CyberSecure Canada Certification: Is It Worth It for an SMB?

An 18-person payroll software company in Kingston is answering a request for proposals from a large credit union. One line stops the team cold: "The proponent must demonstrate recognized cyber security practices." ISO 27001? Not achievable before the deadline. SOC 2? Built for the U.S. market. That leaves a Canadian option designed for smaller organizations: CyberSecure Canada certification.

The program has existed since 2019, yet many business owners have never heard of it, and those who have often wonder whether it still exists. It does, but it has changed hands.

So is it worth the time and money? That depends on who is asking for it. Here is how to decide.

CyberSecure Canada in two minutes

Innovation, Science and Economic Development Canada (ISED) launched the program in 2019 to give small and medium organizations a certification sized for them, with a mark they could display. It was originally built on the 13 baseline cyber security controls published by the Canadian Centre for Cyber Security.

Two important things have changed since:

• Governance. Since March 31, 2023, ISED is no longer the program authority. The SCC is now the official source of program information and continues to accredit the bodies that certify businesses.
• The standard. The baseline controls became a National Standard of Canada, now CAN/DGSI 104:2021, Revision 1 (2024), maintained by the Digital Governance Standards Institute. That revision clarifies what belongs to Level 1 (organizations starting out) versus Level 2 (more mature organizations). A further revision is in the works, so ask your certification body which version applies to your audit.

The standard targets organizations with fewer than 500 employees. It also spells out its own limits: organizations handling sensitive personal or financial information, or supplying high-risk sectors, may need additional controls. Physical security is out of scope.

What the standard actually asks for

CAN/DGSI 104 adds organizational requirements (leadership, accountability) on top of the Cyber Centre's 13 baseline controls. Those 13 controls remain the heart of the exercise:

Nothing exotic here. It is the basic hygiene any insurer or demanding client expects to find.

How certification works

1. Self-review. Get the standard and compare it honestly with your current practices, control by control.
2. Remediation. Close the gaps. This is usually the longest step, especially for MFA, offline backups and documentation.
3. Choose a body. Select a certification body accredited by the SCC. Each sets its own fees, so request several quotes.
4. Audit. The body reviews your evidence. A statement on your honour is not enough.
5. Certification and mark. Once certified, your organization can display the CyberSecure Canada mark under the display requirements.
6. Maintenance. Certification is time-limited, so plan for recertification from day one.

What will the auditor want to see? Expect requests such as an export showing MFA status for every user, a recent backup restore log, a patch compliance report, the training attendance list and your incident response plan with the date of its last review. Keep these in a single shared folder and refresh them every quarter. Recertification then becomes routine, and the next client security questionnaire turns into a short job instead of a week-long scramble.

The real benefits, and the limits

What certification gives you:

• Independent, SMB-sized proof you can attach to a proposal.
• A structured framework so you are not reinventing everything.
• Ready answers for client security questionnaires and for your cyber insurance questionnaire.
• A Canadian mark that buyers who know it will understand.

What it does not give you:

• The name recognition of ISO 27001 or SOC 2, especially outside Canada.
• A guarantee against incidents: an audit is a snapshot in time.
• Compliance with all your legal obligations, starting with privacy law.
• A substitute for a penetration test: the standard checks that controls exist, not how they hold up against an attacker.

Who should go for it?

Probably yes. The Kingston payroll software company, or an IT services firm in Moncton that regularly bids on work for large Canadian organizations. If your clients recognize the mark, the effort-to-benefit ratio is good. The same goes for a managed service provider that wants a simple, credible answer when prospects ask how it protects their data.

Probably something else. A Montréal SaaS startup selling mostly to U.S. customers: they will ask for a SOC 2 report, as we explain in our ISO 27001 vs SOC 2 comparison. A machine shop in Mississauga supplying the defence supply chain: its priority is CPCSC certification.

Not right now. A six-person physiotherapy clinic in Sudbury that no one ever asks about cyber security. For that clinic, the standard is an excellent free checklist; the certificate is a luxury. Its priorities are MFA, backups and its privacy obligations.

Our advice: aim for the standard, then decide on the certificate

The CAN/DGSI 104 controls are worth implementing with or without a certificate. They cover most of what sinks a small business facing ransomware or email fraud.

Paying for the certification audit, on the other hand, is a business decision: how many contracts or clients could the logo bring in? Ask your three largest clients directly. Their answer is worth more than any analysis.

Either way, the first step is the same: measure the gap between your practices and the standard, then fix it. That is exactly what our remediation and hardening service does, turning a list of gaps into fixes that are applied and documented.