Federal cybersecurity certificationCanada

CyberSecure Canada / CAN/DGSI 104 Readiness

Turn Canada's practical cybersecurity baseline into continuously operated controls and defensible evidence for independent certification.

View the control mapping

Where we contribute

A managed security layer within a broader compliance program.

CyberSecure Canada is a voluntary federal certification program built on Canada's baseline cybersecurity controls for small and medium organizations. Network Box can implement and continuously operate much of the technical security layer, but an accredited certification body, rather than Network Box or the client's MSP, determines whether the organization meets the applicable certification requirements.

Certification status

Reviewed September 2, 2026

CyberSecure Canada is a certification, not a self-issued compliance claim.

An SCC-accredited certification body evaluates the organization's implementation. Successful organizations may use the CyberSecure Canada certification mark for a two-year certification period, subject to the current program and display rules.

Standards Council of Canada: CyberSecure Canada ↗

The program is voluntary and designed primarily for Canadian small and medium organizations.
The familiar program baseline contains 13 cybersecurity controls developed by the Canadian Centre for Cyber Security.
The national standard originated as CAN/CIOSC 104:2021 and is now maintained as CAN/DGSI 104.
CAN/DGSI 104 was revised again in July 2026; applicants should confirm the applicable edition, level, transition dates, and audit criteria with their certification body.
Organizations with 500 or more employees, high-impact information, critical infrastructure, or more advanced threats should evaluate more comprehensive safeguards.

A practical Canadian baseline

From 13 essential controls to a certifiable operating program

CyberSecure Canada is attainable for many MSP customers because it focuses on practical safeguards. Certification readiness still requires clear scope, assigned ownership, recurring operation, and evidence, not just purchased technology.

Baseline

13 essential controls

A recognizable control set covering incident response, patching, authentication, security software, users, data, devices, networks, providers, websites, access, and media.

Standard

CAN/DGSI 104

The National Standard of Canada formalizes and expands the baseline into auditable requirements with levels and edition-specific criteria.

Assessment

Independent certification

An accredited certification body reviews implementation and evidence; Network Box provides readiness support and managed-control records.

Lifecycle

Two-year mark

The certification mark is valid for two years, so controls and evidence must remain operational after the initial assessment.

Current national standard

Five areas made explicit beyond the original 13-control checklist

Current CAN/DGSI 104 editions organize the baseline into a broader conformity-assessment structure. These areas reinforce why readiness cannot be reduced to a technical checklist.

