Canadian Survey of Cyber Security and Cybercrime - 2023

Business characteristics - Question identifier:1

Which of the following does your business currently use? Select all that apply.

• : Website for your business
• : Social media accounts for your business
• : E-commerce platforms and solutions
• : Web-based applications
• : Open source software
• : Cloud computing or storage
• : Internet-connected smart devices or Internet of Things (IoT)
• : Intranet
• : Blockchain technologies
• : Voice Over Internet Protocol (VoIP) services
• : Remote Access Technology
• : Software or hardware using artificial intelligence (AI)
• : OR
• : Business does not use any of the above

Business characteristics - Question identifier:2

What type of data does your business store on servers which are connected to the Internet.

Include:
• Data stored on cloud computing or storage services
• data stored on servers that can be accessed remotely (e.g., through virtual desktop connections)
• data that are backed-up.

Select all that apply.

• : Personal employee information
• : Personal information about customers, suppliers, or partners
• : Confidential business information
• : Commercially sensitive information
• : Non-sensitive or public information
• : OR
• : Business does not store data on servers which are connected to the Internet

Business characteristics - Question identifier:3

Does anyone in your business use personally-owned devices such as smartphones, tablets, laptops, or desktop computers to carry out regular business-related activities?

Include personally-owned devices with enterprise software installed, and devices that are subsidized by the business.

• : Yes
• : No
• : Do not know

Cyber security environment - Question identifier:4

Which cyber security measures does your business currently have in place?
Include on-site and external security measures, including those provided by an external party. Select all that apply.

• : Mobile security
• : Anti-malware software to protect against viruses, spyware, ransomware, etc.
• : Web security
• : Email security
• : Network security
• : Data protection and control
• : Point-Of-Sale (POS) security
• : Software and application security
• : Hardware and asset management
• : Identity and access management
• : Physical access controls
• : OR
• : Business does not have any cyber security measures in place
• : OR
• : Do not know

Cyber security environment - Question identifier:5

Did any of the following external parties or cyber security standards or cyber security certification programs require your business to implement certain cyber security measures?

Select all that apply.

• : Supplier of physical goods
• : Supplier of digitally delivered goods or services
• : Supplier of other services that are not digitally delivered
• : Customer
• : Partner
• : Canadian departments, agencies, centres or regulators
  
  Which Canadian departments, agencies, centres or regulators required your business to implement certain cyber security measures?
  o Office of the Privacy Commissioner
  o Canadian Radio-television and Telecommunications Commission
  o Competition Bureau
  o Innovation, Science and Economic Development Canada
  o Canadian Centre for Cyber Security (Cyber Centre)
  o Canadian Spam Reporting Centre
  o Canada Revenue Agency (CRA)
  o Other
• : Foreign departments, agencies, centres or regulators
• : Cyber security standard or cyber security certification program
• : Cyber risk insurance provider
• : OR
• : None of the above

Cyber security environment - Question identifier:6

How many employees does your business have that complete tasks related to cyber security as part of their regular responsibilities?

Include part-time and full-time employees. Examples of tasks these employees may complete include:
- managing, evaluating or improving the security of business networks, web presence, email systems or devices;
- patching or updating the software or operating systems used by the business for security reasons;
- completing tasks related to recovery from previous cyber security incidents.

Exclude
• Members of senior management with responsibility for decision making regarding cyber security risks, threats and incidents
• External IT consultants or contractors.

If precise figures are not available, please provide your best estimate.

• : One employee
• : Two to five employees
• : 6 to 15 employees
• : Over 15 employees
• : None
• : Do not know

Cyber security environment - Question identifier:7

What are the main reasons your business does not have any employees that complete tasks related to cyber security as part of their regular responsibilities? Select all that apply.

