Assessor-based cyber security solution for Canadian small and micro businesses

Amendment # 2 - Questions and Answers # 6-12

Amendment # 1 - Questions and Answers # 1-5

The Government has made significant investments in helping Canadian SMEs enhance their cyber posture including through Innovation, Science and Economic Development Canada’s (ISED) CyberSecure Canada certification program and its complementary e-learning series. CyberSecure Canada aims to raise the cyber security baseline among Canadian small and medium-sized enterprises (SMEs), increase consumer confidence in the digital economy, promote international standardization and better position SMEs to compete globally. However, more needs to be done to help micro and small businesses and those that lack IT capacity to ensure that they can protect themselves and their clients through enhanced cyber security. Therefore, (ISED) is in the process of planning and developing a new program model to support SMEs, specifically micro and small-sized organizations that lack cyber security expertise or those just starting their cyber security journey.

The government is proposing to work with a third party, called an Authorized Partner Organization (APO), to develop and oversee this project. The selected APO would recruit and approve a network of organizations, on behalf of ISED, to operate as “assessor organizations”. Assessor organizations would be responsible for recruiting and training the assessors which would then work directly with small and micro businesses to offer consulting services and help them implement a series of predefined cyber security controls. Assessors would assess the implementation of the controls and provide recognition for successful implementation. It is envisioned that the APO will assume a central program management role, with a governance structure in which ISED will direct the APO and the program approach. We anticipate a long term relationship with the selected APO. There is some seed funding to help the selected APO’s start-up phase, following which we expect the selected APO to be self-reliant in delivering the program.