Canadian Survey of Cyber Security and Cybercrime (CSCSC)

Detailed information for 2025

The purpose of the 2025 Canadian Survey of Cyber Security and Cybercrime is to measure the impact of cybercrime on Canadian businesses and organizations.

The survey gathers information about:
- The measures businesses and organizations have implemented for cyber security, including employee training;
- The types of cyber security incidents that impact businesses and organizations; and
- The costs associated with preventing and recovering from cyber security incidents.

• Questionnaire(s) and reporting guide(s)
• Description
• Data sources and methodology

Description

The 2025 Canadian Survey of Cyber Security and Cybercrime is conducted on behalf of Public Safety Canada. This survey was launched because of the need to benchmark and monitor the rapidly evolving environment surrounding cyber security and cybercrime. The data collected serves the following broad objectives: to further understand the impact of cybercrime on Canadian businesses and organizations including aspects such as investment in cyber security measures, cyber security training, the volume of cyber security incidents and the costs associated with responding to these incidents.

Reference period: The 12-month calendar year

Collection period: January through March

Subjects

• Business and government internet use
• Crime and justice
• Information and communications technology

Data sources and methodology

Target population

The target population was derived from Statistics Canada's Business Register (BR). The BR is an information database on the Canadian business population and serves as a frame for all Statistics Canada business surveys. It is a structured list of businesses engaged in the production of goods and services in Canada.

This survey covers enterprises operating in Canada in almost all industrial sectors. The industries in the target population are based on the 2022 North American Industry Classification System (NAICS). Sectors 11, 21, 22, 23, 31, 32, 33, 41, 44, 45, 48, 49, 51, 52, 53, 54, 55, 56, 61, 62, 71, 72 and 81 were included. The following entities were excluded to arrive at the target population:

- Enterprises with less than 10 employees;
- Crop production (111), animal production and aquaculture (112), fishing, hunting and trapping (114), support activities for crop production (1151), support activities for animal production (1152), specialty trade contractors (238), head offices (551114), private households (814), and public administration (91);
- Enterprises from sectors 11, 23, 48, 49, 53, 54, 56, 61, 62, 71, 72 and 81 with a revenue less than $100,000;
- Enterprises from sectors 21, 22, 31, 32, 33, 41, 44, 45, 51, 52 and 55 with a revenue less than $250,000.

In 2025, the target population also includes organizations from Schedule IV and V of the Financial Administration Act (FAA) and federal government units from the Public Sector Universe (PSU). The in-scope units from the PSU include federal government business enterprises but exclude the unit which represents the Government of Canada as a whole.

Instrument design

The survey data are collected using an electronic questionnaire.

The questionnaire had revisions compared to the previous version in 2023 to better meet the policy needs of the sponsoring partner: Public Safety Canada. Subject matter experts, private businesses and external stakeholders were also consulted during the content development process.

Cognitive testing of the questionnaire content was carried in conjunction with the Questionnaire Design Resource Center based at Statistics Canada in both official languages. For the 2017 iteration, the entire questionnaire was tested through one-on-one interviews with potential respondents that took place in Ottawa, Toronto, Montreal and Vancouver. For the 2019, 2021, 2023 and 2025 iterations, the revised content was tested through one-on-one telephone interviews with potential respondents. The resulting comments and analysis of these interviews led to revisions of the questionnaire to make the questions more relevant to respondents and easier to answer.

Sampling

This is a sample survey with a cross-sectional design.

The survey frame was constructed by selecting all enterprises from the BR that met the definition of the target population. The number of enterprises within the target population was 210,635 enterprises.

Enterprises are stratified by industry and size categories. The size category is based on the number of employees of the enterprise. Three size categories were built: small (10-49 employees), medium (50-249 employees) and large (250 or more employees).

The overall size of the survey sample was determined based on the following:

- Domains specified at the 2-digit, 3-digit or 4-digit level of NAICS, depending on the sector;
- An expected standard error (SE) with equal quality by the 3 employment size groups of 4.75% for the 2-digit level of NAICS and 5.85% in specific 3-digit or 4-digit level of NAICS, for a reported proportion of 50%;
- A response rate of 65%.

The probability of a particular enterprise being selected in the survey sample was determined based on the proportion of the survey sample allocated to its domain, the number of enterprises in its domain in the population and its revenue.

The final sample size was 12,628 enterprises.

Data sources

Data collection for this reference period: 2025-11-03 to 2026-03-31

Responding to this survey is mandatory.

Data are collected directly from survey respondents.

Data are collected through an electronic questionnaire. Businesses are initially contacted by telephone during a pre-contact phase to identify an appropriate contact within the enterprise to respond to the survey.

Follow-up because of non-response, inconsistent or missing data is done by phone on a priority basis.

View the Questionnaire(s) and reporting guide(s) .