• : Business uses private sector consultants or contractors to monitor cyber security
• : Business uses public sector consultants or contractors to monitor cyber security
• : Business has cyber risk insurance
• : Business is in the process of recruiting a cyber security employee
• : Business is unable to find an adequate cyber security employee
• : Business lacks the money or resources to employ a cyber security employee
• : Cyber security is not a high enough risk to the business
• : Business' parent organization manages cyber security

Cyber security environment - Question identifier:8

What percentage of the employees that complete tasks related to the cyber security of your organization as part of their regular responsibilities identify as the following genders?

Gender refers to current gender, which may be different from sex assigned at birth and may be different from what is indicated on legal documents.

Exclude individuals employed by external IT consultants or contractors.

If precise figures are not available, please provide your best estimate.

• : Female
• : Male
• : Another gender

Cyber security environment - Question identifier:9

Which of the following population groups do your business's cyber security employees belong to?
Select all that apply.

• : White
• : Indigenous
• : Visible minority
• : OR
• : Do not know

Cyber security environment - Question identifier:10

What are the highest academic certificates, diplomas or degrees your business' cyber security employees hold?

Select the highest academic certificate, diploma or degree that each cyber security employee holds.

• : Less than high school diploma or its equivalent
• : High school diploma or a high school equivalency certificate
• : Trades certificate or diploma
• : College, CEGEP or other non-university certificate or diploma (other than trades certificates or diplomas)
• : University certificate or diploma below the bachelor's level
• : Bachelor's degree
• : University certificate, diploma or degree above the bachelor's level
• : OR
• : Do not know

Cyber security environment - Question identifier:11

What cyber security certifications do your business' cyber security employees hold?

Include certifications that are no longer active.
Exclude academic certificates, diplomas or degrees.

Select all that apply.

• : Certified Ethical Hacker
• : Certified Information Security Manager
• : Certified Information Systems Professional
• : GIAC Security Expert
• : Security+
• : Other certifications
• : OR
• : None
• : OR
• : Do not know

Cyber security environment - Question identifier:12

Which qualification does your business value the most when evaluating a potential new cyber security employee?

Cyber security employees are part-time or full-time employees that complete tasks related to the cyber security of the business as part of their regular responsibilities. Examples of tasks these employees may complete include:
• managing, evaluating or improving the security of networks, web presence, e-mail systems or devices
• patching or updating the software or operating systems used for security reasons
• completing tasks related to recovery from previous cyber security incidents.

Exclude:
• Members of senior management with responsibility for decision making regarding cyber security risks, threats and incidents
• external IT consultants or contractors.

• : Experience working in cyber security
• : Academic certificates, diplomas or degrees related to cyber security
• : Other Cyber security certifications
• : Other cyber security training
• : Other qualifications - Specify other qualifications
• : Business has never attempted to hire a cyber security employee
• : Do not know

Cyber security environment - Question identifier:13

What are the top 3 technical cyber skills you are looking for in potential new cyber security employees?

Select up to three.

• : Script writing
• : Software development, deployment or debugging
• : IT system development, implementation or maintenance
• : Data management or analysis
• : Knowledge of Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS)
• : Experience with IT or network security
• : Experience with application security
• : Experience with cyber security incident response
• : Experience with ethical hacking
• : Other - Specify other technical skills

Cyber security environment - Question identifier:14

In 2023, did your business encounter any challenges finding qualified cyber security employees or retaining existing cyber security employees?

Select all that apply.

• : Challenges finding qualified cyber security employees
• : Challenges retaining cyber security employees
• : OR
• : This business did not encounter any challenges finding or retaining qualified cyber security employees in 2023
• : OR
• : Do not know

Cyber security environment - Question identifier:15

What challenges did your business encounter when hiring cyber security employees in 2023?

Select all that apply.

• : Applicants lacking skills
• : Applicants lacking experience
• : Salary requests too high
• : Not enough time or resources for effective recruitment
• : Lack of candidate interest in the position
• : Other challenges - Specify other challenges
• : OR
• : Do not know

Cyber security environment - Question identifier:16

For which reasons did cyber security employees leave your business in 2023?

Select all that apply.

