Terms and Conditions for the Use of a Cyber Security Canada Certification Badge

Use of our certification badge

When your organization is certified by Cyber Security Canada, you may display our certification badge. These terms set out how it may be used, and they apply to every certified organization.

They cover the CyberSecure Canada badge (CAN/DGSI 104:2021, Rev 2:2026) and the ISO/IEC 27001 certification mark.

Who may use the badge

Only organizations holding a current certification issued by Cyber Security Canada, and only for the scheme and scope they are certified for. The right to use the badge begins on the effective date of your certificate and ends if that certificate is suspended or withdrawn.

Use of the badge is a non-exclusive, non-transferable, revocable licence. It may not be passed to a parent company, a subsidiary, a partner, or any site outside the scope on your certificate.

Where you may use it

On your marketing materials — your website, brochures, business cards, presentations, proposals, email signatures and social media.

Your use of the badge must never suggest that a product, process or service is certified. Certification applies to your management system, not to what you sell.

Where you must not use it

• On a product, on product packaging, or anywhere a reader could take it to mean the product itself is certified. Packaging here means anything that can be removed without damaging the product. A type label or identification plate counts as part of the product.
• On laboratory test reports, calibration reports, inspection reports or certificates, or on any certificate of conformity you issue.
• On activities, sites or services outside the scope of your certificate.
• In any way that implies sponsorship, endorsement or partnership with Cyber Security Canada beyond the fact of your certification.
• In any way that is misleading, defamatory, illegal or offensive, or that would bring Cyber Security Canada or the certification system into disrepute.

Statements on packaging or accompanying information

You may state on product packaging or in accompanying information that your organization holds a certified management system — but the statement must not imply that the product, process or service is itself certified.

Accompanying information means material that is separately available or easily detachable, such as an insert or a leaflet.

Any such statement must include:

• the name or brand identifying your organization
• the type of management system and the standard it is certified against — for example, information security management system, ISO/IEC 27001
• Cyber Security Canada as the body that issued the certificate

How to display the badge

Keep it intact. Use the badge in its original colours, proportions and design. Do not stretch, compress, recolour or alter it, and do not combine it with other graphics or logos to make a new symbol.

Make it visible. Display it large enough to be recognised — in a website header or footer, on a certification page, or beside your own logo. On printed materials, place it where it is clearly legible.

Link it. Wherever the badge appears on a digital platform, link it to cybersecuritycanada.com so that anyone can verify your certification and read about the standard.

Give it equal footing. If it appears alongside other certification marks, show it at comparable size and prominence.

Be clear about what is certified. The badge, and any text around it, must leave no doubt about which organization is certified, against which standard, and that Cyber Security Canada granted the certification.

If your certification changes

If your scope is reduced, amend every piece of advertising and every website reference so that nothing claims certification for activities no longer covered.

If your certification is suspended, stop promoting your certification immediately and for as long as the suspension lasts. A suspended certification is temporarily invalid.

If your certification is withdrawn or expires, stop using the badge immediately and remove every reference to the certification from your advertising and your website.

If the badge itself is updated, we will tell you, and you are responsible for replacing it with the current version.

If the badge is misused

We monitor how our badge and certification documents are referred to, and we review this with you at each surveillance and recertification audit.

Where we find an incorrect or misleading reference, we will ask you to correct it within a set period. If it is not corrected, we may suspend or withdraw your certification and your right to use the badge, and we may publish the change in certification status.

Questions

Email [email protected].