Cybersecurity Basics for Canadian SMBs
A realistic starting point for SMB cybersecurity in Canada - the controls that block the majority of real-world attacks, without enterprise budgets.
Canadian SMBs are not too small to be targeted. They are the target. The Canadian Centre for Cyber Security has been consistent about this for years: small and mid-sized businesses are attacked more often than enterprises because they are easier. Most attacks are automated, opportunistic, and stopped by a handful of basic controls.
This is the starting point we recommend to any Canadian SMB that wants to take security seriously without spending like a bank. It is deliberately not exhaustive. It is the things you cannot skip.
Threat reality: what actually happens to SMBs
The threats Canadian SMBs face are not the cinematic ones. They are: business email compromise (BEC) leading to wire fraud, ransomware delivered through a phishing email or an exposed remote desktop port, and credential theft via password spraying against Microsoft 365 tenants without MFA.
Almost every incident we have responded to began with one of those three vectors. Almost every one of them was preventable by controls that were already included in the licenses the business owned.
Identity is the new perimeter
If you do nothing else this quarter, harden identity. For most Canadian SMBs that means Microsoft 365 or Google Workspace. The non-negotiables:
- MFA enforced for every user, including admins and service accounts.
- Legacy authentication blocked entirely.
- Conditional Access policies requiring MFA from unmanaged devices and unknown locations.
- A documented offboarding process that disables identity within hours of an HR notification - not days.
- Admin accounts separated from day-to-day accounts, with phishing-resistant MFA.
Endpoint: deploy managed EDR, not just antivirus
Built-in antivirus catches commodity malware. It does not stop modern attackers who use legitimate tools to live off the land. A managed EDR (Endpoint Detection and Response) product - typically with a 24/7 SOC behind it - is the modern baseline. Huntress, SentinelOne and Microsoft Defender for Endpoint with managed XDR are all reasonable choices for SMBs.
The "managed" part is the point. An EDR that nobody is watching at 2 a.m. on a Sunday is just expensive antivirus.
Patch the things that get attacked
Patch operating systems, browsers, and the handful of applications attackers actually target: Microsoft Office, PDF readers, Java if you somehow still have it, and any internet-exposed device (firewall, VPN concentrator, NAS). Firmware on switches and firewalls counts. The goal is not 100% patched on day zero - it is a documented, reviewed cadence with no nine-month-old critical CVEs sitting open.
Email: stop the impersonation attacks
Configure SPF, DKIM and DMARC on your sending domain. Enable anti-phishing policies with impersonation protection for executive and finance mailboxes. Train your finance team to verbally verify any payment instruction change. Wire fraud against Canadian SMBs has cost more than ransomware in some years; the controls to prevent it are essentially free.
Backups you have actually restored
Backups exist at most SMBs. Tested, restorable backups do not. Adopt the 3-2-1-1-0 rule: three copies, two media, one offsite, one immutable, zero errors after testing. Restore a real file, a real mailbox and a real server from backup at least quarterly. Write it down. If you cannot show a restore log from the last 90 days, you do not have a backup strategy - you have a backup hope.
Train people, not just systems
Phishing simulations, run quarterly and paired with short training (under five minutes), measurably reduce click rates. They also surface the small group of users who need extra coaching - usually a predictable handful. Avoid programs that shame users; aim for awareness, not punishment.
Incident response plan, even a one-pager
- Who declares an incident, and how.
- Who calls the cyber insurance carrier (do this before legal or IT).
- Which systems get isolated first.
- Who communicates with staff, customers and regulators.
- Vendor and backup contacts, printed - because you may not have access to your email.
What about compliance frameworks?
PIPEDA applies to most Canadian businesses handling personal information. SOC 2 is increasingly required by enterprise customers. HIPAA-equivalent expectations apply to healthcare. The controls above cover most of the technical requirements for all three. Compliance is a documentation exercise on top of good security - not a substitute for it.
Bottom line
Cybersecurity for Canadian SMBs is mostly about discipline, not budget. Enforce identity. Run managed EDR. Patch the things attackers target. Test your backups. Train your people. Write down what happens when something breaks. Do those six things consistently and you will be ahead of the vast majority of businesses your size.