CyberSecure Canada: who it is for, and when ISO 27001 is the better choice

In 2018, Ottawa announced CyberSecure Canada with CA$28.4 million and a goal of 5,000 certified SMBs by 2025. By August 2023, 41 companies were certified, only two of them since the start of that year (CIGI, 2023).

That number does not mean the standard is a bad one. I read the revision published in July 2026, and it contains serious requirements. It mostly means that most SMBs do not know what this certification is for, or when it is enough.

I should be clear from the start. I am an ISO 27001 auditor. You probably expect me to say that ISO 27001 is always the best answer. It is not. I will also tell you when it is too much.

A quick reminder

CyberSecure Canada (CyberSécuritaire Canada in French) is a certification for small and medium organizations, generally those with fewer than 500 employees. It is based on the national standard CAN/DGSI 104, which sets baseline cybersecurity controls inspired by those of the Canadian Centre for Cyber Security.

The program has changed hands. Since March 2023, Innovation, Science and Economic Development Canada (ISED) no longer owns it. The Digital Governance Standards Institute keeps the standard up to date, and the Standards Council of Canada (SCC) still accredits the bodies that perform the audits.

A warning: several pages online, including the federal government’s own page, still talk about “13 controls.” That was the original version. The current version, CAN/DGSI 104:2021 / Rev. 2:2026, has 18 requirements in three blocks:

• 4 organizational controls: management commitment, responsibilities, training, and risk assessment
• 8 baseline controls, such as an incident response plan, automatic patching, two-factor authentication, and backups
• 6 controls that depend on your environment, such as mobile devices, cloud services, websites, payment terminals, and log management

Each requirement has a level 1 for organizations just starting out and a level 2 for those that want to go further.

Three options, not two

A Quebec SMB that wants to show its customers it takes security seriously now has three doors in front of it.

The first is CyberReady validation, launched in February 2025 by the Digital Governance Council. It checks your practices against the same CAN/DGSI 104 standard, either from your own statements or through a deeper audit. It is not a certification, though. You receive a validation attestation and a trust mark. Never present it to a customer as a certification.

The second is CyberSecure Canada certification. An accredited body comes and checks that the standard’s requirements are in place. The certificate is valid for two years. According to CIGI, the certification itself cost between CA$2,000 and CA$5,000 in 2023, not counting the work to put the controls in place.

The third is ISO 27001 certification, the international standard for information security management. An accredited body audits your management system in two stages, then comes back every year for a surveillance audit, on a three-year cycle. For an SMB of 25 to 50 employees, I estimated in 2022 a total cost of CA$35,000 to CA$100,000, including support, your employees’ time, training, and the certification audit (the breakdown here).

The two figures do not measure the same thing. The gap still gives the order of magnitude.

The real difference: who chooses the controls

It is easy to think the Canadian standard is a simple checklist. It is not. It requires management to commit, a member of the management team to be named responsible for cybersecurity, and a risk assessment to be done.

Look at how that assessment works, though. At level 1, it is a 21-question questionnaire answered yes or no. The standard itself says it is not meant to produce a risk score. Even at level 2, requirement 4.4.3.8 is clear: whatever the assessment result, you must apply the baseline controls or replace them with compensating controls.

In other words, the Canadian standard chooses the controls for you. Your risk assessment is there to add some, not to decide.

ISO 27001 works the other way around. You identify your risks, then you choose, from the 93 controls in Annex A, the ones that address them. You justify your choices in a Statement of Applicability, including the controls you exclude. Then come internal audits, the annual management review, measured objectives, and the correction of gaps.

For an SMB with no in-house expertise, the Canadian approach has a real advantage: it avoids building a risk analysis from nothing. For a company whose risks are out of the ordinary, that is a limit.

In practice, CyberSecure Canada proves that recognized controls are in place. ISO 27001 proves that your company knows how to decide what to protect and how to adjust those decisions when things change, such as a new MSP, the departure of your IT lead, or a new cloud application.

That is also why compliance has to belong to the company. A consultant can help you put controls in place. A consultant cannot make your risk decisions for you.

