What are the CCCS Baseline Controls?

The Canadian Centre for Cyber Security (CCCS) publishes a set of baseline controls that define the minimum cybersecurity posture every Canadian organization should maintain. There are 13 controls, numbered BC.1 to BC.13. They are not a legal requirement for most businesses, but they are the benchmark most Canadian government and regulated-sector buyers expect a small or mid-sized supplier to meet, and they overlap heavily with CPCSC Level 1. Here's what each control covers and what it takes to implement.

Who publishes these controls and why they matter

The Canadian Centre for Cyber Security (CCCS) is Canada's national authority on cybersecurity. It sits within the Communications Security Establishment (CSE) and is the Canadian equivalent of the U.S. CISA.

The CCCS Baseline Controls are published as Baseline Cyber Security Controls for Small and Medium Organizations (ITSM.10.089). They are the minimum controls the Cyber Centre recommends for organizations with fewer than 500 people, and they cover the fundamentals: the controls that, if absent, leave you exposed to the most common attacks.

One point of confusion worth clearing up. CPCSC Level 1 also has 13 controls, but it is a different list, drawn from ITSP.10.171. The two overlap heavily on the basics such as patching, authentication, and incident response, so an organization that meets the CCCS baseline is most of the way to Level 1. Do not treat them as the same checklist. For any Canadian SMB, the CCCS baseline is the right place to start.

What are the 13 CCCS baseline controls?

• BC.1 Develop an incident response plan: write down what you will do before an incident happens, name the owners, and keep contact lists current.
• BC.2 Automatically patch operating systems and applications: turn on automatic updates for operating systems, browsers, email clients, and productivity tools. Unpatched software is the most common way in.
• BC.3 Enable security software: run anti-malware on every device, keep it updated, and use DNS filtering to block known bad destinations.
• BC.4 Securely configure devices: change default passwords, turn off services you do not use, and apply a standard hardened configuration to every new device.
• BC.5 Use strong user authentication: require multi-factor authentication for all accounts, enforce sensible password rules, and give administrative accounts the strongest protection.
• BC.6 Provide employee awareness training: run regular security awareness training. Phishing is still the leading attack vector, and trained people are your first line of defence.
• BC.7 Backup and encrypt data: back up automatically, keep at least one copy offline or otherwise out of reach of ransomware, test the restore, and encrypt sensitive data at rest and in transit.
• BC.8 Secure mobility: govern laptops, phones, and tablets, including personal devices used for work, with device management, encryption, and the ability to wipe a lost device.
• BC.9 Establish basic perimeter defences: use a firewall, secure your Wi-Fi, and require a VPN or equivalent secure access for remote connections into your network.
• BC.10 Secure cloud and outsourced IT services: know which cloud and managed services hold your data, check that providers meet your security expectations, and keep the contracts and access in writing.
• BC.11 Secure websites: keep your public-facing sites patched, use HTTPS everywhere, and follow secure web application practices such as the OWASP guidance.
• BC.12 Implement access control and authorization: give people, contractors, and applications only the access they need, review it regularly, and revoke it the day it is no longer required.
• BC.13 Secure portable media: control the use of USB drives and other removable media, encrypt them when they are needed, and wipe them before disposal.

How to assess your compliance

Going through this list and honestly answering whether each control is implemented is a good starting point. Most Canadian SMBs are partially compliant: some controls in place, others missing.

The most common gaps we see are a documented incident response plan (BC.1), a standard secure configuration for devices (BC.4), and any real governance of cloud and outsourced IT services (BC.10).

If you are preparing for CPCSC Level 1, mapping your posture against the CCCS baseline is a sensible first step, then close the gap against the Level 1 list from ITSP.10.171. The gap between where you are and where Level 1 requires you to be becomes your implementation plan.

HuCortex maps your posture against the CCCS baseline controls as part of CPCSC readiness assessments and BYOE contractor governance reviews.