Canadian IT Compliance Hub
Every Canadian privacy and cyber-security framework that affects your business, PIPEDA, PHIPA, OSFI B-13, Bill C-8, CyberSecure Canada, and cyber insurance, explained in plain language with a readiness matrix for each. CISSP-led, Canadian-owned since 2012.
We serve Canadian businesses with 20 to 200 employees, on-site across Toronto, Hamilton, and Metro Vancouver, and remote-managed coast to coast.
Canadian Compliance Is Its Own Landscape
Most compliance advice you find online is written for U.S. laws, HIPAA, SOX, U.S. state privacy acts, that do not apply to a business operating in Canada. The frameworks that actually govern Canadian SMBs are different: PIPEDA federally, PHIPA in Ontario healthcare, OSFI guidance for federally regulated finance, and a new cyber-security law working through Parliament as Bill C-8. Knowing which ones apply to you, and what each one expects from your IT, is half the battle.
This hub exists to make that simple. For every framework below we maintain two resources: a plain-language guide that explains the law and what it means for a 20-to-200-person business, and a readiness matrix that lists the specific IT controls you need so you can self-assess. Use the guides to understand, and the matrices to act.
We map every program to CIS Controls v8.1, NIST CSF, and SOC 2, external, auditable frameworks, not our own opinion of what is “enough.” Fusion Computing is Canadian-owned, has served Canadian businesses since 2012, and our CEO, Mike Pearlstein, holds the CISSP, the same credential your auditor or insurer expects to see.
Frameworks at a Glance
Each card links to our full guide for that framework. The readiness matrices that pair with them are in the next section, so you can read the explanation first, then score yourself.
PHIPA compliance guideOntario’s health-privacy law. What health information custodians and their IT providers must do for personal health information, including audit trails, access controls, and breach duties.
OSFI B-13 technology and cyber-risk guideOSFI’s guideline for federally regulated financial institutions and their service providers: governance, technology resilience, and cyber-security expectations, with what it means for vendors in the supply chain.
What is Bill C-8 (formerly C-26)Canada’s proposed critical-infrastructure cyber-security law. Who it would cover, the new reporting and program obligations it introduces, and why even non-regulated SMBs should track it.
CyberSecure Canada certification guideThe federal SMB cyber-certification program. The 13 baseline controls, what certification involves, and how it signals security maturity to clients, partners, and insurers.
Cyber insurance requirements in CanadaThe security controls Canadian insurers now require before they will write or renew a policy, MFA, EDR, tested backups, and more, plus what gets a claim denied.
Readiness Matrices: Score Yourself
Each matrix breaks a framework into the specific IT controls it expects, so you can mark what you have, what you are missing, and where the gaps put you at risk. Use them as a self-assessment before an audit, renewal, or board review.
PHIPA IT controls matrixAccess, audit-log, encryption, and breach controls for Ontario health information custodians.
OSFI B-13 readiness matrixTechnology governance and cyber-resilience controls for federally regulated finance and their vendors.
CyberSecure Canada readiness matrixThe 13 baseline security controls mapped to evidence, so you can self-check before certifying.
Cyber insurance readiness matrixThe control checklist insurers score on the application, so you can fix gaps before you apply or renew.
Which Frameworks Apply to You
Almost every Canadian business is covered by PIPEDA. Beyond that, what applies depends on your industry. Find yours below.
Healthcare and clinics (Ontario)
PHIPA plus PIPEDA. You hold personal health information, so audit trails, access control, and breach response are mandatory. Start with the PHIPA guide and IT controls matrix.
Finance, fintech, and insurance
PIPEDA plus OSFI B-13 if you are federally regulated or serve a regulated institution as a vendor. Technology resilience and third-party risk are the focus. Start with the OSFI B-13 guide and matrix.
Critical infrastructure and supply chain
PIPEDA plus the obligations coming under Bill C-8 if you operate in or supply a designated critical sector. Read the Bill C-8 explainer to see whether it reaches you.
