The Region of Durham is now the first municipality in Canada to be certified under ISO/IEC 27001:2022, a globally recognized standard for information security management.
The certification was awarded to the Region's Corporate Services – Information Technology division, according to a Region of Durham news release. The regional headquarters is located on Rossland Road East in Whitby.
ISO/IEC 27001:2022 is described as the world's leading standard for Information Security Management Systems. It sets strict requirements for how organizations manage and protect information, covering confidentiality, integrity and availability.
For residents, the Region says the certification means the core systems behind essential services — including health and social services, infrastructure and finance — are built with security as a foundation. The Region holds personal and sensitive information that residents share when accessing programs and services.
The achievement follows more than two and a half years of investment in cybersecurity across the organization, including a comprehensive audit completed in spring 2026. The Region said feedback from the audit was highly positive, pointing to strong security practices and well-prepared teams.
"Information security is at the core of everything we do, and this milestone reflects years of dedication and collaboration across the organization," Chief Administrative Officer Elaine Baxter-Trahair said in the release. "Achieving ISO/IEC 27001:2022 validates the strength of our systems and processes, and it positions the Region as a leader in protecting the information that supports critical services for our residents."
Baxter-Trahair added that the Region will keep strengthening its practices to stay ahead of emerging risks.
Chief Information Officer and Chief Information Security Officer Chi-Cheng Chu said the certification reinforces the Region's commitment to the people it serves.
"Residents trust us with their personal information every day. Achieving ISO/IEC 27001:2022 demonstrates that we are meeting the global standards to keep that information safe, secure, and protected," Chu said. "As the first municipality in Canada to earn this certification, we are proud to lead the way in building trust and confidence in how public sector organizations safeguard data."
The Region framed the milestone as a new benchmark for municipalities across the country, but stressed that the work is ongoing. Officials say information security practices will continue to be enhanced to keep pace with evolving risks.
