How to use this checklist.
This checklist is a baseline — the controls that most Canadian businesses should have in place, not a comprehensive security framework. It is organized into seven areas. Tick an item only when the control is fully in place.
Leave missing or partially implemented controls unticked, then prioritize the gaps by risk. This page does not save or submit your selections.
This checklist does not substitute for a professional security assessment for businesses with complex environments, regulated data, or high-value targets. It is a practical starting point for businesses building or auditing a security baseline.
Network security
Access control
Endpoint and device protection
Data backup and recovery
Email and phishing
Vendor and supply chain risk
Incident response readiness
Canadian context
What Canadian businesses specifically need to know.
PIPEDA requires organizations to implement security safeguards appropriate to the sensitivity of the personal information they hold. Mandatory breach reporting to the Office of the Privacy Commissioner applies to breaches that create a real risk of significant harm — with notification also required to affected individuals.
Quebec’s Law 25 also changes privacy governance. Before communicating personal information outside Quebec, an organization must conduct a privacy impact assessment. It must notify the Commission d’accès à l’information and affected people when an incident presents a risk of serious injury. See the Commission’s Law 25 guidance for the full obligations; this checklist is not a legal assessment.
British Columbia and Alberta have private-sector privacy laws that can apply instead of PIPEDA to activities within those provinces. PIPEDA may still apply to other activities, including cross-border handling. The applicable law and safeguards depend on the organization and the information it handles. Completing this checklist does not establish compliance. See the Office of the Privacy Commissioner of Canada’s provincial-law guidance.