Baseline Controls News Resources Glossary About
Free Assessment
Home / News / Understanding Canada's Baseline Cyber Security Controls for SMBs
January 15, 2026 Standards 5 min read

Understanding Canada's Baseline Cyber Security Controls for SMBs

By Cybersecurity Canada Editorial Team | Published January 15, 2026 ยท Updated October 9, 2026
Understanding Canada's Baseline Cyber Security Controls for SMBs

The CCCS baseline controls are 13 cyber security practices that the Canadian Centre for Cyber Security (CCCS) recommends for small and medium organizations, published as ITSM.10.089. They are voluntary guidance written for organizations with fewer than 500 employees, and CCCS says they apply the 80/20 rule: "achieve 80% of the benefit from 20% of the effort." A small business should first check where it stands against all 13, then close the biggest gaps.

What are the CCCS baseline controls for small business?

The CCCS baseline controls are a short list of security practices, each with a plain summary statement in ITSM.10.089. CCCS designed them to protect against cybercrime, which it judges to be the threat most likely to affect small and medium organizations. Here is each control and what CCCS recommends, in its own words where possible:

  1. Incident Response Planning (BC.1): have "a basic plan for how to respond to incidents of varying severity."
  2. Patch Management (BC.2): enable automatic patching for all software and hardware, or run full vulnerability and patch management.
  3. Anti-Malware (BC.3): enable anti-malware that updates and scans automatically.
  4. Secure Configuration (BC.4): change default passwords, turn off unnecessary features and enable relevant security features on all devices.
  5. Authentication (BC.5): implement two-factor authentication wherever possible, and document any decision not to. See our guide to multi-factor authentication.
  6. Security Awareness (BC.6): invest in cyber security awareness and training for employees.
  7. Data Backup (BC.7): back up systems that contain essential business information and make sure they can be restored.
  8. Mobile Devices (BC.8): decide on an ownership model for mobile devices and document the rationale and risks.
  9. Network Security (BC.9): have dedicated firewalls between the corporate network and the internet.
  10. Cloud Services (BC.10): require cloud service providers to share a SOC 3 report showing they meet the AICPA Trust Service Principles.
  11. Web Security (BC.11): make sure websites meet OWASP ASVS Level 1.
  12. Access Control (BC.12): give accounts only the access they need and restrict administrator privileges.
  13. Portable Media (BC.13): use only organization-owned, encrypted portable media with strong asset controls.

Who are the baseline controls for?

The baseline controls are for Canadian organizations with fewer than 500 employees. ITSM.10.089 uses the Innovation, Science and Economic Development Canada definition of a small or medium organization and says larger organizations "should invest in more comprehensive cyber security measures." The document also recommends looking beyond the baseline (for example, the CIS Controls or the NIST Cybersecurity Framework) once the basics are in place.

Before the 13 controls, ITSM.10.089 lists organizational controls. These ask you to confirm your size, list which systems are in scope, assess the value of your information, identify your primary threat and confirm your investment level. Working through them first gives every later decision a clear scope.

Are the baseline controls mandatory?

No. The baseline controls are guidance, not law, so most Canadian businesses adopt them voluntarily. A related National Standard of Canada, CAN/DGSI 104, underpins the CyberSecure Canada certification program, which the Standards Council of Canada says gives certified businesses "official recognition of their compliance to the baseline security controls." Certification is also voluntary.

The controls still carry weight. Canadian privacy law expects organizations to protect personal information with safeguards appropriate to its sensitivity, and the baseline controls are a common Canadian reference point for what reasonable safeguards look like. Customers, insurers and partners may ask about them too. This is general information, not legal advice.

Why do the baseline controls matter for Canadian SMBs?

Because most Canadian businesses still lack the basics on paper. Statistics Canada's 2023 Canadian Survey of Cyber Security and Cybercrime, released October 21, 2024, found that about 1 in 6 (16%) Canadian businesses were impacted by cyber security incidents in 2023, and just over 1 in 4 (26%) had written cyber security policies in place.

The same survey found that scams and fraud were the most common method behind those incidents. That matches the baseline controls' focus on cybercrime: training (BC.6), two-factor authentication (BC.5) and backups (BC.7) all reduce the damage a successful scam or ransomware attack can do.

Where should a small business start?