The Canadian standard itself says when it is not enough

The most useful passage in CAN/DGSI 104 is a note in its scope. It says that organizations, whatever their size, that handle personal, financial, or sensitive information, that have strong availability requirements, or that supply high-risk sectors may need controls beyond the standard. It points them to the NIST and ISO/IEC frameworks.

The standard goes further at level 2. An SMB that outsources its IT must require its suppliers to hold an independent certification or attestation, such as ISO 27001 or SOC 2, or document why it does not. If you are an MSP or a cloud software vendor, you are the one who will receive that request.

When ISO 27001 is too much

I say this as an auditor. An SMB of 15 employees, with mostly Quebec customers and no specific contractual requirement, probably does not need ISO 27001 today.

The cost is not only the audit. It is one person’s time, inside the company, to keep the system alive: the risk register, the internal audits, the annual review, the follow-up of actions. If nobody has that time, you risk getting the certificate in the first year and a major nonconformity at the next surveillance audit.

In that case, CyberSecure Canada, or even CyberReady validation, is a better starting point. The baseline controls aim directly at what shows up most often in SMBs, such as accounts without two-factor authentication, late patches, and backups that were never tested.

The dilemma is real. You pay less today, but you may have to start over in two years if a customer requires ISO 27001. The work is not lost, though. Your backups, your patches, and your two-factor authentication sit directly in ISO 27001 Annex A (controls 8.13, 8.8, and 8.5). What will be missing is the management layer.

When ISO 27001 is the better choice

The Canadian certification has almost no recognition outside the country. An American customer will ask you for SOC 2 or ISO 27001. A European customer will ask you for ISO 27001. If you sell outside Canada, or you plan to, the question is settled.

ISO 27001 also becomes the better choice in these situations:

• your customers send you security questionnaires that run for several pages, and you spend weeks on them every year
• you host or process your customers’ data, such as a cloud software vendor, an MSP, a call centre, or an accounting firm
• a major customer requires ISO 27001 in its tenders
• you are growing fast and your security still rests on one or two people
• you have someone inside who can carry the system, with real support from management

In my view, the last point is the one SMBs underestimate the most. Without it, the other four are not enough.

Bill 25: an advantage for ISO 27001

Here is a difference few people notice. The Canadian standard never mentions Quebec’s Bill 25 (Loi 25). Its risk-assessment questionnaire asks whether you know your responsibilities under the federal Privacy Act, a law that applies to federal institutions, not to private-sector businesses.

ISO 27001 forces you to deal with the question. Annex A control 5.34 requires you to identify and meet the privacy and personal-information requirements in the laws and contracts that apply to you. For a Quebec SMB, that is Loi 25. Since every company holds at least the personal information of its employees, excluding this control from the Statement of Applicability is hard to justify.

The auditor will therefore check that you have identified Loi 25 and that you have measures in place, such as a privacy officer, privacy impact assessments, and a confidentiality incident register. The audit works by sampling, though. The certificate shows that you manage the question. It does not replace a proper Loi 25 compliance analysis.

In practice: five questions before you choose

Before you ask anyone for a quote, answer these questions with your management team.

1. Does a customer, current or targeted, require a specific certification? Which one, in writing?
2. Are your customers only in Canada, or also in the United States and Europe?
3. Do you host or process your customers’ data, or a lot of personal information?
4. Who, inside the company, will spend time on security every month, for years, and not only during the certification project?
5. Do you at least have the baseline controls in place, such as two-factor authentication, automatic patching, and tested backups?

If the answer to the first question is the name of a certification, the decision is made. If you answer no to questions 2 and 3, start with CyberSecure Canada or with CyberReady validation. If you answer yes to either of them and you have a real name for question 4, aim for ISO 27001. The Canadian standard points you there itself.

If you answer no to the fifth, whatever the program, start there.

So?

In short, CyberSecure Canada did not fail because the standard is bad. According to Matt Malone of CIGI, the problem is that the program is voluntary and that the government never clarified why companies would need it. A certification that nobody requires is hard to justify for an SMB that is already short on time.

The 2026 revision could move things, because it pushes certified companies to require evidence from their suppliers. I do not yet know whether that will be enough. If your customers start asking you for CyberSecure Canada, I am curious to hear it.

Unsure which one fits your business? Let’s talk.