Start with one question: is your organisation in a group that Ontario's Enhancing Digital Security and Trust Act page lists for the cyber security regulation, O. Reg. 51/26? Then ask your IT provider what records it can supply for the three requirements that page describes. Treat the replies as questions for your renewal discussion, not as a verdict.
According to Ontario's strategy report, Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, introduced the Enhancing Digital Security and Trust Act, 2024 (EDSTA). The report says the bill received Royal Assent on November 25, 2024.
Does O. Reg. 51/26 list my organisation?
Ontario's EDSTA page says new regulations under EDSTA take effect starting July 1, 2026. It lists four groups for the cyber security regulation.
Those groups are: hospitals graded Group A, B or C under the Public Hospitals Act, plus the University of Ottawa Heart Institute; colleges and universities as defined in FIPPA; school boards as defined in the Education Act; and children's aid societies as defined in the Child, Youth and Family Services Act, 2017, including Indigenous child and family well-being agencies.
The page names the organisations the regulation applies to. It does not name suppliers. If a listed client asks you for information, ask the client in writing what it needs, in what form and by when, and which parts it links to the regulation or to your contract.
What the regulation asks of listed organisations
Ontario's EDSTA page says listed organisations will be required to do three things. First, designate a primary cyber security contact and an alternate, and submit their contact details to the Chief Information Security Officer of the Ministry of Public and Business Service Delivery and Procurement.
Second, conduct a cyber security maturity assessment every two years and submit a summary to that officer. Third, report critical cyber security incidents to that officer within 72 hours after the incident is confirmed, according to the same page.
The page also links implementation supports intended to help in-scope organisations comply. If you are listed, read that guidance directly.
What to ask your IT provider
How to record the replies
Keep four labels separate. Reported: what the provider states. Record supplied: a document, export or log you received, which does not by itself confirm accuracy or completeness.
Check performed: what you compared, who compared it and the narrow result. Unknown or outside agreed scope: the open question and who you asked to answer it.
A supplied record reports what the provider recorded for the systems it names. On its own, it says nothing about unnamed systems or how a future incident would be handled. A slow or partial reply is consistent with several explanations, such as workload or an unclear request, so record it as an open question.
Using the answers in a keep, improve, renew or replace discussion
If you are listed, set each reply beside the three requirements. For each gap, note the provider's explanation, who you understand owns the item, and whether a corrected or additional record was promised or received.
Clear answers may support keeping or renewing with responsibilities written down. Open questions may point to improving the agreement first. Neither outcome follows from the replies alone. The same evidence labels help when checking who verified your cyber insurance questionnaire answers.
actually. offers an independent review of evidence about your existing IT provider.
The review is a paid service.
Read about the actually. review.