Start with an honest assessment of where you are today. The baseline controls are deliberately ordered with incident response planning first, because every other response depends on having a plan. Common early wins include automatic patching (BC.2), two-factor authentication (BC.5) and tested backups (BC.7), since each is a setting or routine rather than a major purchase.

Our free assessment evaluates your practices against all 13 control areas in under 30 minutes and gives specific recommendations, without collecting your answers. Once you have your results, see how to use your assessment results. One question to ask your IT lead or provider this week: which of the 13 baseline controls do we already meet, and how do we know?

Explore each control area

Each of the 13 baseline control areas has its own guide on this site:

You can also read the official ITSM.10.089 document on the Canadian Centre for Cyber Security's website.

Free Assessment

How prepared is your business?

Find out where you stand against Canada's 13 Baseline Cyber Security Controls. The assessment takes under 30 minutes and your answers stay in your browser.

Check Your Score

Frequently Asked Questions

What are the CCCS baseline controls for small business?

The CCCS baseline controls are 13 security practices the Canadian Centre for Cyber Security recommends for small and medium organizations in its publication ITSM.10.089. They cover incident response planning (BC.1), patch management (BC.2), anti-malware (BC.3), secure configuration (BC.4), authentication (BC.5), security awareness training (BC.6), data backup (BC.7), mobile device security (BC.8), network security (BC.9), cloud services security (BC.10), web application security (BC.11), access control (BC.12), and portable media (BC.13).

Who publishes the Baseline Cyber Security Controls?

The Canadian Centre for Cyber Security (CCCS), part of the Communications Security Establishment, publishes them as ITSM.10.089, Baseline Cyber Security Controls for Small and Medium Organizations. The document is free on the CCCS website. A related National Standard of Canada, CAN/DGSI 104, underpins the voluntary CyberSecure Canada certification program.

What is ITSM.10.089?

ITSM.10.089 is the CCCS publication number for Baseline Cyber Security Controls for Small and Medium Organizations. It defines the 13 baseline control areas plus a short set of organizational controls (sizing, scope, the value of your information, your threat level and your investment level) that come first. CCCS says it applies the 80/20 rule: achieve 80% of the benefit from 20% of the effort.

Are the Baseline Controls mandatory for Canadian businesses?

No. The Baseline Controls are guidance rather than legislation, so implementing them is voluntary for most Canadian businesses. They matter anyway: Canadian privacy law requires organizations to protect personal information with safeguards appropriate to its sensitivity, and the Baseline Controls are a widely referenced Canadian benchmark for what reasonable safeguards look like. This is general information, not legal advice.

Where should a small business start with the Baseline Controls?

Start by establishing where you currently stand rather than trying to implement all 13 areas at once. ITSM.10.089 begins with organizational controls: confirm the controls fit your size, list which systems are in scope, decide what your information is worth and identify your main threat. A structured self-assessment against all 13 control areas then shows which gaps to close first; our free assessment does this in under 30 minutes without collecting your data.

Do the Baseline Controls guarantee my business will not be breached?

No. The Baseline Controls are not about achieving perfect security. They establish a minimum security posture that meaningfully reduces the likelihood of a successful attack. No set of controls eliminates risk entirely. Their value is that they concentrate limited resources on the practices that address cybercrime, which CCCS designed them to be effective against.

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). Understanding Canada's Baseline Cyber Security Controls for SMBs. Retrieved from https://cybersecuritycanada.ca/news/posts/understanding-canadas-baseline-cyber-security-controls/

Permanent URL: https://cybersecuritycanada.ca/news/posts/understanding-canadas-baseline-cyber-security-controls/ · Last updated October 9, 2026

Disclaimer: This article is intended for general informational purposes only and does not constitute professional cybersecurity, legal, IT, or compliance advice. While we strive to ensure accuracy, the cybersecurity landscape changes rapidly and information may become outdated. Organizations should consult with qualified cybersecurity professionals and legal counsel to assess their specific situation and develop appropriate security policies. Use of this information is at your own risk. See our Privacy Policy for more information.

Cybersecurity Canada is an independent resource and is not affiliated with, endorsed by, or connected to the Canadian Centre for Cyber Security, the Communications Security Establishment, or the Government of Canada.

How does your organization measure up?

Take our free cybersecurity assessment based on the Canadian Centre for Cyber Security's Baseline Controls. 50 questions, under 30 minutes, 100% confidential. Your answers never leave your browser.

Take the Free Assessment