• : Recruited by other business
• : Limited internal promotion or development opportunities
• : High stress levels at work
• : Lack of flexibility (work-life balance)
• : Better salary
• : Other reasons - Specify other reasons
• : OR
• : No cyber security employees left the business in 2023
• : OR
• : Do not know

Cyber security environment - Question identifier:17

Did your business share best practices or general information on cyber security risks with your employees in 2023?

Include the sharing of information through email, bulletin boards, general information sessions on subjects related to:
• recognizing and avoiding email scams
• importance of password complexity and basic security techniques
• securing your web browser and safe web browsing practices
• avoiding phishing attacks
• recognizing and avoiding spyware.

• a.: Information shared with internal cyber security employees
• b.: Information shared with other employees
  o Yes
  o No
  o Not applicable
  o Do not know

Cyber security environment - Question identifier:18

Did your business provide formal training to develop or upgrade cyber security related skills of your employees or stakeholders in 2023?

Include training provided by external sources.
Exclude ad hoc information sharing between employees.

• 1.: Provided training to internal cyber security employees
• 2.: Provided training to other employees
• 3.: Provided training to stakeholders such as suppliers, customers or partners
  o Yes
  o No
  o Not applicable
  o Do not know

Cyber security environment - Question identifier:19

Why did your business not provide formal training to develop or upgrade the cyber security related skills of some or all of its employees?

• : Unable to find appropriate training
• : Cost of training
• : Not enough time or resources to send employees on training
• : Lack of interest from employees
• : Employees did not require formal training
• : Other

Cyber security environment - Question identifier:20

What are the three main reasons your business spends time on or allocates budget to cyber security measures or related skills training?

Select up to three.

• : Allow employees to work remotely securely
• : Protect the reputation of the business
• : Protect personal information of employees, suppliers, customers or partners
• : Protect trade secrets and intellectual property
• : Compliance with Canadian laws and regulations
• : Compliance with foreign laws and regulations
• : Compliance with contracts
• : Business has suffered a cyber security incident previously
• : Prevent downtime and outages
• : Prevent fraud and theft
• : Secure continuity of business operations
• : Required by cyber risk insurance provider
• : OR
• : Business does not spend time or money on cyber security measures or related skills training

Cyber security readiness - Question identifier:21

Which risk management arrangements does your business currently have in place?
Select all that apply.

• : A written policy in place to manage internal cyber security risks
• : A written policy in place to manage cyber security risks associated with supply chain partners
  
  Does your business's written policy associated with supply chain partners cover any of the following?
  o Cyber security risks related to immediate suppliers or partners
  o Cyber security risks related to you business' wider supply chain
• : A written policy in place to report cyber security incidents
• : Other type of written policy related to cyber security
• : Cyber risk insurance
  
  What type of cyber risk insurance does your business have?
  o Indirect coverage through an existing insurance policy
  o A cyber-specific add-on to an existing insurance policy
  
  What type of cyber-specific add-on does your business have?
  o A cyber-specific add-on to an existing insurance policy with under 100k in coverage
  o A cyber-specific add-on to an existing insurance policy with over 100k in coverage
  o Do not know
  o A cyber-specific add-on to an existing insurance policy
  o Standalone cyber risk insurance
  o Other
• : A procedure for notifying employees of cyber security incidents or threats
• : A Business Continuity Plan (BCP) with processes to manage cyber security threats, vulnerabilities, and risks
• : Employees with responsibility for overseeing cyber security risks and threats
• : Members of senior management with responsibility for decision making regarding cyber security risks, threats and incidents
• : A consultant or contractor to manage cyber security risks and threats
• : Monthly or more frequent patching or updating of operating systems for security reasons
• : Monthly or more frequent patching or updating of software for security reasons
• : Recurring mandatory cyber security training for employees
• : OR
• : Business does not have any risk management arrangements for cyber security

Cyber security readiness - Question identifier:22

Why does your business not have a written policy in place to manage cyber security risks associated with supply chain partners?

Select all that apply.

