Home / Cybersecurity Controls

The Complete CAN/DGSI:104 Cybersecurity Controls

A plain-language guide to every requirement in Canada's national cybersecurity standard for small and medium organizations; organized by section with Level 1 and Level 2 requirements clearly explained.

L1

Level 1: Foundational. Requirements every organization should implement first. No large IT team required.

L2

Level 2: Advanced. Builds on Level 1. Intended for organizations growing their cybersecurity program. You must complete Level 1 before Level 2.

Jump to a Section

Section 4: Organizational Section 5: Baseline Technical Section 6: Environment-Specific

How This Standard Is Structured

CAN/DGSI:104 organizes its requirements into three layers: organizational controls that set the foundation, baseline technical controls every organization should implement, and environment-specific controls that apply depending on how your business operates.

Requirements are split into two maturity levels. You don't have to do everything at once. Level 1 gets you started, and Level 2 builds on that as your program matures.

Section 4: Organizational Controls

Leadership, Accountability & Readiness

Before any technical controls can work, the organization needs the right structure in place. These four requirements establish who is responsible, what training is needed, and how risk is understood.

4.1
Organizational Control | Section 4.1

Leadership Commitment

Cybersecurity programs fail when leadership isn't driving them. This control ensures it's not just an IT problem; it belongs to the whole organization.
Level 1

Requirements

  • Establish a written cybersecurity policy with clear objectives
  • Ensure the resources needed to run the program are funded
  • Communicate cybersecurity expectations across the organization
  • Set measurable metrics and track progress
  • Support managers in taking ownership within their areas
4.2
Organizational Control | Section 4.2

Accountability

Someone has to own this. The standard requires a named senior-level person to be responsible, not just "IT."
Level 1

Requirements

  • Appoint a senior-level person to oversee the cybersecurity program
  • That person develops and maintains the program to meet baseline controls
  • They document and share security policies and procedures with staff
  • They coordinate security awareness training across the organization
  • They lead response to actual or suspected security incidents
  • They identify and prioritize risks based on likelihood and impact
4.3
Organizational Control | Section 4.3

Cybersecurity Training

Most breaches involve human error. Trained employees are your first line of defence.
Level 1

Foundational Requirements

  • Train employees on password policies
  • Teach staff to recognize phishing and suspicious communications
  • Ensure employees keep their devices and software updated
  • Cover the concept of least privilege: only accessing what's needed for the job
Level 2

Advanced Requirements

  • Provide documented proof of regular, ongoing security awareness training for all employees
4.4
Organizational Control | Section 4.4

Cybersecurity Risk Assessment

You can't protect what you haven't thought about. A risk assessment helps you understand what you have, what could go wrong, and what to prioritize.
Level 1

Foundational Requirements

  • Conduct a cybersecurity risk assessment (the standard includes a questionnaire in Annex B to get you started)
  • This can be done internally or with the help of a qualified third party
Level 2

Advanced Requirements

  • The designated senior person leads risk assessments and coordinates implementation of controls
  • Maintain a documented asset register of all IT systems and equipment
  • Document any accepted risks and have them signed off by a senior official
  • Track cybersecurity spending as a number and percentage of total budget
  • Set triggers for when to update or redo the risk assessment
  • Review and test controls at least once a year, or after any major change
  • Commit to continuous improvement over time
Section 5: Baseline Controls

The Core Technical Controls Every Organization Needs

These are the fundamental protections the standard requires regardless of your industry or size. Think of them as the floor, not the ceiling.

5.1
Baseline Control | Section 5.1

Incident Response Plan

High Priority
It's not if something goes wrong, it's when. Having a plan before an incident means faster recovery and less damage.
The standard includes a full incident response plan template in Annex A to help you get started.
Level 1

Requirements

  • Have a documented plan for responding to different types of incidents at different severity levels
  • The plan must name who is responsible for what, including contact information for external parties and regulators
  • Keep a printed hard copy; if your systems are down, you still need access to the plan
  • Test the plan to make sure it actually works, including any third-party security providers
  • Consider purchasing cybersecurity insurance that covers incident response and recovery
5.2
Baseline Control | Section 5.2

Patch and Update Management

Most cyberattacks exploit known vulnerabilities that already have fixes available. Keeping systems updated closes those doors.
Level 1

Requirements

  • Ensure all software and hardware has current security patches installed
  • Enable automatic updates everywhere possible: servers, laptops, desktops, tablets, phones, and network equipment
  • If automatic updates aren't possible on a device, document it and have a manual process in place
  • Do a risk assessment on any system that can't be patched to decide whether to replace it
5.3
Baseline Control | Section 5.3

Security Software

Anti-malware software is a basic but essential protection against viruses, ransomware, spyware, and other threats that target your devices.
Level 1

Requirements

  • Deploy anti-malware protection on all connected devices
  • Solutions must update automatically and actively block threats from running
  • Enable software firewalls on all devices within your network
5.4
Baseline Control | Section 5.4

Secure Configuration

Devices ship with default passwords and settings that are widely known and easy to exploit. Out-of-the-box is not secure.
The Center for Internet Security (CIS) publishes free configuration guides for most common devices and software, a useful reference for getting this right.
Level 1

Requirements

  • Change all default passwords on every device before putting it into service
  • Turn off features, ports, and services that aren't needed
  • Remove unused or outdated software
  • Enable all relevant security settings on each device
5.5
Baseline Control | Section 5.5

Strong User Authentication

High Priority
Stolen or weak passwords are behind the majority of breaches. Multi-factor authentication (MFA) stops most credential-based attacks cold.
Level 1

