CAN/DGSI 104:2021 / Rev 1: 2024, Baseline cyber security controls for small and medium organizations

5.7.3.9 is fundamentally broken.

“The organization should ensure that their users join a separate network that is independent of the home network (e.g. guest network)…”

This fails on three levels: technical, operational, and auditability.
1. It assumes control the organization does not have: most organizations do not own or manage employee home routers.

2.“Ensure” implies enforcement, not guidance.

3. You cannot verify compliance without invading privacy.

This is unenforceable for SMBs, especially with a WFH setup.

Modern best practice assumes:
- networks are hostile
- security lives on:
- the endpoint
- identity
- encrypted access

This control is trying to fix endpoint risk with network topology, which is backward.

The real security objective is to prevent public, customer, or third-party access from having implicit or lateral access to internal corporate resources. Segmentation is one method, not the requirement itself.

This control is not about employee home networks at all. It’s about:
- trust boundaries
- exposure surfaces
- preventing pivot paths

Same as my comment for 5.7.3.1: what about WFH businesses?

Wi-Fi is no longer the right boundary: in a remote model, the “Wi-Fi control” is not the core control — the endpoint is.

You cannot guarantee home Wi-Fi security. Even if Wi-Fi is secure, compromise can still happen. A managed device with strong endpoint controls survives insecure networks much better than an unmanaged device on “secure” Wi-Fi.

The control must distinguish between corporate-managed Wi-Fi and remote employee Wi-Fi.

Home routers should not be assumed compliant unless the organization provides and manages them.

For remote work, the right approach is:
- publish minimum Wi-Fi requirements,
- enforce strong device and access controls (VPN/ZTNA, endpoint protections and compliance, DNS filtering),
- optionally use device posture checks to restrict access if the device is unsafe.

What's the expectation for SMBs that have no office, where everyone works from home? They all have their ISP router, so does that address this control? What "proof" would an auditor be looking for?

define basic lifecycle procedures

phishing-resistant f

phishing-resistant

phishing-resistant

phishing resistant

“phishing-resistant authentication

“b. Identification of malicious communications and phishing including AI-enabled social engineering (e.g., deepfake voice/video, synthetic email style, and ‘CEO fraud’ impersonation);”

“NOTE 4: Where an organization supports consequential services (see 3 Terms and definitions) or administers digital credentials, remote identity proofing, or high-risk transactions, the organization should consider adopting authentication controls that are resistant to phishing and impersonation, and applying stronger credential lifecycle controls (issuance, recovery, revocation) appropriate to the risk.”

I never understood why this was a "control". It's just a suggestion that the template provided could be used. When working with customers, I provide my own template, so we never use this. I always set this control to "Not applicable". Perhaps just mention this in the "Context" section?