Skip to content
Turnkey Security

CyberSecure Canada: are you ready?

CyberSecure Canada is the federal certification program for small and medium organizations. Our free check shows which of its 13 control areas we can see from outside, and what you'll need to show an auditor yourself.

Readiness isn't certification. Only a certification body accredited through the Standards Council of Canada can certify you, after evaluating all 13 controls. Certification lasts two years. We're not a certification body, and passing our checks doesn't mean you'd pass an audit.

The 13 control areas

The program is based on the national standard CAN/DGSI 104:2021 (Rev 2024), which builds on the Canadian Centre for Cyber Security's baseline controls. In plain terms:

  1. Have an incident response plan.
  2. Keep operating systems and applications patched, automatically where possible.
  3. Run security software.
  4. Configure devices securely.
  5. Use strong authentication, including two-factor where you can.
  6. Train staff in security awareness.
  7. Back up and encrypt data.
  8. Secure mobile devices.
  9. Put basic perimeter defences in place, including DMARC on your email domain.
  10. Secure your cloud and outsourced IT services.
  11. Secure your websites.
  12. Control who has access to what.
  13. Secure portable media like USB drives.

What our check covers

From outside, we can check two parts: DMARC and SPF on your email domain (part of control 9) andyour website's encryption and browser security settings (a small, visible part of control 11). Everything else (plans, training, backups, device settings, access control) can only be shown with your own evidence. Verified users see a readiness view in their report, area by area.

Official sources

Run the free check