Foundational Requirements

  • Implement multi-factor authentication (MFA) for all accounts, or document any business decision not to
  • Force password changes if an account is compromised or suspected to be
  • Have a clear written policy on password length, reuse, and the use of password managers
Level 2

Advanced Requirements

  • Implement a password manager for the organization, or document the business decision not to
5.6
Baseline Control | Section 5.6

Backup and Data Protection

High Priority
Ransomware, hardware failure, fire or flood. Backups are what get you back on your feet. Without tested backups, recovery can take weeks or be impossible.
Level 1

Requirements

  • Identify which business information is critical and how often it changes
  • Back up all systems that contain essential information at appropriate intervals
  • Store backups at a fully separate, offsite location on a regular basis
  • Backup files must not be modifiable after creation; this prevents ransomware from corrupting your backups
  • Use encrypted backups where possible, with keys stored securely and separately
  • Regularly test that backups can actually be restored; a backup you've never tested isn't one you can trust
5.7
Baseline Control | Section 5.7

Network Perimeter Defences

Your network is the highway between your systems and the internet. Without controls at the perimeter, threats travel freely in both directions.
Level 2

Requirements (All requirements in this section are Level 2)

  • Deploy a firewall between your internal network and the internet
  • Implement a DNS firewall to block connections to known malicious domains
  • Enable software firewalls on all devices, or document alternative measures
  • Require encrypted connections to all corporate systems
  • Require VPN with multi-factor authentication for all remote access
  • Use WPA2-AES at minimum for Wi-Fi (WPA2-Enterprise or WPA3-Enterprise preferred)
  • Separate your guest/public Wi-Fi from your internal corporate network
  • Implement DMARC, DKIM, and SPF on all organization email domains
  • Enable email filtering to detect and block malicious messages
  • Remote workers should connect through a separate, secure network
5.8
Baseline Control | Section 5.8

Access Control and Authorization

Giving everyone admin access because it's convenient is one of the most common security mistakes. Least privilege means people only get access to what they genuinely need for their job.
Level 1

Foundational Requirements

  • Give users only the minimum access needed to do their jobs
  • Restrict admin privileges: only grant them when actually required
  • Admin accounts must be used only for administrative tasks, not for everyday things like email or browsing
  • Remove accounts and access when an employee leaves or changes roles
Level 2

Advanced Requirements

  • Implement a centralized identity and access management system (such as Active Directory or a cloud identity service)
Section 6: Environment-Specific Controls

Controls That Apply Based on How You Operate

These controls apply depending on your organization's environment. If you use mobile devices, run a website, accept payments, store data in the cloud, or use USB drives; these sections apply to you. Many small businesses will need several of these.

📱 Secure Mobile Devices

Section 6.1: Applies if employees use phones or tablets for work
  • L1: Train users to avoid open Wi-Fi, limit Bluetooth use, and always use VPN on public networks
  • L2: Decide on an ownership model (company-owned or BYOD) and document it
  • L2: Separate work and personal data on devices with access to corporate systems
  • L2: Only allow apps from trusted, approved sources
  • L2: Encrypt all sensitive information stored on mobile devices
  • L2: Implement a mobile device management (MDM/EMM) solution, or document the risks of not doing so

☁️ Cloud and Outsourced IT

Section 6.2: Applies if you use cloud storage, SaaS, or managed IT
The standard includes a full vendor risk questionnaire in Annex C, useful for evaluating your IT providers.
  • L1: Evaluate your risk tolerance around how vendors handle your sensitive data
  • L2: Complete a formal risk assessment of all external IT providers
  • L2: Require vendors to provide compliance documentation (SOC 2, ISO 27001, PCI-DSS, or equivalent)
  • L2: Assess risks related to where your data is stored (jurisdiction matters)
  • L2: Ensure all communication with cloud services is encrypted
  • L2: All cloud admin accounts must use MFA and be separate from internal admin accounts

🌐 Website Security

Section 6.3: Applies if you operate a website or web application
If your website is managed by a third party, these requirements can be included in your contract with them.
  • L1: Demonstrate awareness of the OWASP Top 10: the most common web vulnerabilities
  • L2: Remediate all high and medium OWASP Top 10 risks on primary websites to an acceptable risk level
  • L2: Define the OWASP ASVS level your site needs to meet

💿 Portable Media

Section 6.4: Applies if employees use USB drives or portable storage
  • L1: Only allow use of organization-owned, secure portable media; no personal USB drives
  • L2: Maintain strong asset controls for all portable storage devices
  • L2: Require encryption on all portable media
  • L2: Have a process for securely wiping or destroying media before disposal

💳 Point of Sale & Financial Systems

Section 6.5: Applies if you accept card payments or operate financial systems
  • L1: Follow the Payment Card Industry Data Security Standard (PCI DSS)
  • L1: Use a firewall to isolate payment terminals from the rest of your network and from the internet

📋 Security Log Management

Section 6.6: Logs are your audit trail for detecting threats and understanding incidents
All requirements in this section are Level 2 only.
  • L2: Establish a written log management policy covering what gets logged, how logs are backed up, and how long they're retained
  • L2: Logs to capture include: user login events, security events, file access, device configuration changes, firewall logs, and intrusion detection logs

Not Sure Where You Stand on These Controls?

Many organizations already have some of these protections in place but may still have gaps. A cybersecurity assessment can help identify which controls are already implemented and where improvements are needed.

Assess Your CAN/DGSI:104 Readiness

Need help implementing these controls? MTech Cyber specializes in CAN/DGSI:104 implementation for Canadian SMBs.

Know Where You Stand

Take our free CAN/DGSI:104 Readiness Assessment and receive a personalized report on which controls you have in place and where improvements are needed.

Assess Your CAN/DGSI:104 Readiness View Implementation Guide