This library connects Ontario small businesses, professional offices and community organizations to the official cybersecurity, AI governance, continuity and digital-governance material most relevant to practical operations.
These resources help leadership organize cybersecurity risk, identify practical safeguards and connect day-to-day controls to wider governance and resilience objectives.
A Canadian starting point designed for small and medium organizations seeking proportionate improvements in cyber resilience.
A Canadian national standard specifying a minimum cybersecurity control set for small and medium organizations.
A flexible outcomes-based framework organized around Govern, Identify, Protect, Detect, Respond and Recover.
A shorter introduction for organizations with modest or no formal cybersecurity program.
A prioritized set of safeguards for defending systems and networks against common attacks.
The international requirements standard for establishing, implementing, maintaining and improving an information security management system.
Choosing between them: Canadian baseline controls and NIST's small-business guide are usually easier entry points for a smaller organization. NIST CSF 2.0 supports wider risk governance, CIS adds implementation detail, and ISO/IEC 27001 is appropriate when an organization needs a formal information-security management system or certification pathway.
These sources support responsible deployment, risk identification, approved-use decisions and management oversight without treating every small organization as an AI developer.
Canadian guidance for small and medium enterprises adopting AI securely, responsibly and in alignment with trustworthy-AI principles.
A cross-sector framework for incorporating trustworthiness considerations into the design, development, deployment and use of AI systems.
A companion resource to AI RMF 1.0 focused on risks and actions associated with generative AI.
Joint Canadian privacy-regulator principles for organizations developing, providing or using generative AI.
The international requirements standard for an artificial intelligence management system used by organizations that develop, provide or use AI-enabled products and services.
Continuity and incident response overlap, but they are not identical. These sources help organizations define priorities, responsibilities, response actions, recovery paths and testing.
The international requirements standard for a business continuity management system.
Canadian Cyber Centre guidance for identifying critical operations, dependencies, recovery procedures, roles and plan testing.
Current NIST incident-response recommendations integrated with Cybersecurity Framework 2.0 risk-management outcomes.
Operational guidance for preparing for, responding to and recovering from ransomware incidents.
Do not treat a voluntary framework as law or assume a procurement requirement applies to every business. Scope must be established before anyone claims compliance, readiness or certification.
A Canadian certification program based on baseline controls. Certification requires the current program process and does not result from a normal CyberTECT review.
Available since April 2026 and introduced into select defence contracts beginning in summer 2026. Level 1 uses an annual self-assessment against 13 controls.
Policies alone do not establish implementation. Account lists, access reviews, training records, configurations and test evidence may be required.
Certification, legal compliance, contractual requirements and framework alignment are different conclusions and should never be used interchangeably.
CyberTECT uses authoritative sources to structure questions, identify reasonable outcomes and explain why a control matters. An engagement is scoped to the organization and does not become a certification audit merely because a framework informed the method.
An official publication supports a recommendation, definition or practical control objective.
Selected work may be mapped to relevant outcomes without claiming complete implementation of the framework.
Evidence is reviewed or tested to determine what is actually true in the organization.
Information and authoritative sources last reviewed: July 2026. Frameworks, standards and government programs change. CyberTECT reviews the official source before relying on edition-specific or requirement-specific details.
CyberTECT can connect the business question to the smallest appropriate framework, review or validation without turning a practical problem into an unnecessary enterprise program.
