Canadian Survey of Cyber Security and Cybercrime (CSCSC)

Detailed information for 2023





Record number:


The purpose of the 2023 Canadian Survey of Cyber Security and Cybercrime is to measure the impact of cybercrime on Canadian businesses.

The survey gathers information about:
- The measures businesses have implemented for cyber security, including employee training;
- The types of cyber security incidents that impact businesses; and
- The costs associated with preventing and recovering from cyber security incidents.


The 2023 Canadian Survey of Cyber Security and Cybercrime is conducted on behalf of Public Safety Canada. This survey was launched because of the need to benchmark and monitor the rapidly evolving environment surrounding cyber security and cybercrime. The data collected serves the following broad objectives: to further understand the impact of cybercrime on Canadian businesses including aspects such as investment in cyber security measures, cyber security training, the volume of cyber security incidents and the costs associated with responding to these incidents.

Reference period: The 12-month calendar year

Collection period: January through March


  • Business and government internet use
  • Crime and justice
  • Information and communications technology

Data sources and methodology

Target population

The target population was derived from Statistics Canada's Business Register (BR). The BR is an information database on the Canadian business population and serves as a frame for all Statistics Canada business surveys. It is a structured list of businesses engaged in the production of goods and services in Canada.

This survey covers enterprises operating in Canada in almost all industrial sectors. The industries in the target population are based on the 2022 North American Industry Classification System (NAICS). Sectors 11, 21, 22, 23, 31, 32, 33, 41, 44, 45, 48, 49, 51, 52, 53, 54, 55, 56, 61, 62, 71, 72 and 81 were included. The following entities were excluded to arrive at the target population:

- Enterprises with less than 10 employees;
- Crop production (111), animal production and aquaculture (112), fishing, hunting and trapping (114), support activities for crop production (1151), support activities for animal production (1152), specialty trade contractors (238), head offices (551114), private households (814), and public administration (91);
- Enterprises from sectors 11, 23, 48, 49, 53, 54, 56, 61, 62, 71, 72 and 81 with a revenue less than $100,000;
- Enterprises from sectors 21, 22, 31, 32, 33, 41, 44, 45, 51, 52 and 55 with a revenue less than $250,000.

Instrument design

The survey data are collected using an electronic questionnaire.

The questionnaire had revisions compared to the previous version in 2021 to better meet the policy needs of the sponsoring partner: Public Safety Canada. Subject matter experts, private businesses and external stakeholders were also consulted during the content development process.

Cognitive testing of the questionnaire content was carried in conjunction with the Questionnaire Design Resource Center based at Statistics Canada in both official languages. For the 2017 iteration, the entire questionnaire was tested through one-on-one interviews with potential respondents that took place in Ottawa, Toronto, Montreal and Vancouver. For the 2019, 2021 and 2023 iterations, the revised content was tested through one-on-one telephone interviews with potential respondents. The resulting comments and analysis of these interviews led to revisions of the questionnaire to make the questions more relevant to respondents and easier to answer.


This is a sample survey with a cross-sectional design.

The survey frame was constructed by selecting all enterprises from the BR that met the definition of the target population. The number of enterprises within the target population was 208,537 enterprises.

Enterprises are stratified by industry and size categories. The size category is based on the number of employees of the enterprise. Three size categories were built: small (10-49 employees), medium (50-249 employees) and large (250 or more employees).

The overall size of the survey sample was determined based on the following:

- Domains specified at the 2-digit, 3-digit or 4-digit level of NAICS, depending on the sector;
- An expected standard error (SE) with equal quality by the 3 employment size groups of 4.75% for the 2-digit level of NAICS and 5.85% in specific 3-digit or 4-digit level of NAICS, for a reported proportion of 50%;
- A response rate of 65%.

The probability of a particular enterprise being selected in the survey sample was determined based on the proportion of the survey sample allocated to its domain, the number of enterprises in its domain in the population and its revenue.

The final sample size was 12,453 enterprises.

Data sources

Data collection for this reference period: 2024-01-08 to 2024-03-28

Responding to this survey is mandatory.

Data are collected directly from survey respondents.

Data are collected through an electronic questionnaire. Businesses are initially contacted by telephone during a pre-contact phase to identify an appropriate contact within the enterprise to respond to the survey.

Follow-up because of non-response, inconsistent or missing data is done by phone on a priority basis.

View the Questionnaire(s) and reporting guide(s) .

Date modified: