Despite the scale of information and communications technology investment and the criticality of those systems, Canada does not have a secure-coding policy.