Quick Summary
- There’s no single certificate that makes a small business “cybersecurity compliant.” Compliance is a mix of privacy law, a federal baseline standard, and a growing list of insurance and contract requirements.
- Most small businesses are missing six core things: an information security policy, an incident response plan, a business continuity plan, MFA and access controls, staff training, and tested backups.
- Skipping these carries three kinds of exposure: legal (breach notification duties), financial (insurance and contract risk), and operational (chaos during an actual incident).
- A security assessment shows you where your business stands against the list.
If you run a small business in Calgary or Red Deer and someone has ever asked “are you compliant?” (a client, an insurance broker, an auditor), you’ve probably felt a small jolt of panic. Compliant with what, exactly? There’s no government office that hands out a compliance badge for a 25-person accounting firm or a two-truck oilfield services company. But there is a baseline standard most small businesses in Canada are expected to meet, and it’s a lot more concrete than most owners think.
We sell managed IT services, so you’d be right to wonder whether this list is really a sales pitch with a checklist wrapped around it. Three of the six items below you can build yourself this month without hiring anyone, two more you can start on your own, and the table below shows which is which. The last one is where a provider like us earns its keep.
What “cybersecurity compliance” means for a small business
Why there’s no single law that says “you must be compliant”
Canada doesn’t have one federal cybersecurity law that small businesses register against, the way you’d register for a business license. Instead, three things stack on top of each other:
- Privacy law, meaning PIPEDA federally, plus Alberta’s Personal Information Protection Act (PIPA). Both govern how you collect, use, and protect personal data.
- A federal baseline standard, the Canadian Centre for Cyber Security (CCCS) Baseline Cyber Security Controls, which describes what a business your size should have in place.
- Contract and insurance requirements, which carry legal weight even though no government writes them.
That third category is catching most owners off guard right now. A client contract or a cyber insurance renewal can demand documentation you’ve never been asked for before, with no warning it was coming.
The difference between legal obligation and industry best practice
Privacy law is the part you’re legally bound by. If you collect personal information, whether that’s client files, employee records, or a mailing list, you’re responsible for protecting it and for reporting certain breaches. The Canadian government’s baseline cybersecurity controls for small and medium organizations isn’t law, but it’s the closest thing to an official answer to “what should a business our size have in place.”
The core checklist: what most small businesses are missing
Most small businesses have none of these documented, not even an outdated version.
| # | What you need | Can you do it yourself? | Rough time |
|---|---|---|---|
| 1 | MFA on email and financial systems | Yes | An afternoon |
| 2 | Written information security policy | Yes | 2–3 hours |
| 3 | Employee awareness training habit | Yes | Ongoing, twice yearly |
| 4 | Written incident response plan | Partly | 1 day with help |
| 5 | Business continuity plan | Partly | 1 day with help |
| 6 | Tested backup and recovery | No, usually | Ongoing |
Access controls and password/MFA policy
Multi-factor authentication is the single cheapest, fastest fix on this list, and it’s also the one that gets skipped most often, usually because nobody got around to setting it up. It matters because attackers increasingly go after identities and login credentials rather than breaking through a firewall, and with MFA turned on, a stolen password alone won’t get anyone into your email. It won’t stop every attack. Someone can still trick an employee into approving a login prompt or steal a session that’s already signed in. But it takes away the easiest way in. MFA comes at no extra cost in most Microsoft 365 and Google Workspace plans, and turning it on for email and any financial system takes an afternoon.
An information security policy (and why “we just know what to do” isn’t one)
Every owner we talk to has some version of this in their head: who’s allowed on the accounting software, who gets a company laptop, what happens when someone leaves. But “we just know” lives in your head and maybe your office manager’s, and it disappears the day either of you is unavailable.
A written policy doesn’t need to run twenty pages. A workable one-page version covers five things:
- Who has access to what systems
- What devices are approved for work use
- Password and MFA requirements
- What happens to accounts and equipment when someone leaves
- Who to call if something looks wrong
Write those five sections down, put the document somewhere your team can find it, and you’ll have what most insurance applications and client questionnaires expect to see.
A written incident response plan
Say an employee comes in on a Tuesday morning to find their screen locked with a ransom note. Without a written answer on what to do next, the first hour of a real incident goes to sorting out who should do what, and containment waits.
A first version fits on one or two pages and answers four questions:
- Who does an employee tell first, and how do they reach that person after hours?
- Who has the authority to disconnect or shut down systems?
- Who calls your IT provider, your insurance broker, and, if personal information is involved, the privacy commissioner? Many cyber policies require you to call the insurer’s breach line before hiring anyone else.
- Where does the contact list live if email and your file server are down?
You can answer those yourself. The part that needs technical help is containment for your specific systems: which machines to isolate, which accounts to lock, and what evidence to preserve so your insurer can process a claim. Once it’s done, print a copy and keep it somewhere other than the network it’s meant to protect.
A business continuity plan
The question here is blunter. If your main systems went down tomorrow for three days, could you still invoice clients, run payroll, and answer the phone? For a nonprofit with a small back office, the answer might be “barely, on paper.” For a firm handling client trust funds, “barely” isn’t good enough, and that gap is what this document is meant to close.
