Common Failures and Official Sources
CyberSecure Canada and the Cyber Centre baseline controls: what SMEs need and what a provider can cover
The Cyber Centre's 13 baseline controls for SMEs, how CyberSecure Canada certification relates, and which a managed provider can run.
The Canadian Centre for Cyber Security publishes Baseline Cyber Security Controls for Small and Medium Organizations, a practical set of 13 controls aimed at organisations with fewer than 500 employees. CyberSecure Canada is a voluntary certification program for small and medium organisations built on those baseline controls. ISED ran the program at launch; ISED says it has not been the program authority since 31 March 2023, and current information on certification and recertification is published by the Standards Council of Canada (SCC). No law requires private businesses to be certified, but clients and procurement processes sometimes ask for it. For a buyer of managed security, the baseline is a useful map: it shows which controls a provider can run for you, which stay with your staff, and where quotes leave gaps.
This guide is part of managed security failures and official sources.
The 13 baseline controls and who usually owns them
| # | Baseline control (Cyber Centre title) | Can a managed provider run it? | What stays with you |
|---|---|---|---|
| 1 | Develop an incident response plan | Helps write and test it | Decisions, contacts, approval |
| 2 | Automatically patch operating systems and applications | Yes, usually within managed endpoint services | Approving downtime; legacy systems |
| 3 | Enable security software | Yes: antivirus, EDR, MDR | Ensuring every device has it |
| 4 | Securely configure devices | Yes, through device management | Exceptions for business needs |
| 5 | Use strong user authentication | Configures MFA and password policy | Enforcing it for everyone, including owners |
| 6 | Provide employee awareness training | Delivers training and phishing simulations | Time for staff to take it |
| 7 | Backup and encrypt data | Runs backups and encryption | Deciding what matters and testing restores |
| 8 | Secure mobility | Manages phones and tablets | Policy on personal devices |
| 9 | Establish basic perimeter defences | Managed firewall, DNS filtering | Telling the provider about new sites or connections |
| 10 | Secure cloud and outsourced IT services | Reviews settings, monitors cloud tenants | Choosing and contracting providers responsibly |
| 11 | Secure websites | Can scan and monitor | Your web developer and hosting contract |
| 12 | Implement access control and authorization | Configures roles and admin accounts | Approving who gets access; removing leavers promptly |
| 13 | Secure portable media | Device control policies | Rules for USB drives and removable media |
The document is version 1.2, and its date-modified shows 2020; check the Cyber Centre website for any newer version before relying on details.
Using the baseline to read a quote
Illustrative example. A 30-person Kelowna property-management firm gets a proposal for "complete security" at $60 per user per month. Mapping it against the baseline shows that the bundle covers controls 2, 3, 4, 5, 6, 8 and 9, but not backups (7), cloud tenant review (10), website security (11) or an incident response plan (1). The firm then asks for prices on the missing pieces:
| Missing control | Option | Illustrative cost |
|---|---|---|
| 7 Backup and encrypt | Cloud backup of Microsoft 365 and file server | 30 × $5 × 12 = $1,800 a year |
| 10 Cloud services | Quarterly tenant configuration review | 4 × $600 = $2,400 a year |
| 11 Websites | Ask web host; monthly vulnerability scan | $50 × 12 = $600 a year |
| 1 Incident response plan | Fixed-fee plan and tabletop | $3,500 one-time |
The bundle itself costs 30 × $60 × 12 = $21,600 a year. With the additions, year one is $21,600 + $1,800 + $2,400 + $600 + $3,500 = $29,900 before tax. Comparing two providers now means comparing the same 13 controls.
CyberSecure Canada certification
What we could confirm from official sources:
- It is a voluntary certification aimed at small and medium organisations.
- It is based on the Cyber Centre's baseline controls for small and medium organizations.
- ISED is no longer the program authority as of 31 March 2023; for certifications obtained after that date and for recertification, ISED points to the Standards Council of Canada website.
- The Cyber Centre's Learning Hub offers a course on cyber security for small and medium organizations.
SCC accreditation bulletins indicate that certification bodies in the scheme certify to the national standard CAN/CIOSC 104:2021, now maintained by the Digital Governance Standards Institute as CAN/DGSI 104:2021 (Rev 1: 2024), and that the revision clarified Level 1 versus Level 2 requirements in areas such as training, risk assessment and backups. ISED's CyberSecure Canada information sheet describes the certification mark as valid for two years; that sheet dates from 2020, so confirm the current term with the certification body. The accredited certification bodies, audit process, fees and validity period should be checked on the SCC website. Certification bodies set their own fees. If a client asks for CyberSecure Canada certification, ask whether an equivalent independent assessment would also satisfy them.
A managed provider can help you prepare, but your organisation is certified, not the provider. Ask the provider for evidence you can use in the audit: patch reports, MFA coverage, backup test records and training completion.
Common gaps the baseline reveals
- Owners and executives exempt from MFA. Control 5 should apply to everyone.
- Leavers' accounts left active. Control 12 requires prompt removal.
- Backups never restored. Control 7 is only met if restores work.
- Cloud services assumed secure by default. Control 10 means reviewing settings.
- No incident response plan. Control 1 comes first for a reason; an IR retainer can fund it.
Add the baseline mapping to your due-diligence checklist and see scope gaps for related patterns. Insurers often ask about several of these controls; see cyber-insurance security requirements.
Frequently asked questions
Is the baseline enough for a regulated business?
It is a minimum aimed at small and medium organisations. Regulated sectors, designated operators under the Critical Cyber Systems Protection Act and businesses with demanding clients may need more.
How much does certification cost?
Fees are set by certification bodies and depend on size and scope. Check current information with the Standards Council of Canada and request quotes.
Can my MSSP certify me?
Your provider can help you prepare, but certification is done by an accredited certification body under the program rules.
Do the controls apply to a 5-person business?
Yes, scaled down. Many controls, such as MFA, patching and backups, cost little and matter most.
Sources
- Canadian Centre for Cyber Security — Baseline Cyber Security Controls for Small and Medium Organizations, Learning Hub
- Innovation, Science and Economic Development Canada — CyberSecure Canada program page and change of program authority
- Standards Council of Canada — current CyberSecure Canada certification information