• : Lack of time or money to invest in developing or upholding a policy
• : Lack of knowledge for how to develop a policy
• : Lack of available information regarding supply chain partners
• : Creating such a policy is not a priority
• : Such a policy is not applicable to this business
• : Business has not considered establishing a policy
• : Other

Cyber security readiness - Question identifier:23

Have any of your written cyber security policies been reviewed by third parties, such as cyber security consultants, or external auditors, within the past 2 years?

• : Yes
• : No
• : Do not know

Cyber security readiness - Question identifier:24

How would you describe the level of preparedness of your business to defend itself against cyber threats?

• : Extremely prepared
• : Very prepared
• : Somewhat prepared
• : Unprepared
• : Very unprepared

Cyber security readiness - Question identifier:25

Which of the following are covered under your cyber risk insurance policy? Select all that apply.

• : Direct losses from an attack or intrusion
• : Incident response
• : Restoration expenses for software, hardware, and electronic data
• : Interruptions (loss of productive time)
• : Reputation losses
• : Third-party liability
• : Cyber extortion or ransom payments
• : Financial losses
• : Security breach remediation and notification expenses
• : Credit monitoring expenses
• : Claims made by employees
• : Other - Please specify
• : OR
• : Do not know

Cyber security readiness - Question identifier:26

When your business's cyber risk insurance was last up for renewal, did your provider change any of the following?

Select all that apply.

• : Higher premiums
• : Higher deductibles
• : Lower coverage limits
• : Additional exclusions
• : Co-insurance
• : Sub-limits
• : Baseline cyber security threshold or cyber security standards checklist required to obtain coverage increased
• : Reduced ransomware coverage
• : More detailed submissions, including but not limited to, supplemental ransomware questionnaires
• : Providing pre-breach services
• : Enlisting third-party cyber security firm to conduct additional assessments
• : Carrying out external scans of web-facing assets
• : Other - Please specify
• : OR
• : None
• : OR
• : Do not know

Cyber security readiness - Question identifier:27

Why does your business not have cyber risk insurance?
Select all that apply.

• : The business' existing insurance policies cover cyber security risks
• : The cost of cyber risk insurance is too high
• : The business' existing cyber security measures provide enough protection that cyber risk insurance is unnecessary
• : The business had no cyber security risks
• : The business has not considered obtaining cyber risk insurance
• : Not aware of cyber risk insurance prior to responding to this survey
• : Other reasons for not having cyber risk insurance
• : OR
• : Do not know

Cyber security readiness - Question identifier:28

Prior to responding to this survey, were you aware of any cyber security standards or cyber security certification programs that businesses can apply for?

Include:
- Canadian, foreign and international standards and programs;
- standards and programs that you were aware of but your business was not eligible for or did not apply for.

Select all that apply.

• : Cyber security standards
  
  Does your business follow any cyber security standards?
  o Yes
  o No
  o Do not know
• : Cyber security certification programs
  
  Does your business hold any cyber security certifications?
  o Yes
  o No
  o Do not know
• : OR
• : Not aware of any cyber security standards or certification programs

Cyber security readiness - Question identifier:29

Which activities does your business undertake to identify cyber security risks?
Select all that apply.

• : Monitoring insider threat risk behaviours
• : Monitoring other employee behaviour
• : Monitoring network and business systems
• : A formal risk assessment of cyber security practices, undertaken by an employee
• : A formal risk assessment of cyber security practices, undertaken by an external party
• : Penetration testing, undertaken by an employee
• : Penetration testing, undertaken by an external party
• : Assessment of the security of Internet-connected smart devices or Internet of Things (IoT) devices
• : Investment in threat intelligence
• : Participation in a cyber security information sharing community
• : Complete audit of IT systems, undertaken by an external party
• : Business conducts other activities to identify cyber security risks
• : OR
• : Business does not conduct any activity to identify cyber security risks

Cyber security readiness - Question identifier:30

How often does your business conduct activities to identify cyber security risks? Select all that apply.

• : On a scheduled basis
  
  On what schedule does your business conduct activities to identify cyber security risks?
  o Daily
  o Weekly
  o Monthly
  o Quarterly
  o Annually
  o Other
• : After a cyber security incident occurs
• : When a new IT initiative or project is launched
• : On an irregular basis

Cyber security readiness - Question identifier:31

How often is senior management in your business given an update on actions taken regarding cyber security? Select all that apply.

• : On a scheduled basis
  
  On what schedule does senior management get updates on actions taken regarding cyber security?
  o Daily
  o Weekly
  o Monthly
  o Quarterly
  o Annually
  o Other
• : After a cyber security incident occurs
• : When a new IT initiative or project is launched
• : Senior management have tools to track cyber security issues
• : Senior management is given an update on an irregular basis
• : OR
• : Senior management is not updated on cyber security issues

Cyber security readiness - Question identifier:32

Which of the following cyber security resources provided by the federal government has your business used?

Select all that apply.

• : Get Cyber Safe campaign
• : CyberSecure Canada certification program
• : Baseline Cyber Security Controls for Small and Medium Businesses
• : Canadian Cyber Security Tool (CCST)
• : Ransomware Playbook
• : Developing an Operational Technology and Information Technology Incident Response Plan
• : Sector specific guidance or tools
• : Other reports, advice or guidance
• : OR
• : None
• : OR
• : Do not know

Cyber security incidents - Question identifier:33

To the best of your knowledge, which cyber security incidents impacted your business in 2023?

Select all that apply.

• : Incidents to disrupt or deface the business or web presence
• : Incidents to steal personal or financial information
• : Incidents to steal money or demand ransom payment
• : Incidents to steal or manipulate intellectual property or business data
• : Incidents to access unauthorised or privileged areas
• : Incidents to monitor and track business activity
• : Incidents with an unknown motive
• : OR
• : Business was not impacted by any cyber security incidents in 2023

Cyber security incidents - Question identifier:34

In 2023, was your business contacted by any of the following external parties regarding their cyber security incidents because they may have involved your business?

Select all that apply.

• : Suppliers, customers or partners
• : IT consultant or contractor
• : Cyber risk insurance provider
• : Canadian department, agency, centre or regulator
  
  Which Canadian departments, agencies, centres or regulators contacted you?
  o Office of the Privacy Commissioner
  o Canadian Radio-television and Telecommunications Commission
  o Competition Bureau
  o Innovation, Science and Economic Development Canada
  o Canadian Centre for Cyber Security (Cyber Centre)
  o Canadian Spam Reporting Centre
  o Canada Revenue Agency (CRA)
  o Other
• : Foreign department, agency, centre or regulator
• : Industry association
• : Bank or other financial institution
• : Software or service vendor
• : Other parties not mentioned above
• : OR
• : External parties did not report their cyber security incidents events to the business in 2023

Cyber security incidents - Question identifier:35

You previously indicated that external parties contacted your business about their cyber security incidents because they may have involved your business in 2023. How did your business react to those cyber security incidents?

Select all that apply.

• : Incidents were resolved internally
• : Incidents were resolved with the external party
• : Incidents were resolved through cyber risk insurance
• : Incidents were resolved through an IT consultant or contractor
• : Incidents were reported to a police service
• : Incidents were reported to other external parties
• : Business is currently working with the external party to resolve the incidents
• : OR
• : No action was necessary or not action was taken by the business

Cost of cyber security incidents - Question identifier:36

In 2023, what was the total amount your business spent to prevent or detect cyber security incidents?

Exclude costs that were incurred specifically due to previous cyber security incidents (e.g., recovery costs from previous cyber security incidents).

If precise figures are not available, provide your best estimate in Canadian dollars.

Enter "0" if there is no value to report.