For each task the business can’t stop doing, your business continuity plan will record:
- The system it runs on and who’s responsible for it
- How long you can go without it before the damage becomes real
- The manual or backup way to keep it going in the meantime
- Who decides when to switch over
Owners and office managers usually know the first three better than anyone, so that part is yours to write. The recovery side is where you need help: how long restoring each system actually takes, and whether that fits the downtime you said you could handle.
Employee awareness training
The training that stops phishing doesn’t need to be elaborate. Email remains the way most attacks reach a small business in the first place, so a short session twice a year, plus a habit of forwarding real examples of scam emails your team has received, does more than an annual slideshow nobody remembers.
Data backup and recovery testing
Backups fail silently more often than people expect. A backup job can keep reporting success for months while the files it writes are incomplete, corrupted, or missing folders someone added after it was set up. Nobody finds out until the day they need a restore. The only way to know your backup works is to restore from it on purpose, on a schedule, while nothing is wrong.
What happens if you skip the checklist
Regulatory and legal exposure
If a breach involves personal information and creates a real risk of significant harm to someone, you have to report it. For most Alberta businesses, that report goes to the Office of the Information and Privacy Commissioner of Alberta under PIPA, and the Commissioner can then require you to notify the people affected. Federally regulated businesses, and those whose data crosses provincial or national borders, report under PIPEDA to the Privacy Commissioner of Canada instead. Skipping that step is a separate legal problem layered on top of the breach itself, and failing to notify is an offence under both laws, with fines for a business of up to $100,000.
Insurance and contract risk
Cyber insurance applications now ask direct questions: do you have MFA enabled, do you have a written incident response plan, when was your last backup test. Answer “no” or “not sure” enough times and the insurer may decline you outright, or a missing control can surface later in the claims review and reduce the payout. The same is now true of client contracts, and it goes beyond your own systems. A breach at a vendor or supplier can put your business on the hook even when your own systems were never touched. Clients in finance, healthcare, and larger enterprises now ask their suppliers to prove baseline security before signing.
Operational risk if an incident hits and there’s no plan
What shuts businesses down is two or three days of guessing what to do while systems stay offline and clients stop hearing back. A documented plan shortens that stretch.
Who this checklist applies to
Businesses this applies to regardless of industry
If you have employees, a bank account, and an email system, the core six items apply to you. A two-person shop and a fifty-person firm both need an incident response plan, just at very different levels of detail, whether that’s a lean nonprofit back office or a small business with a dedicated IT budget.
Where industry rules add extra requirements
A medical or dental clinic handling health records carries obligations under Alberta’s Health Information Act (HIA) that go beyond PIPA. An accounting firm managing client financial data, or an insurance brokerage handling client policy details, answers to standards most small businesses never think about. Oil and gas, municipal and local government work, and other regulated sectors often carry an extra layer of requirements on top of the baseline. The details differ by industry, so talk them through with someone who knows yours.
How to build this out without hiring a compliance officer
What can be handled internally
A written information security policy, MFA rollout, and a basic staff training habit are all things an office manager or owner can put together without outside help. Templates exist, and the federal baseline document is free to read. None of it requires a certification.
Where a managed IT partner typically fits in
The pieces that get harder without technical help are backup testing that verifies a restore works, plus the technical side of your incident response and continuity plans: containment steps for your specific systems and realistic recovery times. Beyond the checklist, a provider can also add ongoing monitoring that catches problems before an employee notices something’s wrong.
Small business cybersecurity compliance: frequently asked questions
Do small businesses legally have to follow cybersecurity regulations?
There’s no single cybersecurity law that applies to every small business the way employment standards or tax law do. What applies is privacy law (Alberta’s PIPA for most businesses here, or federal PIPEDA if you’re federally regulated or move data across borders) if you handle personal information, plus any sector-specific rules for regulated industries. The federal baseline controls aren’t legally mandatory, though insurers and clients now treat them as the floor.
How is this different from cyber insurance requirements?
Insurance requirements are set by individual insurers and vary by policy, but they overlap heavily with the baseline controls on this checklist: MFA, backups, and a written incident response plan show. Meeting the checklist puts you in a strong position for coverage. Your policy’s own terms still decide what’s covered, so read those too.
How often should a compliance checklist be reviewed?
At minimum once a year, and immediately after any major change: a new line of business, a new client contract with security terms attached, or a change in what data you collect. Businesses in healthcare, finance, and government contracting should look at it twice a year.
What’s the fastest thing to fix first if I have nothing in place?
MFA on email and financial systems. It takes an afternoon, comes at no extra charge in most Microsoft 365 and Google Workspace plans, and means a stolen password is no longer enough to get into your accounts.
Getting started
A security assessment checks where you stand on each item on this list, documentation and technical controls both, and comes back with a list of specific gaps. It’s the first step for every prospective client. You see where you land, then decide what to do about it.
If you want a second set of eyes on where your business stands, book a no-pressure security and compliance assessment. You’ll get a clear picture of the gaps, with no obligation.