Select a framework area to explore its detailed control mapping.
Framework area	Network Box contribution	Relevant services	Coverage
	Security reporting and service reviews inform oversight, while executive direction and resources remain organization-owned.	Security reportingService reviews24/7 SOC	Supporting
Detailed mapping2 mapping notes Leadership must direct, support, resource, and continually improve the cybersecurity program. Network Box contribution Supporting Network Box provides threat trends, service performance, incident summaries, risk findings, and remediation recommendations for management review. Relevant capabilities Security reportingService reviews24/7 SOC Certified organization responsibility Client responsibility Approve the program, establish priorities, allocate resources, resolve risk decisions, and remain accountable for cybersecurity outcomes. Relevant capabilitiesNot a Network Box control
	Defined managed-service roles and escalation paths support a complete responsibility model.	Service documentationEscalation proceduresSecurity reporting	Partial
Detailed mapping2 mapping notes Every cybersecurity activity and item of evidence needs an accountable owner with appropriate authority and competence. Network Box contribution Partial Network Box documents responsibilities, operational contacts, escalation paths, and the activities performed within the contracted service scope. Relevant capabilities Service documentationEscalation proceduresSecurity reporting Certified organization responsibility Client responsibility Assign internal leadership, control, and evidence owners; document responsibilities across the organization, MSP, Network Box, users, and other providers. Relevant capabilitiesNot a Network Box control
	Vulnerability, threat, incident, architecture, and exposure information provides strong technical inputs to risk analysis.	Vulnerability ManagementThreat intelligenceSIEMSecurity reporting	Partial
Detailed mapping2 mapping notes The organization must understand its assets, information value, threats, vulnerabilities, likelihood, impact, and treatment decisions. Network Box contribution Partial Network Box supplies current technical findings, observed attack activity, incident trends, architecture information, and managed-control performance data. Relevant capabilities Vulnerability ManagementThreat intelligenceSIEMSecurity reporting Certified organization responsibility Client responsibility Define scope and methodology, assess business impact and residual risk, approve treatment or acceptance, assign owners, and update the assessment after material changes. Relevant capabilitiesNot a Network Box control
	Segmentation, monitoring, access protection, and vulnerability management can protect payment and finance environments.	Network segmentationUTM+SIEMNBX: MDR, EDR, XDRVulnerability Management	Supporting
Detailed mapping2 mapping notes Payment and financial systems require explicit protection against unauthorized access, manipulation, theft, and service disruption. Network Box contribution Supporting Network Box can isolate systems, control network paths, monitor activity, identify weaknesses, and support investigation within the managed scope. Relevant capabilities Network segmentationUTM+SIEMNBX: MDR, EDR, XDRVulnerability Management Certified organization responsibility Client responsibility Inventory systems and data flows, govern terminals and applications, reconcile transactions, manage vendor access, and satisfy PCI DSS, banking, accounting, privacy, or contractual obligations where applicable. Relevant capabilitiesNot a Network Box control
	Centralized logs, source monitoring, correlation, investigation, escalation, and retention options create recurring operational evidence.	SIEMNBX: MDR, EDR, XDR24/7 SOCSecurity reporting	Strong
Detailed mapping2 mapping notes Security-relevant activity must be recorded, protected, reviewed, investigated, and retained so suspicious behavior and control operation can be demonstrated. Network Box contribution Strong Network Box centralizes supported telemetry, monitors source health, correlates activity, investigates alerts, escalates incidents, and provides dashboards and records. Relevant capabilities SIEMNBX: MDR, EDR, XDR24/7 SOCSecurity reporting Certified organization responsibility Client responsibility Identify every required source and event, enable complete logging, maintain time synchronization and attribution, protect and retain records, and cover systems outside Network Box scope. Relevant capabilitiesNot a Network Box control

These mappings are illustrative and depend on deployment, configuration, service scope, the client environment, and evidence requirements. Strong, Partial, and Supporting describe Network Box's potential contribution, not a compliance conclusion.

Control mapping

The 13 baseline controls and Network Box support

Open any control to see its intent, Network Box's contribution, and the work that remains with the certified organization and its MSP. The exact audit criteria must be confirmed against the applicable CAN/DGSI 104 edition and level.

