CYBERSECURITY GUIDE
Cybersecurity checklist for small businesses in Toronto
A practical starting point for protecting business accounts, devices, information and day-to-day operations.
Small businesses rely on email, cloud services, websites, payment systems and connected devices every day. That convenience also creates risk. A stolen password, missed update or untested backup can interrupt operations and expose sensitive information.
This checklist is designed for small and growing organizations that want a clear, manageable place to begin. It reflects the practical control areas emphasized by the Canadian Centre for Cyber Security, while recognizing that every organization has different systems, obligations and risks.
Start with the systems that matter most
Before buying new tools, list the technology your business depends on. Include business email, Microsoft 365 or Google Workspace, bookkeeping, customer records, websites, payment services, laptops, phones, network equipment and any industry-specific applications.
For each system, identify who owns it, who has administrative access, where its data is stored and what would happen if it became unavailable. This short inventory helps you focus effort on the systems that could cause the greatest operational, financial or privacy impact.
The 12-point cybersecurity checklist
Assign responsibility
Name one person who is accountable for coordinating security, even if technical work is handled by a provider. Document important vendors, account owners and escalation contacts.
Turn on multi-factor authentication
Enable MFA for email, cloud administration, banking, bookkeeping, social media and remote-access accounts. Start with administrators and accounts holding sensitive information.
Use unique passwords and a business password manager
Do not reuse passwords across services. Use a reputable password manager, protect it with MFA and establish a secure recovery method controlled by the business.
Control administrator privileges
Give users only the access needed for their work. Keep separate administrator accounts for privileged tasks and promptly remove access when someone changes roles or leaves.
Patch operating systems and applications
Enable automatic security updates wherever practical. Track devices and applications that require manual updates, including browsers, routers, website software and line-of-business tools.
Secure every business device
Use supported operating systems, screen locks, encryption, anti-malware protection and a firewall. Configure remote-wipe capabilities for managed mobile devices where appropriate.
Protect email and train employees
Teach staff how to recognize suspicious links, unexpected attachments, payment-change requests and fake sign-in pages. Create a simple way to report a questionable message without embarrassment or delay.
Back up critical information
Maintain protected copies of important data and applications. Separate at least one recovery copy from normal user credentials, monitor backup jobs and regularly test that files and systems can actually be restored.
Secure Wi-Fi, networks and remote access
Change default router credentials, use current encryption, separate guest access and disable services you do not use. Require secure remote-access methods rather than exposing devices directly to the internet.
Review cloud and vendor security
Understand which protections are provided by a vendor and which remain your responsibility. Review administrator access, security settings, data location, backup options, incident notifications and contract terms.
Protect the company website and domain
Use MFA at the registrar and hosting provider, restrict administrative access, keep website components current, maintain backups and ensure HTTPS remains active. Domain and email control should never depend on one employee’s personal account.
Prepare a basic incident-response plan
Write down who will make decisions, preserve evidence, contact providers, communicate with clients and restore operations. Include current offline contact information and test the plan with a short tabletop exercise.
A useful rule: verify before acting
When a message requests an urgent payment, password reset, banking change or confidential file, confirm it using a second trusted channel. Do not rely on the contact details provided inside the suspicious message.
A practical first-week plan
If you suspect a security incident
Act quickly but carefully. Disconnect affected devices from networks when safe to do so, preserve relevant messages and logs, and contact your internal lead or trusted technology provider. Avoid deleting evidence or performing unplanned resets before the situation is assessed.
Change credentials from a known-clean device when account compromise is suspected, starting with email and administrative accounts. Notify financial institutions if payments or banking details may be affected. Legal, privacy, insurance and regulatory reporting requirements depend on the incident and should be evaluated with appropriate professional advice.
Canadian guidance and next steps
The Canadian Centre for Cyber Security identifies incident planning, patching, strong authentication, backup and encryption as priority starting controls for small and medium organizations. Its broader guidance also covers security software, employee training, cloud services, mobile devices, websites, access control and perimeter defences.
Review the official Top measures to enhance cyber security for small and medium organizations and Baseline Cyber Security Controls for more detail.
Important: This article provides general information, not a complete security assessment, legal opinion or compliance determination. Appropriate controls depend on your systems, data, contractual duties and regulatory requirements.
NEED A PRACTICAL REVIEW?
Turn this checklist into an action plan.
CommzzTech can help assess priorities, identify gaps and define a right-sized cybersecurity improvement plan.