Article · Cybersecurity
Cybersecurity essentials for Canadian small and medium-sized businesses
You do not need a security department to be meaningfully safer. Canada’s national cyber security authority publishes a baseline set of controls designed for organizations like yours. This guide explains them in practical terms and suggests where to start.
- Published
- 7 min read
On this page
Key takeaways
- The Canadian Centre for Cyber Security publishes baseline cyber security controls written specifically for small and medium organizations.
- Most of those controls are achievable with tools you may already license, such as Microsoft 365 Business Premium.
- Start with the controls that stop the most common incidents: MFA, patching, protected backups, endpoint protection and staff awareness.
- Write down an incident response plan before you need it, including who to call and how to reach them if email is down.
- CyberSecure Canada is a federal program that lets SMEs have their security practices independently assessed against a national standard based on the baseline controls.
- Privacy and breach-reporting obligations vary by province and sector; confirm yours with qualified advisers.
Why small and medium organizations are targeted
Many owners assume attackers are only interested in large companies. In practice, much of today’s cybercrime is automated and opportunistic. Phishing campaigns, password-guessing tools and scans for unpatched remote-access devices do not check the size of the organization before they try. A small accounting office, construction firm or clinic with valuable client data, regular payments and limited IT oversight is an attractive target.
The most common outcomes for small businesses are business email compromise, where an attacker uses a hijacked mailbox to redirect payments, and ransomware, where files and systems are encrypted and often copied before a ransom demand. Both are disruptive and expensive, and both are made far less likely by a handful of well-implemented basics.
The Canadian Centre for Cyber Security baseline controls
The Canadian Centre for Cyber Security, part of the Communications Security Establishment, is Canada’s federal authority on cyber security. Among its public guidance is a document of baseline cyber security controls for small and medium organizations. It is written to help organizations without dedicated security teams focus on the measures that give the greatest protection for the effort involved.
The baseline begins with organizational steps, such as identifying what information and systems are most important to your business and who is responsible for security decisions, and then sets out controls in areas including incident response planning, automatic patching, security software, secure device configuration, strong user authentication, employee awareness training, backup and encryption, mobile device security, perimeter defences, securing cloud and outsourced IT services, website security, access control and the handling of portable media.
The guidance is free to read on the Cyber Centre’s website and is worth reviewing directly. The sections below translate its themes into practical first steps for a typical Microsoft 365 office in British Columbia or Alberta.
Practical first steps, theme by theme
Strong authentication
Turn on multifactor authentication for email, remote access, banking, accounting and payroll systems. Use a password manager so staff can have unique passwords without writing them down.
Patching
Enable automatic updates for operating systems, browsers and common applications. Track firewalls, VPN appliances and other network devices separately, because they do not update themselves.
Security software
Run current endpoint protection on every computer, with tamper protection turned on and someone responsible for reviewing alerts.
Secure configuration
Remove default passwords, disable unused services, remove local administrator rights from daily-use accounts and encrypt laptops.
Backup and encryption
Back up important data regularly, keep at least one copy that ransomware cannot reach, and test restores. Encrypt data on portable devices.
Awareness training
Teach staff to recognize phishing, verify payment changes by phone using a known number, and report mistakes quickly without fear of blame.
Access control
Give people access only to what their role needs, review access when roles change, and disable accounts promptly when someone leaves.
Cloud and outsourced services
Understand which security responsibilities your cloud providers and IT vendors carry and which remain yours, and ask vendors how they protect your data and their access to it.
Write a simple incident response plan
The baseline treats incident planning as a starting point, not an afterthought. A useful plan for a small business can fit on a few pages.
Define what counts as an incident
Examples include a suspected compromised mailbox, ransomware, a lost unencrypted laptop, or an employee sending client data to the wrong person.
Name the people
List who decides, who handles technical response, who communicates with staff and clients, and external contacts such as your IT provider, cyber insurer, lawyer and bank.
Plan for email being unavailable
Keep a printed or offline contact list with mobile numbers, because a compromised tenant may be the very thing you cannot trust.
Document first actions
For example: disconnect affected devices from the network but do not power them off, reset credentials and revoke sessions, preserve logs, and call your insurer before engaging outside responders if your policy requires it.
Know where to report
Cyber incidents can be reported to the Canadian Centre for Cyber Security, and fraud to the Canadian Anti-Fraud Centre and your local police. Privacy breaches may carry separate notification obligations.
What CyberSecure Canada is, and whether it suits you
CyberSecure Canada is a federal program led by Innovation, Science and Economic Development Canada. It allows small and medium-sized organizations to have their security practices assessed by an accredited third-party body against a national standard that is based on the Cyber Centre’s baseline controls. Organizations that meet the standard can display the program’s mark, which some use to demonstrate good practice to clients and partners or to respond to supplier security questionnaires.
Participation is voluntary, involves fees charged by the assessing body, and requires that the controls actually be in place and documented. For many SMEs the more immediate value is using the same baseline as a structured self-assessment and improvement plan. If your clients or contracts start asking for evidence of security practices, the program is worth considering. Check the program’s official website for current requirements and process.
Privacy and breach obligations
Cybersecurity and privacy law overlap. Private-sector organizations in Canada may be subject to federal privacy law, and British Columbia and Alberta each have their own private-sector privacy legislation that applies to many organizations operating within those provinces. Some of these laws include obligations to report certain breaches to a regulator and notify affected individuals, and sector-specific rules may apply in areas such as health care.
Which rules apply depends on your organization, your sector and where your clients are. Your IT provider can help you implement safeguards, keep records of incidents and support an investigation, but determining legal obligations is a question for qualified legal and privacy advisers.
If you only do five things this quarter
Turn on MFA everywhere it is available, confirm automatic patching on every computer, verify that at least one backup copy is offline or immutable and that a restore works, deploy and monitor endpoint protection, and run a short phishing awareness session with a clear process for verifying payment changes.
Frequently asked questions
Where can I read the Canadian Centre for Cyber Security baseline controls?
The baseline cyber security controls for small and medium organizations are published free of charge on the Canadian Centre for Cyber Security website, alongside other guidance for businesses and the public.
Is CyberSecure Canada mandatory?
No. It is a voluntary federal program. Some organizations pursue it to demonstrate their security practices to clients or partners, while others simply use the underlying baseline controls as a self-assessment framework.
We are only ten people. Do these controls really apply to us?
Yes. The baseline was written for small and medium organizations precisely because they face the same automated attacks as larger ones. Most controls scale down well and can be implemented with tools you may already license.
Can Podium Catchers make us compliant with privacy law?
We help implement and document technical safeguards that support privacy-aware operations, but we do not provide legal advice or compliance sign-off. Your legal and privacy advisers should confirm your obligations.
Related services
Products and packages
Measure your business against the baseline
A security assessment reviews your current controls against recognized small-business guidance and turns the gaps into a practical, prioritized plan.