Authoritative sourceCyberSecure Canada program information ↗

Select a framework area to explore its detailed control mapping.
Framework area	Network Box contribution	Relevant services	Coverage
	24/7 monitoring, investigation, escalation, supported containment, and incident records help turn a written plan into an operational capability.	SIEMNBX: MDR, EDR, XDR24/7 SOCIncident response support	Partial
Detailed mapping2 mapping notes Prepare to detect, respond to, communicate, and recover from incidents of varying severity, with clear owners and external contacts. Network Box contribution Partial The SOC monitors and validates events, prioritizes alerts, investigates available telemetry, escalates through agreed contacts, supports containment using managed controls, and documents actions and timelines. Relevant capabilities SIEMNBX: MDR, EDR, XDR24/7 SOCIncident response support Certified organization responsibility Client responsibility Maintain and test the enterprise incident response plan; define authority, legal and privacy notification, communications, evidence preservation, insurance, business continuity, recovery, and events beyond Network Box visibility. Relevant capabilitiesNot a Network Box control
	Vulnerability Management identifies and prioritizes missing patches while Network Box maintains supported systems in its managed scope.	Vulnerability ManagementManaged platform operationsSecurity reporting	Partial
Detailed mapping2 mapping notes Keep operating systems, applications, firmware, and security tools current through automatic updates or a documented vulnerability and patch-management process. Network Box contribution Partial Network Box maintains supported software in its managed services, identifies missing patches and exposed weaknesses in subscribed scans, prioritizes remediation, tracks trends, and can validate correction. Relevant capabilities Vulnerability ManagementManaged platform operationsSecurity reporting Certified organization responsibility Client responsibility Inventory and patch endpoints, servers, applications, firmware, cloud resources, mobile devices, and other systems outside Network Box management; test changes, replace unsupported technology, document exceptions, and verify deployment. Relevant capabilitiesNot a Network Box control
	Layered managed security prevents, detects, investigates, and responds to malicious software and communications.	UTM+IDS/IPSSecure Web GatewayManaged Cloud Email SecurityNBX: MDR, EDR, XDR	Strong
Detailed mapping2 mapping notes Use active, current, automatically updating security software and local firewalls across applicable systems. Network Box contribution Strong Managed antimalware, UTM, IDS/IPS, secure web and email controls, endpoint detection, threat intelligence, automated blocking, investigation, and response provide continuously operated protection. Relevant capabilities UTM+IDS/IPSSecure Web GatewayManaged Cloud Email SecurityNBX: MDR, EDR, XDR Certified organization responsibility Client responsibility Ensure complete coverage across every endpoint, server, mobile device, cloud workload, and other system; keep protections enabled, govern exclusions, prevent unauthorized disabling, and remediate alerts. Relevant capabilitiesNot a Network Box control
	Standardized managed configurations, controlled changes, and continuous monitoring support secure device operation.	UTM+Edge DefenseSecure SD-WANManaged change control	Partial
Detailed mapping2 mapping notes Change defaults, remove unnecessary features and accounts, enable relevant protections, and maintain secure configuration standards. Network Box contribution Partial Network Box hardens subscribed services, restricts administrative access, manages supported updates, documents changes, and continuously monitors managed security components. Relevant capabilities UTM+Edge DefenseSecure SD-WANManaged change control Certified organization responsibility Client responsibility Create standards and securely configure endpoints, servers, applications, cloud systems, network equipment, mobile and IoT devices, local firewalls, accounts, and features outside the managed scope; review exceptions. Relevant capabilitiesNot a Network Box control
	MFA-supported VPN, directory integration, controlled administration, authentication telemetry, and alerting protect managed access paths.	VPNMFA/TOTP supportDirectory integrationSIEM24/7 SOC	Partial
Detailed mapping2 mapping notes Use strong authentication, especially MFA for important, privileged, financial, cloud, and remote-access accounts, and govern password practices. Network Box contribution Partial Network Box supports MFA and directory integration for applicable VPN access, uses controlled managed-service administration, records authentication activity, and can correlate suspicious access in SIEM. Relevant capabilities VPNMFA/TOTP supportDirectory integrationSIEM24/7 SOC Certified organization responsibility Client responsibility Own identity lifecycle, unique accounts, MFA coverage, password and password-manager policy, privileged and service accounts, access reviews, compromised-credential response, and authentication for all other systems. Relevant capabilitiesNot a Network Box control
	Training and phishing simulations help employees recognize and report common attacks.	Security Awareness TrainingPhishing simulationsCampaign reporting	Partial
Detailed mapping2 mapping notes Give personnel practical, recurring education on phishing, credentials, malware, acceptable use, data handling, and incident reporting. Network Box contribution Partial Network Box can administer awareness campaigns and phishing simulations, provide reminders and targeted education, and report completion and user-risk results. Relevant capabilities Security Awareness TrainingPhishing simulationsCampaign reporting Certified organization responsibility Client responsibility Set policy and frequency, train everyone in scope at onboarding and recurrently, tailor content to roles and threats, address non-completion and repeated failures, and retain evidence. Relevant capabilitiesNot a Network Box control
	Secure connectivity and protective monitoring support data protection, while backups and encryption at rest remain client-operated controls.	VPNSecure SD-WANNetwork segmentationNBX: MDR, EDR, XDR	Supporting
