Country profile · Cyber resilience
Canada
Canada has a national CERT, Canadian Centre for Cyber Security (and 1 more team in our list), and our daily collector sees it publishing. On the Bloch Index it ranks 24th of 191; its context pillars score Economy 56.8, Governance 93.5, Education 75.5.
OECDUNIMFWBNATOG7G20USMCA
Publishing
National CERT
CCCS
65.3
Cyber resilience rating
B · Established · first pass, 3 of 7 pillars
24th
Bloch Index rank
of 191 countries · score 70.2
First pass. This rating covers 3 of the methodology's 7 pillars, scored from evidence we already hold (treaty and adequacy registers, our own CERT list and collector, and passive checks of two government websites per country). It is a starting point, not a verdict: the remaining pillars, a wider government-domain sample and corrections from the countries themselves will move it edition by edition. Version v0.1 first pass, cut-off 2026-10-26.
Our cyber reasoning
The Cyber Risk Barometer rates countries on protection in practice, not on paper: each indicator is a public, checkable fact or something we measure ourselves. The seven pillars, their fixed weights and the A to E bands are set out in the methodology before any country is scored. This page shows every indicator we hold for Canada, with the evidence behind it.
How the rating is built
Each pillar is scored 0 to 100 from its indicators. The rating is the weighted mean of the pillars scored so far, on the fixed weights published in the methodology. The 4 pillars not yet scored are left out and the weights renormalised, so this is a preview, 3 of 7 pillars.
| Pillar | Weight | Score | Points |
|---|
| Gold-standard data protection | 20 | 45.0 | 18.0 |
| National CERT in action | 15 | 100.0 | 30.0 |
| Government cyber hygiene, measured | 15 | 57.8 | 17.3 |
| Weighted mean | 65.3 |
| Cyber resilience rating | 65.3 · B Established |
Is the country bound by Convention 108/108+, or recognised by the EU or UK as giving equivalent protection?
Sources: Council of Europe Treaty Office; European Commission and ICO adequacy lists.
Is there a national CERT, and is it visibly working? Three of the six indicators are measured today from our own list and collector; the other three are still to be measured. Our daily collector reads every working feed, so "publishing" is observed, not declared.
| Indicator | Evidence | Points |
|---|
| ✓ A national (government-designated) CERT/CSIRT existsP2.EXISTS | Canadian Centre for Cyber Security | 4 / 4 |
| ✓ It is publishing: our daily collector sees a working feedP2.ACTIVE90 | Feed working | 4 / 4 |
| ✓ Machine-readable feed (RSS, Atom or JSON) or public advisoriesP2.FEED | Feed published | 1 / 1 |
| · It is a FIRST memberP2.FIRST | Not yet measured | – / 2 |
| · It publishes regularly (12 or more items in the last 12 months)P2.REGULAR | Not yet measured | – / 2 |
| · It publishes an annual report or statisticsP2.REPORT | Not yet measured | – / 2 |
- Canadian Centre for Cyber Security (CCCS) · National cyber agency · North America · languages en/fr · website · news · alerts · feed · status: feed ok
The rss/v1 URLs redirect to the atom/v1 equivalents; the alerts and advisories feed is very active (latest 2026-10-05). - CERT-QC · Regional / supranational · North America · languages fr · website · alerts · feed · status: feed ok
The site is now branded Centre gouvernemental de cyberdéfense (CERT-QC is part of it); the Atom feed has only vulnerability notices (avis) and is large (~9 MB, ~475 entries); no separate news page.
Sources: Our national-CERT list (FIRST teams directory plus hand-added teams) and our daily feed collector; status checked 2026-10-26.
Government cyber hygiene, measured
15% of the rating
58/ 100 · 8.67 of 15 points
Do the country's own government websites and email domains follow basic security practice? First-pass sample: the national CERT's and the data protection authority's websites.
| Indicator | Evidence | Points |
|---|
| ½ DMARC at p=quarantine or p=rejectP6.DMARC | 2 of 3 domains pass: www.cyber.gc.ca, www.cyber.gouv.qc.ca checked 2026-10-26 | 2.67 / 4 |
| ½ SPF record present and not +allP6.SPF | 2 of 3 domains pass: www.cyber.gc.ca, www.priv.gc.ca checked 2026-10-26 | 1.33 / 2 |
| ✗ DNSSEC: zone signed (DS record)P6.DNSSEC | 0 of 3 domains pass: none checked 2026-10-26 | 0 / 3 |
| ✓ HTTPS front page with a valid certificateP6.HTTPS | 3 of 3 domains pass: www.cyber.gc.ca, www.cyber.gouv.qc.ca, www.priv.gc.ca checked 2026-10-26 | 3 / 3 |
| ✓ Strict-Transport-Security headerP6.HSTS | 3 of 3 domains pass: www.cyber.gc.ca, www.cyber.gouv.qc.ca, www.priv.gc.ca checked 2026-10-26 | 1 / 1 |
| ½ security.txt with a contactP6.SECTXT | 1 of 3 domains pass: www.cyber.gouv.qc.ca checked 2026-10-26 | 0.67 / 2 |
Domains sampled
| Domain | DMARC | SPF | DNSSEC | HTTPS | HSTS | security.txt |
|---|
| www.cyber.gc.caCanadian Centre for Cyber Security · national CERT | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ |
| www.cyber.gouv.qc.caCERT-QC · national CERT | ✓ | ✗ | ✗ | ✓ | ✓ | ✓ |
| www.priv.gc.caOffice of the Privacy Commissioner of Canada (Commissariat à la protection de la vie privée du Canada) · data protection authority | ✗ | ✓ | ✗ | ✓ | ✓ | ✗ |
A first-pass sample of the two government bodies most responsible for cyber and privacy. Passive lookups only: DNS records and the HTTPS front page.