Professional services and SMBs generally
PIPEDA applies, and most carry cyber insurance. CyberSecure Canada certification is the practical baseline that satisfies clients and lowers premiums. Start with PIPEDA and the cyber-insurance matrix.
How Fusion Turns a Framework Into a Working Program
Knowing the rule is not the same as meeting it. We close the gap between a checklist and a defensible, day-to-day security posture, mapped to CIS Controls v8.1, NIST CSF, and SOC 2 so the evidence stands up to an auditor, regulator, or insurer.
- Assess: we run the relevant readiness matrix against your real environment and tell you, in writing, where you stand.
- Remediate: we implement the missing controls, MFA, EDR, encryption, tested backups, logging, and access policy, on a prioritized plan.
- Document: we produce the policies and evidence each framework asks for, so an audit or insurance application is a file you already have.
- Maintain: we monitor, patch, and review quarterly, because compliance is a state you keep, not a box you tick once.
It all runs on our CISSP-led cybersecurity and MSSP services, with on-site coverage in Toronto, Hamilton, and Metro Vancouver and remote management coast to coast.
Canadian IT Compliance: Common Questions
Which Canadian compliance frameworks apply to a small business?
Nearly every Canadian business that handles personal information is covered by PIPEDA, the federal private-sector privacy law. On top of that it depends on your industry: Ontario healthcare adds PHIPA, federally regulated finance adds OSFI B-13, and critical-infrastructure operators should track Bill C-8. Most SMBs also need to meet cyber-insurance control requirements, and many pursue CyberSecure Canada certification as a practical baseline.
What is the difference between PIPEDA and PHIPA?
PIPEDA is Canada’s federal law for personal information collected in commercial activity, and it applies broadly across the country. PHIPA is Ontario’s specific law for personal health information held by health information custodians such as clinics, pharmacies, and their IT providers. An Ontario healthcare business is generally subject to both, but PHIPA sets the stricter, health-specific rules for things like audit logging and consent.
Is my business affected by Bill C-8?
Bill C-8 (the successor to the earlier Bill C-26) targets operators in federally regulated critical sectors such as telecommunications, finance, energy, and transportation. If you operate in or supply one of those sectors, it would impose cyber-security program and incident-reporting obligations. Even if it does not reach you directly, larger clients in those sectors may push the requirements down their supply chain. Our Bill C-8 explainer walks through who is covered.
What security controls do Canadian cyber insurers require?
Canadian insurers now expect a baseline before they will write or renew a policy: multi-factor authentication on email and remote access, endpoint detection and response, regularly tested backups, email filtering, security awareness training, and a documented incident-response plan. Missing or misrepresenting these can get a claim denied. Our cyber-insurance readiness matrix lists the full control set so you can fix gaps before you apply.
Is CyberSecure Canada certification worth it for an SMB?
For most small and mid-sized businesses, yes. CyberSecure Canada is the federal certification program built around 13 baseline security controls. Earning it gives you an externally recognized signal of security maturity that reassures clients and partners, often helps with cyber-insurance applications, and forces you to put practical controls in place. Our certification guide and readiness matrix show exactly what is required.
Can an MSP actually make us compliant?
An MSP cannot make legal compliance a guarantee, accountability stays with you, but the right partner does the heavy lifting. Fusion Computing assesses your environment against the relevant matrix, implements the missing technical controls, produces the policies and evidence each framework asks for, and maintains the posture with monitoring and quarterly reviews. We build on CIS Controls v8.1, NIST CSF, and SOC 2 so the work holds up to an auditor, regulator, or insurer.
Book a Free Compliance Review
Tell us your industry and where you are unsure. We will tell you which Canadian frameworks apply to you, where your current IT stands against them, and what it would take to close the gaps. No obligation. CISSP-led, Canadian-owned since 2012.
CIS Controls v8.1, NIST CSF, and SOC 2 aligned. Toronto, Hamilton, and Metro Vancouver, remote coast to coast.
Updated