Detailed mapping2 mapping notes Back up essential systems and information, protect copies from attack, test recovery, and encrypt sensitive data in storage and transit. Network Box contribution Supporting VPN and secure connectivity protect traffic on managed paths; segmentation, access controls, monitoring, and response can help shield backup infrastructure from unauthorized activity. Relevant capabilities VPNSecure SD-WANNetwork segmentationNBX: MDR, EDR, XDR Certified organization responsibility Client responsibility Define recovery objectives and backup frequency; maintain independent, protected, encrypted, and where appropriate offline copies; manage keys; monitor jobs; test integrity and restoration; and encrypt sensitive data at rest and across all relevant paths. Relevant capabilitiesNot a Network Box control
	Secure remote access, web protection, endpoint telemetry, and continuous monitoring reduce risk for distributed users.	VPNSecure Web GatewayNBX: MDR, EDR, XDRManaged Cloud Email Security	Partial
Detailed mapping2 mapping notes Choose and govern a mobile-device ownership model, protect business data, control applications, encrypt devices, and secure remote connectivity. Network Box contribution Partial Network Box can protect remote traffic and web and email use, monitor supported endpoints, detect threats, and provide secure VPN access to corporate resources. Relevant capabilities VPNSecure Web GatewayNBX: MDR, EDR, XDRManaged Cloud Email Security Certified organization responsibility Client responsibility Own BYOD or corporate-device policy, mobile-device management, application controls, data separation, device encryption and locks, updates, remote wipe, public Wi-Fi and travel rules, loss response, and disposal. Relevant capabilitiesNot a Network Box control
	Managed firewalls, UTM, intrusion prevention, segmentation, SD-WAN, secure remote access, and 24/7 monitoring form a continuously operated perimeter.	Edge DefenseUTM+IDS/IPSSecure SD-WANVPN24/7 SOC	Strong
Detailed mapping2 mapping notes Protect every Internet and third-party boundary, isolate exposed systems, filter malicious traffic, secure remote access and Wi-Fi, and protect email and DNS paths. Network Box contribution Strong Network Box manages firewall and UTM policy, IDS/IPS, segmentation, VPN, SD-WAN, secure web and email controls, DNS-related protections, threat updates, logging, and SOC monitoring within scope. Relevant capabilities Edge DefenseUTM+IDS/IPSSecure SD-WANVPN24/7 SOC Certified organization responsibility Client responsibility Identify and diagram every connection and location; approve and review rules; secure Wi-Fi, guest networks, remote work, domains, email authentication, local host firewalls, and any technology or bypass paths outside the managed boundary. Relevant capabilitiesNot a Network Box control
	Protected cloud connections, integrated monitoring, documented service scope, and provider evidence support third-party oversight.	Cloud telemetry monitoringManaged Cloud Email SecuritySecure connectivityService documentation	Partial
Detailed mapping2 mapping notes Assess providers before use, define security responsibilities and contract terms, secure administrative access and connectivity, and monitor outsourced services. Network Box contribution Partial Network Box documents its services and responsibilities, protects connections, can monitor integrated cloud and identity telemetry, manages selected cloud security controls, and provides operational and available assurance information. Relevant capabilities Cloud telemetry monitoringManaged Cloud Email SecuritySecure connectivityService documentation Certified organization responsibility Client responsibility Perform risk-based due diligence; review provider reports; govern contracts, data location, access, incidents, continuity, deletion, exit, and downstream providers; enforce cloud-admin MFA; securely configure services; and monitor providers. Relevant capabilitiesNot a Network Box control
	WAF, vulnerability assessment, attack detection, virtual patching, and SOC response protect public web applications and APIs.	WAFVulnerability ManagementPenetration TestingSIEM24/7 SOC	Strong
Detailed mapping2 mapping notes Protect websites and sensitive information through secure design, HTTPS, current components, strong administration, vulnerability management, and suitable application testing. Network Box contribution Strong Network Box WAF, scanning, IDS/IPS, virtual-patching capabilities, telemetry, and SOC monitoring detect and block attacks and support investigation and response. Relevant capabilities WAFVulnerability ManagementPenetration TestingSIEM24/7 SOC Certified organization responsibility Client responsibility Inventory websites and APIs; own secure design and development; patch servers, frameworks, plugins, and dependencies; manage certificates, DNS, hosting, code, credentials, data, and pipelines; address OWASP risks and remediate findings. Relevant capabilitiesNot a Network Box control
	Network policy, segmentation, VPN, supported identity integration, and access monitoring restrict and observe managed paths.	Network segmentationUTM+VPNDirectory integrationSIEM	Partial
Detailed mapping2 mapping notes Apply least privilege, separate administrative activity, promptly change or remove access, and use centralized authorization where appropriate. Network Box contribution Partial Network Box enforces managed firewall, segmentation, and VPN policy; supports selected identity integrations; restricts service administration; and monitors access telemetry for suspicious behavior. Relevant capabilities Network segmentationUTM+VPNDirectory integrationSIEM Certified organization responsibility Client responsibility Provision, approve, review, modify, and terminate access across applications, data, cloud, endpoints, privileged and service accounts; define business roles, segregation of duties, emergency access, and complete identity governance. Relevant capabilitiesNot a Network Box control
	Endpoint and network monitoring may detect selected removable-media activity or subsequent malicious communications, but governance remains client-owned.	NBX: MDR, EDR, XDRNetwork monitoring	Supporting
Detailed mapping2 mapping notes Minimize removable-media use and tightly govern approved, encrypted, inventoried devices through their complete lifecycle. Network Box contribution Supporting Where the endpoint platform and service scope provide telemetry, Network Box may detect selected media activity or malware and can restrict or investigate malicious network communications. Relevant capabilities NBX: MDR, EDR, XDRNetwork monitoring Certified organization responsibility Client responsibility Authorize company-owned media, inventory and encrypt it, restrict connection and transfer, scan devices, train users, report loss, prohibit unmanaged media, and sanitize or physically destroy media before disposal. Relevant capabilitiesNot a Network Box control