• a.: Employee salary related to prevention or detection
• b.: Cost of training employees, suppliers, customers, or partners
• c.: Cost of hiring IT consultants or contractors
• d.: Cost of legal services or public relations (PR) services
• e.: Cost of cyber security software
• f.: Cost of hardware related to cyber security
• g.: Annual cost of cyber risk insurance or equivalent
• h.: Other related costs

Cost of cyber security incidents - Question identifier:37

In 2023, what was the total cost to your business to recover from the cyber security incidents?

Exclude costs related to prevention and detection of cyber security incidents as these were asked in the previous question.

If precise figures are not available, provide your best estimate in Canadian dollars.

Enter "0" if there is no value to report.

• a.: Employee salary related to recovery
• b.: Cost of training employees, suppliers, customers, or partners
• c.: Cost of hiring IT consultants or contractors
• d.: Cost of legal services or public relations (PR) services
• e.: Cost of hiring other external parties
• f.: Cost of new or upgraded cyber security software
• g.: Cost of new or upgraded hardware related to cyber security
• h.: Increased cost of cyber risk insurance or equivalent
• i.: Reimbursing suppliers, customers, or partners
• j.: Financial penalties from Canadian regulators or authorities
• k.: Financial penalties from foreign regulators or authorities
• l.: Ransom payments
• m.: Additional credit monitoring fees
• n.: Costs related to notification of a breach
• o.: Other related costs

Impact of cyber security incidents - Question identifier:38

To the best of your knowledge, who perpetrated the cyber security incidents in 2023?

Select all that apply.

• : Incidents to disrupt or deface the business or web presence
• : Incidents to steal personal or financial information
• : Incidents to steal money or demand ransom payment
• : Incidents to steal or manipulate intellectual property or business data
• : Incidents to access unauthorised or privileged areas
• : Incidents to monitor and track business activity
• : Incidents with an unknown motive
  
  • An external party
  • An internal employee
  • Supplier, customer or partner
  OR
  • Do not know

Impact of cyber security incidents - Question identifier:39

What were the methods used by the perpetrator for the cyber security incidents?

Select all that apply.

• : Incidents to disrupt or deface the business or web presence
• : Incidents to steal personal or financial information
• : Incidents to steal money or demand ransom payment
• : Incidents to steal or manipulate intellectual property or business data
• : Incidents to access unauthorised or privileged areas
• : Incidents to monitor and track business activity
• : Incidents with an unknown motive
  
  • Exploiting software, hardware, or network vulnerabilities
  • Password cracking
  • Identity theft
  • Scams and fraud
  • Ransomware
  • Other malicious software
  • Denial of Service (DoS) or Distributed Denial of Service (DDoS)
  • Disruption or defacing of web presence
  • Abuse of access privileges by a current or former internal party
  • Other
  OR
  • Do not know

Impact of cyber security incidents - Question identifier:40

You previously indicated that your business has cyber risk insurance. Did your business attempt to make a claim on that policy after the cyber security incidents in 2023?

Select all that apply.

• : Yes, we successfully made a claim against the business's cyber risk insurance
• : Yes, we attempted to make a claim against the business' cyber risk insurance but were unsuccessful
• : Yes, we attempted to make a claim against the business's cyber risk insurance and it is still in progress
• : OR
• : No, we have not attempted to make a claim for any of the cyber security incidents

Impact of cyber security incidents - Question identifier:41

How was your business impacted by the cyber security incidents in 2023?

Select all that apply.

• : Loss of revenue
• : Loss of suppliers, customers, or partners
• : Additional repair or recovery costs
• : Prevented the use of resources or services
• : Prevented employees from carrying out their day-to-day work
  
  What percentage of employees were prevented from carrying out their day-to-day work at some point in
  2023?
  o Percentage
• : Additional time required by employees to complete their day-to-day work
• : Damage to the reputation of the business or erosion of public trust
• : Financial penalties or fines from Canadian regulators or authorities
• : Financial penalties or fines from foreign regulators or authorities
• : Discouraged business from carrying out a future activity that was planned
• : Minor incidents, impact was minimal to the business
• : Manipulation or theft of data
• : Theft or compromise of software or hardware
• : Required to notify external parties of a breach
• : Other
• : OR
• : Do not know

Impact of cyber security incidents - Question identifier:42

As a result of cyber security incidents, approximately how many hours of downtime did your business experience in 2023?
Include:
- total downtime for mobile devices, desktops, and network;
- time periods during which there was either reduced activity or inactivity of employees or the business.

