CyberSecure Canada Readiness Matrix
In one paragraph
CyberSecure Canada is the federal cyber-certification program for Canadian small and medium businesses, administered by the Standards Council of Canada (SCC) since March 31, 2023. It targets businesses with 1 to 499 employees and certifies against 13 baseline controls drawn from the Baseline Cyber Security Controls for Small and Medium Organizations published by the Canadian Centre for Cyber Security (CCCS). Certification involves a self-assessment, evidence package, and third-party audit conducted by an accredited certification body. This matrix maps each of the 13 controls to CIS Controls v8.1, lists the evidence the auditor will request, and flags the controls SMBs most often fail at first attempt.
📚 New here? Start with CyberSecure Canada Certification: The Complete Guide for the plain-language overview, then use this matrix to audit your controls.
What CyberSecure Canada is
CyberSecure Canada is the federal Government of Canada cyber-certification program. It was launched in 2019 under Innovation, Science and Economic Development Canada (ISED), moved to the Standards Council of Canada (SCC) on March 31, 2023, and was refreshed in 2024 to align with the CCCS Baseline Cyber Security Controls for Small and Medium Organizations (Baseline Controls v1.2). The program is voluntary but is increasingly required or preferred in:
- Federal government procurement, included in evaluation criteria for many federal IT and professional services tenders.
- Provincial and municipal procurement, adopted by some procurement offices as a baseline trust signal.
- Supply-chain assurance, large Canadian enterprises increasingly require it of SMB vendors.
- Cyber-insurance underwriting, some carriers use it as evidence of baseline maturity (premium discount).
Certification is issued by accredited Certification Bodies (CBs), not by the SCC or CCCS directly. The SCC accredits those CBs under ISO/IEC 17021-1 and publishes the certification process on its CyberSecure Canada program pages. Older articles that tell you to apply through ISED or CCCS are out of date.
Who CyberSecure Canada applies to
CyberSecure Canada is scoped to small and medium organizations:
- Small organizations, fewer than 100 employees.
- Medium organizations, 100 to 499 employees.
Federal Crown corporations, federal departments, and organizations with 500+ employees are outside the program scope and align instead to ITSG-33 or to sector-specific guidance (OSFI B-13, ITSG, etc.).
The 13 baseline controls
The 13 control areas map directly to the CCCS Baseline Cyber Security Controls v1.2 sections. The matrix below adds CIS Controls v8.1 alignment, the evidence the auditor will request, and the typical first-audit failure mode.
| # | Baseline control | CCCS reference | CIS v8.1 | Evidence requested |
|---|---|---|---|---|
| 1 | Incident response plan | 3.1 | 17.1, 17.4 | Written IRP + tabletop report |
| 2 | Automatic patching | 3.2 | 7.3, 7.4 | Patch policy + RMM compliance export |
| 3 | Backup and encryption | 3.3 | 11.1, 11.4, 3.6 | Backup policy + restore-test evidence |
| 4 | Strong authentication (MFA) | 3.4 | 6.3, 6.5 | Conditional Access policy export |
| 5 | Employee training | 3.5 | 14.1-14.3 | Training records + phishing dashboard |
| 6 | Basic perimeter defences | 3.6 | 12.2, 13.10 | Firewall config + DNS-filter logs |
| 7 | Secure mobility | 3.7 | 4.1, 4.7 | MDM compliance report |
| 8 | Cloud / outsourced IT | 3.8 | 15.1-15.7 | Vendor inventory + attestation packet |
| 9 | Secure portable media | 3.9 | 10.6, 3.10 | USB control policy + encryption report |
| 10 | Secure websites | 3.10 | 2.7, 16.7 | TLS + WAF + dependency scan reports |
| 11 | Access control & authorization | 3.11 | 5.4, 6.7, 6.8 | PAM policy + quarterly access review |
| 12 | Secure configuration of devices | 3.12 | 4.1, 4.2, 4.6 | Baseline image / Intune profile export |
| 13 | Anti-malware on devices | 3.13 | 10.1, 10.6, 10.7 | EDR/AV coverage report |
The five controls SMBs most often fail at first audit
- Incident response plan (control 1). An IRP without a documented tabletop exercise in the past 12 months reads as theoretical to the auditor.
- Backup and encryption (control 3). Backups exist but no documented restore test inside the last 6 months.
