Canada's national cybersecurity certification program, helping organizations demonstrate that they have implemented recognized security practices to protect systems, data, and operations.
CyberSecure Canada is Canada's national cybersecurity certification program. It was created by the Government of Canada and, since March 31, 2023, has been administered by the Standards Council of Canada (SCC), which accredits the certification bodies that assess organizations. The program allows organizations to demonstrate that they have implemented recognized cybersecurity practices designed to protect their systems, data, and operations.
The certification is intended primarily for small and medium organizations that want to strengthen their cybersecurity posture and demonstrate responsible security practices to customers, partners, and suppliers.
Organizations that achieve certification can show that they meet a recognized baseline for cybersecurity protection.
CyberSecure Canada was launched by Innovation, Science and Economic Development Canada (ISED) and has been administered by the Standards Council of Canada since March 2023. It helps Canadian businesses demonstrate cybersecurity readiness to customers, partners, and insurers.
Program Page at SCC ↗Understanding the relationship between the framework and the certification program.
The cybersecurity framework that defines the technical controls organizations should implement to protect their systems and data.
Leads to
The certification program that allows organizations to demonstrate they have implemented the controls outlined in CAN/DGSI:104.
In simple terms: CAN/DGSI:104 defines what to implement. CyberSecure Canada is the certification that proves you've implemented it.
Certification is designed primarily for small and medium organizations that want to demonstrate strong cybersecurity practices.
Companies that store customer data, financial records, or sensitive operational information benefit from demonstrating they protect that data responsibly.
Organizations working with larger enterprise clients or government organizations that require supply chain cybersecurity assurances.
Companies that must meet supply chain cybersecurity expectations from clients, procurement requirements, or industry standards.
Organizations responsible for protecting client information: MSPs, professional services firms, and technology providers.
Businesses that want to demonstrate a commitment to cybersecurity best practices and build trust with customers and partners.
Companies seeking to strengthen cyber insurance eligibility or demonstrate cybersecurity maturity to underwriters.
Even organizations that do not pursue certification can benefit from implementing the controls recommended in the framework to reduce cybersecurity risk. Certification adds external validation and market recognition to your security investments.
Many organizations choose to pursue CyberSecure Canada certification to strengthen trust and demonstrate that they take cybersecurity seriously.
CyberSecure Canada certification is voluntary. Organizations are not required to obtain certification in order to implement the cybersecurity controls outlined in CAN/DGSI:104.
Many businesses adopt these controls simply to improve their cybersecurity posture and reduce risk from cyber threats.
However, certification can provide additional assurance to customers, partners, and stakeholders that the organization follows recognized cybersecurity practices.
Organizations typically follow several steps to obtain CyberSecure Canada certification.
Organizations first implement the cybersecurity controls defined in the CAN/DGSI:104 framework. These controls focus on foundational protections such as:
MTech Cyber can help you implement these controls as part of a managed cybersecurity program.
Once the required controls are in place, organizations can pursue external recognition through two routes, depending on the level of assurance they need:
If the organization meets the certification requirements, it receives CyberSecure Canada certification. Certified organizations may promote their certification status to:
Certification is valid for two years and must be maintained through reassessment, ensuring cybersecurity practices remain effective as threats evolve.
Selling into defence supply chains? A separate program applies there: the Canadian Program for Cyber Security Certification (CPCSC), whose Level 1 launched in April 2026 and will progressively appear in defence contracts. The Digital Governance Council also offers a CyberDefence Ready program to help defence-industrial and dual-use companies prepare. The CAN/DGSI:104 controls are a strong foundation for both.
Organizations interested in improving their cybersecurity posture often begin by evaluating their existing security controls and identifying areas where improvements may be needed.
A cybersecurity readiness assessment can help determine how closely an organization's current practices align with the controls outlined in CAN/DGSI:104.
Once gaps are identified, organizations can develop a prioritized implementation plan to address the most important risks first, laying the groundwork for eventual CyberSecure Canada certification if desired.
Assess Your CAN/DGSI:104 Readiness