Sources: Our own passive DNS and HTTPS checks of government domains.
These pillars are defined in the methodology with fixed weights and yes / partial / no indicators against a fixed standard. They appear here, with every indicator and its evidence, as each is scored.
| Pillar | Weight | Main sources |
|---|
| Citizens' rights protectedDoes a GDPR-grade law give people enforceable rights, and does an independent authority use its powers? | 20 | Statutes; regulator sites; our fines data |
| Incident reporting and transparencyMust serious cyber incidents and personal-data breaches be reported, quickly, and does the public get to know? | 10 | Statutes and regulator rules |
| Cybercrime law and cooperationCan the country prosecute cybercrime and work across borders? | 10 | Council of Europe Treaty Office (Budapest Convention); UN cybercrime convention status; FIRST membership |
| AI and emerging-tech safeguardsAre there binding rules for high-risk AI and for connected-product security? | 10 | Statutes |
Table: Cyber Risk Barometer · WLD-CRB-57 · Source: Cyber Risk Barometer national-CERT list (FIRST teams directory plus hand-added teams) and daily feed collector, status 2026-10-26; data/ratings.json v0.1 first pass
Context from the Bloch Index
Three of the Bloch Index's seven pillars, reused as it publishes them: the economy, institutions and education that shape a country's cyber capacity. Every indicator is ranked against every other country the Bloch Index scores (191) and turned into a percentile score from 0 to 100; a pillar is the average of its indicators. Snapshot of 2026-10-05; these numbers do not enter the cyber rating.
Economic strength, stability and growth, measured by GDP per head, inflation, unemployment, growth rate and debt sustainability.
| Indicator | Value | Year | Percentile score |
|---|
| Inflation% · lower is better · FP.CPI.TOTL.ZG | 2.1 | 2025 | |
| Unemployment% of labour force · lower is better · SL.UEM.TOTL.ZS | 6.9 | 2025 | |
| GDP per headUS$ (PPP) · higher is better · NY.GDP.PCAP.PP.CD | 66,746 | 2025 | |
| GDP growth% · higher is better · NY.GDP.MKTP.KD.ZG | 1.7 | 2025 | |
| Central government debt% of GDP, IMF GFS consolidated · lower is better · GC.DOD.TOTL.GD.ZS | 64.1 | 2024 | |
World Bank fundamentals (50.5) are blended 80/20 with a market signal: the 10-year government bond yield of 3.83% (2026-09, OECD) scores 81.8, giving 56.8.
Institutional quality and accountability: rule of law, control of corruption, voice and accountability, and government effectiveness (World Bank Worldwide Governance Indicators).
| Indicator | Value | Year | Percentile score |
|---|
| Rule of lawWGI score, 0 to 100 · higher is better · GOV_WGI_RL.SC | 82.97 | 2025 | |
| Control of corruptionWGI score, 0 to 100 · higher is better · GOV_WGI_CC.SC | 80.21 | 2025 | |
| Voice & accountabilityWGI score, 0 to 100 · higher is better · GOV_WGI_VA.SC | 85.16 | 2025 | |
| Govt effectivenessWGI score, 0 to 100 · higher is better · GOV_WGI_GE.SC | 88.31 | 2025 | |
Educational access and attainment: secondary and tertiary enrolment.
| Indicator | Value | Year | Percentile score |
|---|
| Tertiary enrolment% (gross) · higher is better · SE.TER.ENRR | 76.3 | 2023 | |
| Secondary enrolment% (net) · higher is better | no recent data |
Table: Cyber Risk Barometer · WLD-CRB-58 · Source: Bloch Index (blochindex.web.app) snapshot 2026-10-05; World Bank World Development Indicators and Worldwide Governance Indicators; OECD long-term government bond yields
Full Bloch Index profile for Canada → (all seven pillars, nineteen indicators and the wider evidence).
League table context
The connectivity and economic columns shown for Canada in the league table. Fixed broadband is fetched live from the World Bank; the rest come from the Bloch Index's World Bank snapshot.
| Indicator | Value | Year |
|---|
| Fixed broadband per 100 people | 42.5 | 2024 |
| Internet users (% of population) | 94% | 2024 |
| GDP per head (PPP, int$) | $66,746 | 2025 |
| Central government debt (% of GDP, World Bank/IMF GFS) | 64% | 2024 |
| Tertiary enrolment (% gross) | 76% | 2023 |
Table: Cyber Risk Barometer · WLD-CRB-59 · Source: World Bank World Development Indicators (IT.NET.BBND.P2 live; IT.NET.USER.ZS, NY.GDP.PCAP.PP.CD, GC.DOD.TOTL.GD.ZS, SE.TER.ENRR via the Bloch Index snapshot 2026-10-05)