Children's Aid Cyber Program
Maturity assessment using a Ministry-endorsed standard, Managed Security with round-the-clock detection, an incident plan with a 72-hour reporting runbook, Managed Compliance, and yearly training.
Children's aid societies
Cyber security for children's aid societies
Meet Ontario's public-sector cyber rules, including the 72-hour reporting duty.
Who we work with. Children's aid societies, and the school boards, colleges, universities and public hospitals covered by the same rules.
Sound familiar?
When organizations like yours call us
- You need a named senior leader accountable for cyber security.
- Your first maturity assessment is due.
- You need a runbook for reporting a critical incident within 72 hours.
Rules that apply
What the rules ask of you
General information, not legal advice. Use the compliance guide's filter for your exact profile. Last verified: November 6, 2026.
Enhancing Digital Security and Trust Act, 2024
- Ontario's Enhancing Digital Security and Trust Act, 2024 (from Bill 194) and its cyber security regulation (O. Reg. 51/26) came into force July 1, 2026 for children's aid societies, school boards, colleges, universities and many public hospitals.
- A cyber security program meeting set minimums.
- A named senior leader accountable for cyber security and the Ministry's main contact.
- Cyber security maturity assessments using Ministry-endorsed standards. The first is due one year after the rules apply, with a summary to the Ministry within 30 days.
- Critical cyber security incidents reported to the Ministry within 72 hours of confirmation.
- Related rules cover digital information about people under 18.
We confirm the Ministry-endorsed assessment standard with you before scoping.
Recommended
Where to start
Bundles are quoted for your organization. Each one is built from services you can also buy on their own.
FAQ
Questions we hear
Which assessment standard do we use?
One the Ministry endorses. We confirm it with you before scoping.
Start here
Find out where you stand, at a fixed price.
A short discovery call, then a fixed-price assessment with a ranked, costed roadmap: what to fix first, what it costs, and what funding may help.