If precise figures are not available, provide your best estimate, rounded to the nearest hour.

• : Hours
• : OR
• : Business did not experience any downtime in 2023
• : OR
• : Do not know

Cyber security incidents reporting - Question identifier:43

Did your business report any cyber security incidents to a police service in 2023?

Include all levels of police service including federal, provincial, territorial, municipal and Indigenous.

• : Yes
• : No
• : Do not know

Cyber security incidents reporting - Question identifier:44

Which cyber security incidents did your business report to a police service in 2023?

Select all that apply.

• : Incidents to disrupt or deface the business or web presence
• : Incidents to steal personal or financial information
• : Incidents to steal money or demand ransom payment
• : Incidents to steal or manipulate intellectual property or business data
• : Incidents to access unauthorised or privileged areas
• : Incidents to monitor and track business activity
• : Incidents with an unknown motive

Cyber security incidents reporting - Question identifier:45

What were the reasons for reporting incidents to a police service in 2023?

Select all that apply.

• : To reduce the damage caused by the incidents
• : To lower the probability of other businesses being impacted by the same incidents
• : To help catch the perpetrators
• : To fulfill the requirements of customers, suppliers, partners, regulators, cyber security standards or cyber certification programs
• : Other
  o Specify other reasons

Cyber security incidents reporting - Question identifier:46

What were the reasons for not reporting some or all of the cyber security incidents to a police service in 2023?

Select all that apply.

• : Incidents were resolved internally
• : Incidents were resolved through an IT consultant or contractor
• : To keep knowledge of the incidents internal
• : To protect the reputation of the business or stakeholders
• : Did not want to spend more time or money on the issue
• : Police service would not consider incidents important enough
• : Police service was unsatisfactory in the past
• : Unsure of where or how to report
• : Reporting process is too complicated or unclear
• : Did not think the perpetrator would be convicted or adequately punished
• : Minor incidents, not important enough for business
• : Lack of evidence
• : Did not think of contacting a police service
• : OR
• : Business reported all cyber security incidents to a police service in 2023

Cyber security incidents reporting - Question identifier:47

Excluding police services, which other external party did your business report the cyber security incidents to in 2023?

Select all that apply.

• : Suppliers, customers, or partners
• : IT consultant or contractor
• : Cyber risk insurance provider
• : Canadian department, agency, centre or regulator
  
  Which Canadian departments, agencies, centres or regulators did you report to?
  o Office of the Privacy Commissioner
  o Canadian Radio-television and Telecommunications Commission
  o Competition Bureau
  o Innovation, Science and Economic Development Canada
  o Canadian Centre for Cyber Security (Cyber Centre)
  o Canadian Spam Reporting Centre
  o Canada Revenue Agency (CRA)
  o Other
• : Foreign department, agency, centre or regulator
• : Industry association
• : Bank or other financial institution
• : Software or service vendor
• : Cyber security employees at other businesses or organizations
• : OR
• : Business did not report any cyber security incidents to external parties in 2023

Cyber security incidents reporting - Question identifier:48

What were the reasons for not reporting some or all the of the cyber security incidents to an external party in 2023?

Select all that apply.

• : Incidents were reported to a police service only
• : Incidents were resolved internally
• : To keep knowledge of the incidents internal
• : To protect the reputation of the business or stakeholders
• : Lack of evidence
• : No obligation or benefit to reporting
• : Minor incidents, not important enough for business
• : Did not think of reporting the incidents to an external party
• : Did not know where to report cyber security incidents
• : OR
• : Business reported all cyber security incidents to an external parties in 2023

Cyber security incidents reporting - Question identifier:49

In responding to the cyber security incidents in 2023, which external parties did your business contact for information or advice?

