Small-business cybersecurity becomes easier to manage when each concern turns into a specific task. “Improve security” is difficult to assign. “Confirm who can recover the company email account” is something a person can investigate and report back on. Start with a short, owned work list and expand it as you understand the environment.
This checklist is intended for business planning in Quebec and across Canada. It does not certify an organization or replace an assessment of its applications, obligations and operating risks.
1. Identify what you need to protect
Write down your essential business activities and the technology behind them. Include email, finance, shared files, customer records, remote access and the business website. Assign a business owner to each activity. That owner should explain the impact of losing access and decide which workarounds are acceptable.
Next, record where the information lives and who administers access. A spreadsheet does not need to contain secrets to be useful: system name, owner, provider and recovery contact are a reasonable starting structure. Store administrative credentials in an appropriate secure system, outside this general inventory.
For example, a fictional office may discover that only one employee knows how to renew its domain. Recording an authorized backup owner and renewal process creates a concrete improvement before any new security product is purchased.
2. Make account protection an assigned responsibility
The Canadian Centre for Cyber Security’s foundational actions identify multifactor authentication as a basic protection. Review where MFA is available and whether business accounts actually use it. Record exceptions, the reason for each exception and who is responsible for resolving it.
Prioritize accounts that control other systems: email administration, domains, backups and remote management. Decide who approves account creation and who authorizes access to financial or sensitive business information. Avoid sharing a single employee identity to make administration more convenient.
- List administrators and confirm that their access is still needed.
- Document a secure recovery process when a phone or authentication method is lost.
- Confirm how employee departures trigger access removal.
- Choose an owner for the next access review.
3. Track updates and device exceptions
An update process needs more than an instruction to install patches. Identify who monitors completion, who schedules restarts and what happens when an application prevents an update. Keep a list of unsupported devices and unresolved exceptions, with a business decision for each one.
For a small office, the first useful deliverable might be a device list showing operating system, assigned employee and last verified update status. Add the person responsible for following up when a laptop has not connected for several weeks. Treat company-owned and personally owned devices according to an agreed policy.
Ask your provider what endpoint protection does, who receives its alerts and when those alerts are reviewed. A product subscription and an agreed response service are separate items to verify in the contract.
4. Give employees a clear reporting path
Create a short instruction that employees can find before an incident. It should explain where to report an unexpected sign-in prompt, suspicious invoice or potentially lost device. Give an alternative contact method in case company email is inaccessible. Tell people which details to report without asking them to forward passwords or sensitive customer documents.
Practice with a fictional invoice-change request. Ask the accounts team how it would independently verify new payment instructions using a contact method already on file. The purpose is to identify process gaps, not to embarrass an employee for clicking the wrong thing.
Include new staff, temporary workers and managers in the same reporting process. Record who receives reports while the usual contact is away. A process that depends entirely on one person’s availability deserves a backup owner.
5. Connect security to recovery and business decisions
Ask the owner of each critical system what evidence shows that its information can be restored. Record the most recent test, the result and any missing items. Review the separate backup and disaster recovery guide when defining those tests.
Prepare an incident contact sheet with management, IT support and essential application vendors. Define who may approve disruption, recovery work and external specialist assistance. Keep an accessible copy that does not require the affected system to work.
The Cyber Centre’s baseline controls provide a broader framework covering matters such as account protection, updates, awareness and backups. Use them to check the completeness of your planning rather than treating this article as a complete security standard.
6. Turn the checklist into a realistic first month
The following is an illustrative sequence for an organization beginning a review. Adjust it for the environment and address urgent findings through your authorized support process. Do not postpone a known serious problem simply because it belongs to a later week on a worksheet.
- Week one: list critical systems, administrative owners and recovery contacts. Record unknowns.
- Week two: verify account protection and review recent employee changes. Assign unresolved exceptions.
- Week three: review the computer inventory, update process and employee reporting instructions.
- Week four: perform an agreed recovery exercise, review remaining gaps and approve the next work list.
Use a simple status for each action: not started, in progress, verified or blocked. Keep “verified” tied to evidence, such as a completed access review or documented test. At the end of the month, management should be able to explain what changed, what remains open and who owns the next step.
Common cybersecurity planning questions
Is antivirus enough for a small business?
Antivirus addresses one part of the environment. Your plan also needs named responsibilities for accounts, updates, reporting, access changes and recovery. Ask which of those responsibilities your current services actually cover.
Does this checklist establish compliance?
No. Specific contractual, industry and legal requirements need their own review. This guide helps organize operational questions and does not establish a certification or a legal conclusion.
Where should we begin if nobody owns IT?
Assign a business decision-maker first, then prepare the system list and unresolved questions. DITC’s IT and cybersecurity services can be discussed around that inventory, with responsibilities confirmed in writing.
Take the next step
DITC works with businesses in Quebec and across Canada in French and English. Tell us about your environment and priorities so we can agree on a clear scope.
Explore our services