If you work in IT at a small or medium organization, you've probably been asked some version of this question: "So, are we secure?" It's a fair question, and a hard one to answer. Secure compared to what?
That's where CAN/DGSI 104 comes in. It gives Canadian organizations a shared, recognized baseline to measure against. And this Cyber Security Awareness Month, we've turned it into a free assessment you can complete in about 15 minutes.
Here's what the standard is, why it matters, and how to get the most out of those 15 minutes.
CAN/DGSI 104 is a National Standard of Canada called Baseline Cyber Security Controls for Small and Medium Organizations. It's published by the Digital Governance Standards Institute, and the current edition is CAN/DGSI 104:2021 / Rev 1: 2024.
Think of it as a practical minimum: the set of security controls every small or medium organization should have in place, written for organizations that don't have a large security team. According to the Standards Council of Canada, it's aimed at organizations that typically have fewer than 500 employees.
It builds on the Canadian Centre for Cyber Security's baseline controls, which were designed around a simple idea: get most of the benefit from a focused set of efforts, rather than trying to do everything at once. A new revision is in development, so the standard will keep evolving with the times.
The standard is organized in two levels.
Level 1 is the foundation. It covers the essentials: leadership accountability, employee training, keeping software updated, backing up data, strong authentication such as multi-factor authentication (a second check after your password), and a plan for what to do if something goes wrong.
Level 2 builds on Level 1 as an organization matures. It goes further in areas like risk assessment, secure configuration of systems, cloud and outsourced IT services, and websites.
You don't need to memorize any of it. What matters is that the standard turns "are we secure?" into a list of clear, answerable questions.
There are plenty of security frameworks out there, many designed for large enterprises or other countries. CAN/DGSI 104 has a few advantages for Canadian organizations like yours.
It's made in Canada, for organizations your size. The controls are proportional. They ask for what a small or medium organization can realistically do, not what a bank with a 200-person security team does.
It's recognized. CAN/DGSI 104 underpins CyberSecure Canada, the federal certification program for small and medium organizations. Certification is done by bodies accredited by the Standards Council of Canada. Even if certification isn't on your roadmap, measuring against the same standard gives your work credibility.
It speaks your leadership's language. When you tell your CEO "we meet most of the national baseline, and here are the three gaps I recommend closing," you're having a business conversation, not a technical one. That's a much easier conversation to win.
It's built to grow with you. Level 1 gives you a solid starting point, and Level 2 is there when you're ready. You can improve step by step without starting over.
It helps with the questions you're already getting. Clients, partners and insurers increasingly ask about security basics. Many of those questions, like whether you use MFA or test your backups, line up with what the standard covers.
Our free assessment is based on the latest published edition, CAN/DGSI 104:2021 / Rev 1: 2024, and designed to be quick. Here's how to make those 15 minutes count.
Choose your format
You have two options. Complete it online in about 15 minutes, or download the template and work through it at your own pace, which is handy if you want to fill it in together with a colleague or keep it for your records.
Bring the right knowledge to the table
You don't need to prepare documents. It helps, though, to have a general sense of how your organization handles things like updates, backups, passwords and who has administrator access. If someone else manages part of your IT, such as an outside provider, loop them in or note the questions to check later.
Answer for today, not for the plan
It's tempting to answer based on what you intend to do next quarter. Resist it. The assessment is most useful when it reflects where things stand right now. If you're not sure about an item, note it. "Not sure" is useful information in itself.
Review your results
When you finish, you'll receive a personalized scorecard. It shows where you stand on each area of the assessment and, where there's room to improve, the next steps that can raise your score. Look for patterns rather than individual items. Are the gaps mostly about people and training, or about systems and settings? That tells you where to focus.
Pick one next step
Don't try to fix everything at once. Choose the one gap that would make the biggest difference with the least effort, and start there. For example, if MFA is on for email but not for remote access, extending it is often a quick, high-value win. Then share a short summary with your leadership team: what's working, what you recommend next, and why.
One important note: our assessment is a self-check to help you see where you stand. It isn't a certification, and completing it doesn't make an organization certified or "compliant." If formal CyberSecure Canada certification is a goal, the assessment is a great first step toward understanding the work involved.
The best security programs start with an honest look at the baseline. In about 15 minutes, you can have a personalized scorecard showing your organization's strengths, clear next steps for improving your score, and a much better answer the next time someone asks, "So, are we secure?"
Take the free CAN/DGSI 104 assessment online, or download the template: https://form.alcit.com/can/dgsi104-eng
Do You Cybersecure?®