Why This Matters Now
80% of Canadian small businesses experienced at least one cybersecurity incident in the past year. Ontario businesses face additional pressure from PIPEDA (Personal Information Protection and Electronic Documents Act), which requires organizations to protect personal information — and report breaches.
The consequences of a breach go beyond lost data. Under PIPEDA, organizations that fail to report breaches can face fines up to $100,000 per violation. For healthcare organizations in Ontario, PHIPA adds another layer of requirements.
This checklist covers the essentials. It's not exhaustive, but if you can check every box, you're ahead of 90% of small businesses.
The Essential Cybersecurity Checklist
Access & Authentication
- Multi-factor authentication (MFA) enabled on all business email accounts
- MFA enabled on all cloud services (Microsoft 365, Google Workspace, etc.)
- Unique, strong passwords for every account (use a password manager)
- Admin accounts separated from daily-use accounts
- Former employee accounts disabled within 24 hours of departure
- Quarterly review of who has access to what
Email Security
- Advanced email filtering enabled (not just basic spam filtering)
- DMARC, SPF, and DKIM records configured for your domain
- Automatic quarantine of suspicious attachments
- External email warnings enabled (banners on emails from outside your organization)
- Regular phishing simulation tests for staff
Endpoint Protection
- Next-generation antivirus on all workstations and servers
- Automatic OS updates enabled (Windows, macOS)
- Full-disk encryption on all laptops
- Mobile device management (MDM) for company phones
- USB device restrictions on workstations handling sensitive data
Backup & Recovery
- Automated daily backups of all critical data
- Backups stored in at least two locations (on-site + cloud)
- Backup encryption enabled
- Monthly backup restoration tests (backups you can't restore are worthless)
- Documented disaster recovery plan with assigned roles
Network Security
- Business-grade firewall (not a consumer router)
- Guest WiFi separated from business network
- VPN required for remote access
- Network segmentation for sensitive systems (finance, HR)
- Regular vulnerability scans (quarterly minimum)
Employee Training
- Annual cybersecurity awareness training for all staff
- Phishing simulation tests (quarterly)
- Clear reporting process for suspicious emails or activity
- Written acceptable use policy signed by all employees
- Incident response procedure documented and accessible
Compliance (PIPEDA)
- Privacy policy published and up to date
- Breach reporting process documented (72-hour notification requirement)
- Data retention policy defined (don't keep data you don't need)
- Consent mechanisms in place for collecting personal information
- Annual privacy impact assessment
Where to Start
If this list feels overwhelming, start with three things today:
- Enable MFA everywhere. This single step blocks over 99% of account compromise attacks.
- Verify your backups work. Run a test restore this week. If you can't restore, you don't have a backup.
- Train your team. One phishing simulation will show you exactly where your risk is.
Then work through the rest systematically. A managed cybersecurity provider can handle most of this for you — turning a checklist into an ongoing program instead of a one-time project.
The Real Risk
The question isn't whether your business will face a cyber threat. It's whether you'll be prepared when it happens. For Ontario small businesses, the regulatory and financial stakes make preparation non-negotiable.
Start with the basics, build from there, and don't wait for a breach to take security seriously.