Quick answer: The Canadian Centre for Cyber Security (CCCS) publishes 13 baseline controls for small and medium organizations (ITSM.10.089). They cover incident response, patching, endpoint security, user authentication (MFA), backup, access control, security training, network defenses, and encryption. A managed IT and cybersecurity provider can implement most of these controls through services like EDR/MDR, automated patching, email security, backup monitoring, and security awareness training.
What are the CCCS baseline controls and why do they matter?
The Canadian Centre for Cyber Security is Canada's national authority on cybersecurity. Under the Communications Security Establishment, the CCCS publishes practical guidance tailored to Canadian organizations, including a set of baseline cyber security controls specifically for small and medium organizations.
These 13 controls represent what the CCCS considers the minimum necessary to protect a Canadian business from common cyber threats. They are not exhaustive enterprise security standards; they are a practical starting point that any small business can work toward. Organizations that implement all 13 controls significantly reduce their exposure to ransomware, business email compromise, data breaches, and the operational disruptions that follow.
The controls are:
- Incident response plan
- Patch management
- Enable security software
- Secure configurations
- User authentication
- Backup and recovery
- Access control
- User education
- Perimeter defenses
- Media protection
- Physical security
- Mobile device management
- Encryption
Below, we break down each control in plain language and show how a managed IT and cybersecurity provider like Cyber Unit can help you implement it.
How do you create an incident response plan?
An incident response plan documents what your organization will do when a cybersecurity incident occurs. The CCCS baseline requires that you have a written plan that identifies key contacts, defines roles, and outlines steps for containment, eradication, and recovery. Without a plan, incidents take longer to resolve and cause more damage.
A managed provider helps by:
- Drafting or reviewing your incident response documentation
- Providing 24/7 SOC monitoring so incidents are detected faster
- Coordinating containment and remediation when an incident occurs
- Conducting post-incident reviews to improve defenses
For detailed guidance on the critical first hour, see our ransomware first-hour checklist.
How do you keep systems patched?
Patch management means applying security updates to operating systems, applications, and firmware in a timely manner. The CCCS baseline emphasizes prioritizing critical and high-severity vulnerabilities, especially those being actively exploited. Unpatched systems are one of the most common entry points for attackers.
A managed IT provider handles this by:
- Automating patch deployment across workstations and servers
- Monitoring for failed or missing patches
- Prioritizing patches based on severity and known exploitation (CISA KEV, CCCS advisories)
- Scheduling updates to minimize business disruption
Research shows the average time to exploit a vulnerability is now under 10 hours for some actively exploited flaws. Manual patching cannot keep pace. See our analysis of CVE exploit windows for current data.
How do you enable and manage security software?
The CCCS baseline requires security software on all devices, including antivirus, anti-malware, and ideally endpoint detection and response (EDR). This software must be kept current and centrally monitored.
Cyber Unit's approach:
- EDR deployment on all managed endpoints (SentinelOne or equivalent)
- Managed Detection and Response (MDR) with 24/7 SOC analysts reviewing alerts
- Automatic signature and engine updates
- Tamper protection to prevent malware from disabling security tools
The difference between EDR and MDR is significant. EDR is software; MDR adds human analysts who investigate and respond to threats around the clock. See our EDR vs MDR comparison for more detail.
How do you implement secure configurations?
Secure configurations mean disabling unnecessary services, removing default accounts, and hardening systems before they are deployed. The CCCS baseline emphasizes not using vendor defaults and documenting baseline configurations.
A managed provider implements this through:
- Standardized build images for workstations and servers
- Configuration baselines aligned with CIS Benchmarks or vendor hardening guides
- Removal of unnecessary software, services, and open ports
- Periodic configuration audits to detect drift
How do you enforce strong user authentication?
User authentication is one of the most critical controls. The CCCS baseline requires strong, unique passwords and multi-factor authentication (MFA) wherever possible, especially for remote access, email, and administrative accounts.
Implementation includes:
- Enforcing MFA on Microsoft 365, Google Workspace, VPN, and remote desktop
- Deploying a business password manager to eliminate weak or reused passwords
- Following current NIST password guidelines: minimum 15 characters, no forced rotation, breach database checks
- Using phishing-resistant MFA (hardware keys or passkeys) for privileged accounts
MFA alone does not guarantee protection. Attackers now use real-time phishing and token theft to bypass MFA. See our session hijacking and MFA bypass article for current threats.
How do you maintain reliable backups?
The CCCS baseline requires regular backups of critical data, stored separately from production systems, and tested periodically to confirm recovery works. Backups are your last line of defense against ransomware.
A managed provider delivers:
- Automated daily backups with off-site or cloud storage
- Immutable backup copies that ransomware cannot encrypt or delete
- Regular restore testing to verify backup integrity
- Documented recovery time objectives (RTOs) and recovery point objectives (RPOs)
Many organizations discover their backups do not work only when they need them. See our backup assumptions that fail for common pitfalls.
How do you implement access control?
Access control means limiting who can access what based on job function. The CCCS baseline requires the principle of least privilege: users should have only the permissions necessary for their role, and administrative access should be restricted.
Implementation includes:
- Role-based access control (RBAC) in cloud platforms like Microsoft 365
- Separate admin accounts for IT staff (not using admin privileges for daily work)
- Regular access reviews to remove unnecessary permissions
- Prompt offboarding to revoke access when employees leave
How do you provide effective security training?