Appropriate use

A strong baseline, not a ceiling

The Canadian Centre for Cyber Security designed these controls primarily for organizations with fewer than 500 employees and information whose compromise would cause no more than medium injury. Larger, critical-infrastructure, regulated, defence-supply-chain, or higher-risk organizations may need more comprehensive frameworks and sector-specific obligations. CyberSecure Canada also does not by itself establish PIPEDA or provincial privacy-law compliance.

Certification path

Move from readiness to independent assessment

Treat certification as an operating cycle rather than a one-time technology purchase.

Confirm the certification basis

Select an SCC-accredited certification body and confirm eligibility, edition, level, audit method, evidence expectations, cost, transition rules, and certification cycle.

Define scope and ownership

Inventory people, locations, systems, data, cloud services, providers, websites, mobile devices, and exclusions; assign a responsible owner for every control and record.

Assess and remediate gaps

Compare actual policies, processes, technology, and evidence with every applicable requirement, then correct deficiencies and document accepted risks.

Operate and retain evidence

Run recurring controls long enough to demonstrate they work, review exceptions, test response and recovery, and preserve complete evidence populations.

Complete the independent audit

Provide policies, records, interviews, demonstrations, and corrective actions to the certification body. Network Box can supply agreed technical evidence but does not make the decision.

