CyberSecure Canada

Offre de certification 

Organizations wishing to show the efforts they are making to improve their control concerning cyber security and have this recognized may apply to the Bureau de normalisation du Québec (BNQ), whose CyberSecure Canada certification program which is accredited by the Standards Council of Canada (SCC).

To obtain certification, organizations must demonstrate to the BNQ that they are implementing security controls from the CyberSecure Canada program.

The certification cycle is a two-year cycle during which a maintenance audit is performed twelve months after the initial certification audit or the recertification audit, as applicable. The certification process begins with an initial application submitted to the BNQ using CyberSecure Canada’s online application portal, or with an application submitted directly to the BNQ by email using the application form provided for the purpose, available under Download the document required for certification.

Once the service contract between the BNQ and the client has been signed, and the requisite documentation pertaining to the CyberSecure Canada initial certification of the client has been sent to the BNQ, the name of the lead auditor is communicated to the client.

To being with, a preliminary assessment is carried out to measure the level of preparedness of the client, notably through the review of the documents submitted. The conclusions of the preliminary assessment are then communicated to the client in the form of a written report in which an initial neutral opinion is given as to conformity and the level of the client’s comprehension and implementation of cyber security controls. Should the assessment be favourable, the lead auditor prepares an audit plan.

The initial certification audit, during which relevant information pertaining to the CyberSecure Canada certification program is collected and verified by the auditor, can then start. This information is collected by means of interviews, the observation of activities and the work environment, and the consultation of documents on the spot. The client is informed of the auditor’s findings as the audit progresses, and these are also compiled in an audit report summarizing the auditor’s conclusions and given to the client.

Discrepancies observed during the audit may be subject to corrective action requests (CARs), which may be major or minor depending on the significance of the impact of the discrepancy on the achievement of the objectives. CARs must be closed (in other words resolved) within 30 days following the audit.

The decision to certify the client is based on the recommendation of the lead auditor along with the revision of the file by the BNQ to ensure that all certification conditions have been met.

Following a favourable decision by the BNQ, a certificate of conformity is sent to the client, who agrees to undergo a maintenance audit within twelve months after the first day of the initial certification audit.