Select all that apply.

• : Suppliers, customers, or partners
• : IT consultant or contractor
• : Cyber risk insurance provider
• : Legal services
• : Police services
• : Canadian department, agency, centre or regulator
  
  Which Canadian departments, agencies, centres or regulators did you contact?
  o Office of the Privacy Commissioner
  o Canadian Radio-television and Telecommunications Commission
  o Competition Bureau
  o Innovation, Science and Economic Development Canada
  o Canadian Centre for Cyber Security (Cyber Centre)
  o Canadian Spam Reporting Centre
  o Canada Revenue Agency (CRA)
  o Other
• : Foreign department, agency, centre or regulator
• : Industry association
• : Bank or other financial institution
• : Software or service vendor
• : A cyber security information sharing community
• : Other Internet community
• : Friends, family, or acquaintances
• : Computer repair shop
• : Cyber security employees at other businesses or organizations
• : OR
• : Business did not contact any external parties in 2023

Cyber security incidents reporting - Question identifier:50

Did your business report any attempted but unsuccessful cyber security incidents to police services or other external parties in 2023?

Include all levels of police service including federal, provincial, territorial, municipal and Indigenous.

Yes

Which external parties did your business report the cyber security incidents to?
o Police services
o Suppliers, customer or partners
o IT consultant or contractor
o Cyber risk insurance provider
o Canadian department, agency, centre or regulator

• : Which Canadian departments, agencies, centres or regulators did you report to?
  - Office of the Privacy Commissioner
  - Canadian Radio-television and Telecommunications Commission
  - Competition Bureau
  - Innovation, Science and Economic Development Canada
  - Canadian Centre for Cyber Security (Cyber Centre)
  - Canadian Spam Reporting Centre
  - Canadian Anti-Fraud Centre (CAFC)
  - Canada Revenue Agency (CRA)
  - Other
  
  o Foreign department, agency, centre or regulator
  o Industry association
  o Banks or other financial institution
  o Software or service vendor
  o Cyber security employees at other businesses or organizations
  o Other
• : No
• : Do not know

Current cyber security trends - Question identifier:51

In 2023, what was the total value of ransom payments made by your business?

• : More than $0, but less than or equal to $10,000
• : More than $10,000, but less than or equal to $50,000
• : More than $50,000, but less than or equal to $100,000
• : More than $100,000, but less than or equal to $250,000
• : More than $250,000, but less than or equal to $500,000
• : More than $500,000
• : The business did not make ransom payments in 2023
• : Do not know

Current cyber security trends - Question identifier:52

In 2023, what form of transaction did your business use to make ransom payments?

Select all that apply.

• : Cryptocurrency
• : Gift card
• : E-transfer
• : Other - Please specify

Current cyber security trends - Question identifier:53

In 2023, which external parties did your business work with to address ransomware incidents?

Include all external parties your business reported the ransomware incidents to.

Select all that apply.

• : IT consultant or contractor
• : Cyber risk insurance provider
• : Royal Canadian Mounted Police (RCMP)
• : Other police services
• : Canadian Centre for Cyber Security (Cyber Centre)
• : Canadian Spam Reporting Centre
• : Canadian Anti-Fraud Centre (CAFC)
• : Office of the Privacy Commissioner
• : Other external parties
• : OR
• : The business did not work with external parties to resolve ransomware incidents in 2023
• : OR
• : Do not know

Current cyber security trends - Question identifier:54

In the case of ransomware attacks, does your business have a rule or policy to not pay the ransom?

• : The business has a rule or policy to not pay the ransom
• : The business does not have a rule or policy to not pay the ransom
• : Do not know

Notification of intent to extract web data - Question identifier:55

What is this business's website address?

We may also visit this business's website to search for additional publicly available information using automated methods, being careful not to impede the functionality of the website.

• : Website address