User education is the control that addresses human risk. The CCCS baseline requires ongoing security awareness training for all employees, covering phishing, social engineering, safe browsing, and password hygiene.
Cyber Unit delivers security awareness training through:
- Managed training programs powered by platforms like Wizer
- Realistic phishing simulations with immediate feedback
- Short, frequent modules rather than annual compliance courses
- Reporting on completion rates and simulation results
Research from the CCCS, CISA, and NIST shows that short, frequent training with immediate feedback is more effective than annual courses. See our guide to what actually works for the evidence.
How do you secure your network perimeter?
Perimeter defenses include firewalls, intrusion detection, and filtering at the network edge. The CCCS baseline requires a firewall between the internal network and the internet, with appropriate rules and monitoring.
A managed IT provider handles this through:
- Managed firewall configuration and monitoring
- Regular rule reviews to remove unnecessary open ports
- VPN hardening for remote access
- DNS filtering to block known malicious domains
For small offices, a managed firewall service includes firmware updates, configuration backups, and proactive monitoring that most internal teams cannot sustain.
How do you protect removable media?
Media protection addresses the risk from USB drives, external hard drives, and other removable storage. The CCCS baseline requires controls to prevent unauthorized devices from connecting to systems and policies for secure disposal of storage media.
Technical controls include:
- Endpoint policies that block or restrict USB storage devices
- Automatic scanning of removable media when connected
- Encryption requirements for any approved external storage
- Secure data destruction procedures when disposing of drives
How do you address physical security?
Physical security means protecting hardware and network equipment from unauthorized physical access. The CCCS baseline requires controls like locked server rooms, visitor policies, and screen locks on workstations.
While physical security is primarily an organizational responsibility, a managed provider can help with:
- Enforcing automatic screen lock policies via MDM or group policy
- Remote wipe capabilities for lost or stolen devices
- Asset tracking to know where all devices are located
How do you manage mobile devices securely?
Mobile device management addresses the risk from smartphones and tablets accessing corporate data. The CCCS baseline requires policies for mobile devices, including the ability to remotely wipe lost devices, enforce encryption, and separate personal and work data on BYOD devices.
A managed provider implements this through:
- MDM or MAM deployment (Microsoft Intune, Jamf, or equivalent)
- Work profile containerization on personal devices
- Enforcement of screen lock, encryption, and OS version requirements
- Remote wipe capability for corporate data
BYOD policies without MDM leave corporate data unprotected. See our BYOD security risks article for a detailed breakdown.
How do you implement encryption?
The CCCS baseline requires encryption for sensitive data at rest and in transit. This includes full-disk encryption on laptops, encrypted connections for remote access, and secure (HTTPS/TLS) connections for web applications.
Implementation includes:
- Enabling BitLocker (Windows) or FileVault (macOS) on all endpoints
- Enforcing TLS for all remote access and cloud services
- Using encrypted backup solutions
- Verifying encryption is enabled and keys are properly managed
How does Cyber Unit help implement these controls?
The CCCS baseline controls are achievable for small and medium organizations, but implementing them requires both technical capability and ongoing attention. Most SMBs do not have dedicated IT security staff. That is where a managed IT and cybersecurity provider fits.
Cyber Unit delivers:
- Managed IT Services: Patching, configuration management, backup monitoring and testing, access control, and employee onboarding/offboarding. These cover controls 2, 4, 6, and 7.
- Cybersecurity Services: EDR/MDR with 24/7 SOC monitoring, email security, vulnerability management, and incident response. These cover controls 1, 3, 5, 8, and 9.
- Security Awareness Training: Managed training and phishing simulations. This covers control 8.
- Mobile Security: MDM deployment and policy enforcement. This covers control 12.
Because Cyber Unit integrates IT and security services, there are no gaps between vendors. Patching, monitoring, backup, and incident response are coordinated by a single team. This approach aligns with how the CCCS baseline is designed: as an integrated set of controls, not a checklist of disconnected products.
How do you assess your current state against CCCS controls?
Before implementing controls, you need to know where you stand. Two free options:
- Cybersecurity Canada offers a free assessment built on the CCCS framework. It produces a detailed report with recommendations by control area.
- Our free cybersecurity assessment on cyberunit.com covers 22 security areas in under five minutes and highlights gaps a provider can address.
If you would like a professional review, our security assessment service provides an analyst-led evaluation with a prioritized remediation roadmap.
What comes next?
Implementing the CCCS baseline controls is not a one-time project. Threats evolve, systems change, and controls require ongoing maintenance. The value of a managed provider is continuous coverage: patching happens every week, monitoring runs 24/7, and training continues throughout the year.
If you are starting from scratch, prioritize MFA, patching, backups, and endpoint security first. These four controls address the most common attack vectors. Then work through user training, access control, and the remaining controls.
The CCCS baseline provides a credible, government-backed framework that Canadian businesses can reference when speaking with insurers, auditors, or customers who ask about security practices. It is practical, achievable, and directly relevant to the threats Canadian organizations face.
This article is intended for general informational purposes only and does not constitute professional security, legal, or compliance advice. The CCCS baseline controls described are based on publicly available guidance from the Canadian Centre for Cyber Security (cyber.gc.ca) as of the publication date. Organizations should consult the official CCCS publications and qualified cybersecurity professionals before implementing controls or making operational changes.