- Employee training (control 5). Training records that don’t link individual employees to completion dates, or no phishing simulation evidence.
- Cloud / outsourced IT vendor management (control 8). No vendor inventory, no SOC 2 / equivalent attestations collected for material vendors.
- Access control (control 11). Privileged accounts exist but quarterly review evidence does not.
The CyberSecure Canada certification process
- Self-assessment against the 13 baseline controls published by CCCS.
- Evidence package assembly, written policies, technical configuration evidence, training records.
- Engage an accredited Certification Body. The SCC publishes the list of accredited CBs. Pricing typically $5,000-$15,000 for an SMB, depending on size.
- Audit, typically remote or hybrid, lasting 1-3 days.
- Certification, valid for two years. Annual maintenance attestation required.
- Renewal, re-audit at 24 months.
How this fits with CIS Controls and ISO 27001
CyberSecure Canada is a baseline. Organizations that need a stronger trust signal, federal critical infrastructure suppliers, FRFI vendors, larger enterprises, typically progress to one of:
- CIS Controls v8.1 IG2 / IG3 for SMBs that want defensible technical maturity without a formal cert.
- ISO 27001 for organizations that need an internationally recognized ISMS certification.
- SOC 2 Type II for SaaS providers and MSPs serving regulated industries.
- FedRAMP (US) or CPCSC equivalents for organizations bidding into federal critical-systems work.
About this matrix
This matrix is maintained by Mike Pearlstein, CISSP, Founder and CEO of Fusion Computing Limited. Fusion Computing has guided Canadian SMBs through CyberSecure Canada and CIS Controls v8.1 baseline implementations since 2019. We are a Microsoft Solutions Partner (Security, Modern Work, Infrastructure) and a CompTIA Managed Services Trustmark holder.
If you’d like a PDF version of this matrix or want a pre-audit gap analysis, book a 30-minute consult.
Common Questions
What is CyberSecure Canada?
CyberSecure Canada is the federal cyber-security certification program for Canadian small and medium businesses (1-499 employees), administered by the Standards Council of Canada (SCC) since March 31, 2023. It certifies against 13 baseline cyber-security controls published by the Canadian Centre for Cyber Security (CCCS). Certification is voluntary but is increasingly required or preferred in federal procurement, supply-chain assurance, and cyber-insurance underwriting.
Who issues CyberSecure Canada certification?
Certification is issued by accredited Certification Bodies (CBs), not directly by the SCC or CCCS. The SCC accredits the CBs under ISO/IEC 17021-1 and publishes the list of accredited bodies. The CB performs the audit, reviews evidence, and issues the certification, which is valid for two years with an annual maintenance attestation.
How much does CyberSecure Canada certification cost?
Audit cost for an SMB typically ranges $5,000-$15,000 depending on organization size, complexity, and the chosen Certification Body. Internal preparation cost (policy authoring, evidence assembly, remediation of gaps) varies widely, typically $10,000-$40,000 for an SMB that does not already have mature security operations.
What controls are in CyberSecure Canada?
Thirteen baseline controls: (1) incident response plan, (2) automatic patching, (3) backup and encryption, (4) strong authentication (MFA), (5) employee training, (6) basic perimeter defences, (7) secure mobility, (8) cloud and outsourced IT, (9) secure portable media, (10) secure websites, (11) access control and authorization, (12) secure configuration of devices, (13) anti-malware on devices.
How long is CyberSecure Canada certification valid?
Certification is valid for two years. An annual maintenance attestation is required between full audits. After two years a re-audit is required to maintain certification.
How does CyberSecure Canada compare to ISO 27001?
CyberSecure Canada is a baseline-level Canadian-specific certification scoped to SMBs (1-499 employees) and certifies against 13 prescribed controls. ISO 27001 is an internationally recognized Information Security Management System (ISMS) standard with no organizational size limit and a much broader control set (93 controls in Annex A under the 2022 revision). Many Canadian SMBs use CyberSecure Canada as the baseline and progress to ISO 27001 when international customers or larger Canadian enterprises require it.
Part of the Canadian IT Compliance Hub – PIPEDA, PHIPA, OSFI B-13, Bill C-8, CyberSecure Canada and cyber-insurance guidance for Canadian SMBs, in one place.
Updated