Maintain and recertify

Monitor changes and risk, address findings, retain evidence, use the mark accurately, and prepare for the next certification cycle.

Assessment evidence

Show that safeguards are operating.

Available evidence depends on deployed services, configured log sources, agreed scope, format, and retention period.

01Service descriptions, scope documents, responsibility assignments, and escalation contacts
02Managed device, protected endpoint, subscribed service, and connected log-source inventories
03Network diagrams and descriptions of boundaries, connections, remote access, and segmentation
04Firewall, VPN, SD-WAN, IDS/IPS, secure web, email, DNS-related, remote-access, and WAF policies
05Secure configurations, managed updates, change approvals, and implementation records
06Administrative access, authentication, directory integration, and MFA evidence for managed services
07Security-software coverage, health, update, detection, and exception information
08Vulnerability findings, patch priorities, remediation recommendations, trends, and validation rescans
09Centralized logs, source-health checks, time-synchronization information, searches, dashboards, and reports
10SOC alerts, analyst investigations, incident tickets, timelines, escalations, and supported containment actions
11WAF, malware, phishing, email, web, endpoint, identity, network, and application-security events
12Security-awareness participation, campaign results, completion records, and phishing-simulation metrics
13Service availability, health monitoring, restoration, and operational review information
14Exceptions, remediation tracking, management reporting, and continuous-improvement recommendations
15Available service-provider security, contractual, and independent-assurance information

Coverage key

What each label means.

Strong

Network Box can directly deliver and operate a substantial part of this technical outcome when the relevant services are in scope.

Partial

Network Box contributes meaningful controls, but the requirement also depends on the client's systems, configuration, people, or processes.

Supporting

Network Box provides useful security operations or evidence, but does not satisfy the requirement by itself.

Client responsibility

This area primarily remains with the MSP and client, their assessors, or other qualified parties.

Shared responsibility

Network Box helps operate the controls. The organization owns the compliance program.

The organization owns certification scope, leadership accountability, risk decisions, policies, complete asset and identity governance, client-operated controls, evidence, corrective actions, and the application and independent audit.

CyberSecure Canada FAQ

Questions about scope, evidence, and responsibility.

What is CyberSecure Canada?

Turn Canada's practical cybersecurity baseline into continuously operated controls and defensible evidence for independent certification.

How can Network Box USA support CyberSecure Canada?

Network Box USA can operate managed technical safeguards, monitor the subscribed environment, investigate and escalate security activity, maintain managed configurations, and produce service evidence that may support applicable CyberSecure Canada requirements.

Does using Network Box USA make an organization CyberSecure Canada compliant?

No. A managed security service can contribute controls, operations, and evidence, but it cannot guarantee compliance or replace the organization's governance, complete scope, legal interpretation, assessment, or formal certification and attestation work.

How should the CyberSecure Canada control mapping be used?

Use the mapping as a scoping and evidence-planning aid. Each row explains the requirement, the potential Network Box contribution, available evidence, the coverage level, and the work that remains with the organization.

What evidence may be available for a CyberSecure Canada assessment?

Depending on the deployed services and agreed retention, evidence may include managed configurations, logs, alerts, incident records, vulnerability findings, change records, service reports, and recurring operational reviews. The assessor determines whether evidence is sufficient.

What remains the organization's responsibility under CyberSecure Canada?

Important information

Compliance and legal disclaimer

The information in this Compliance Center is provided for general informational purposes and does not constitute legal, regulatory, audit, or certification advice. Requirements vary by organization, jurisdiction, contract, data, and system scope. Network Box services can support selected technical and operational safeguards but do not by themselves establish compliance, certification, or attestation. Each organization remains responsible for determining its obligations, defining scope, implementing governance and non-technical controls, and obtaining advice or assessment from qualified legal, compliance, audit, or certification professionals.

Explore another frameworkReturn to the Compliance Center →

Security stack review

Map the technical foundation before the assessment starts.

Request a Security Stack Review