Security Resource Center

All 50 guides All 21 what-to-do pages All 15 privacy law pages

• GuidesManaged ITA baseline set of Conditional Access policies
• GuidesManaged ITA modern password policy (NIST-aligned)
• GuidesCyber ForensicsA payment verification procedure to stop wire fraud
• GuidesPrivacy & AIA vendor security questionnaire for small organizations
• GuidesPrivacy & AIAI acceptable use policy: what to include
• GuidesPrivacy & AIAI meeting notetakers: privacy and confidentiality risks
• Privacy lawPrivacy & AIAlberta PIPA and mandatory breach notification
• GuidesManaged ITBacking up Microsoft 365: what Microsoft does and doesn't do
• Privacy lawPrivacy & AIBC PIPA for private organizations
• GuidesManaged ITBlocking legacy authentication in Microsoft 365
• GuidesManaged ITBring your own device (BYOD) policy guide
• GuidesManaged ITBuilding a device compliance baseline with Intune
• GuidesPrivacy & AIBuilding a records retention schedule
• GuidesManaged ITBuilding a security awareness program that changes behaviour
• Privacy lawPrivacy & AICASL basics for business email and texts
• GuidesManaged ITConfiguring Defender for Office 365 anti-phishing, Safe Links and Safe Attachments
• GuidesCyber ForensicsControlling OAuth app consent in Microsoft 365
• GuidesManaged ITControlling third-party app access in Google Workspace
• GuidesPrivacy & AIData classification policy for small organizations
• GuidesCyber ForensicsDeepfake voice and video fraud against businesses
• Privacy lawPrivacy & AIElectronic monitoring of employees in Ontario
• GuidesManaged ITEmployee offboarding security checklist
• GuidesManaged ITEmployee onboarding security checklist
• GuidesManaged ITEnforcing 2-Step Verification and security keys in Google Workspace
• GuidesCyber ForensicsFinding and blocking malicious mailbox forwarding rules
• GuidesPrivacy & AIFinding the AI tools your staff already use
• Privacy lawPrivacy & AIFIPPA and MFIPPA: what vendors to Ontario public bodies need to know
• GuidesPrivacy & AIGetting started with sensitivity labels
• GuidesManaged ITGmail and Yahoo bulk sender requirements explained
• GuidesLegal TechnologyGoogle Vault retention rules and holds
• ArticlesCyber ForensicsGTA Business Email Security, Q4 2026: Three Months On, DMARC Enforcement Has Not MovedWe re-scanned the public DNS of the same 500 Greater Toronto Area business domains we measured in August 2026.
• GuidesLegal TechnologyHow to instruct a digital forensics expert
• GuidesManaged ITHow to read DMARC aggregate reports
• GuidesCyber ForensicsInvestigating incidents with the Google Workspace investigation tool
• GuidesCyber ForensicsInvestigating suspicious sign-ins in Microsoft Entra
• Privacy lawPrivacy & AILaw Society of BC technology and cloud guidance
• GuidesManaged ITLocking down SharePoint and OneDrive external sharing
• GuidesCyber ForensicsManaging vendor and MSP remote access
• GuidesLegal TechnologyMicrosoft 365 litigation hold and content search for law firms and legal teams
• GuidesManaged ITOffboarding a user in Microsoft 365 the right way
• Privacy lawPrivacy & AIOntario's Bill 194: cyber security in the public sector
• Privacy lawPrivacy & AIOSFI Guideline B-13 basics
• GuidesCyber ForensicsOut-of-band communications and incident call tree
• Privacy lawPrivacy & AIPHIPA for clinics and health information custodians
• GuidesManaged ITPhishing-resistant MFA and passkeys in Microsoft 365
• Privacy lawPrivacy & AIPIPEDA breach reporting and record-keeping
• Privacy lawPrivacy & AIPIPEDA's safeguards principle in practice
• GuidesManaged ITProtecting admin accounts in Microsoft 365
• GuidesManaged ITProtecting company data on personal phones with Intune app protection
• GuidesManaged ITQuarterly user access review checklist
• Privacy lawPrivacy & AIQuebec Law 25: confidentiality incidents and the incident register
• Privacy lawPrivacy & AIReal risk of significant harm: how the assessment works
• GuidesManaged ITRemote and hybrid work security policy
• GuidesManaged ITRolling out DMARC from p=none to p=reject
• GuidesPrivacy & AISecure file sharing with clients
• GuidesManaged ITSecuring QuickBooks Online and cloud accounting apps
• GuidesManaged ITSecurity defaults vs Conditional Access in Microsoft 365
• GuidesPrivacy & AISetting up Microsoft Purview retention policies and labels
• Privacy lawPrivacy & AIStoring and processing data outside Canada
• GuidesCyber ForensicsThe first 72 hours of a cyber incident
• GuidesManaged ITUsing Microsoft Secure Score without chasing points
• GuidesCyber ForensicsUsing the Microsoft 365 audit log in an investigation
• GuidesCyber ForensicsWhat a post-incident attestation letter can and can't say
• What to doCyber ForensicsWhat to do if a former employee still has access
• What to doCyber ForensicsWhat to do if a Microsoft 365 account is hacked
• What to doCyber ForensicsWhat to do if a work laptop is lost or stolen
• What to doCyber ForensicsWhat to do if a work or personal phone with company data is lost
• What to doCyber ForensicsWhat to do if clients receive fake invoices that look like they're from you
• What to doCyber ForensicsWhat to do if personal information was emailed to the wrong person
• What to doCyber ForensicsWhat to do if someone gave remote access to a 'tech support' scammer
• What to doCyber ForensicsWhat to do if you clicked a phishing link
• What to doCyber ForensicsWhat to do if you entered your password on a fake login page
• What to doPrivacy & AIWhat to do if you receive a privacy complaint or a letter from a privacy commissioner
• What to doCyber ForensicsWhat to do if you receive an extortion email
• What to doCyber ForensicsWhat to do if you see a ransom note on a screen
• What to doCyber ForensicsWhat to do if you sent a payment to a fraudster
• What to doCyber ForensicsWhat to do if you suspect an employee took company data
• What to doCyber ForensicsWhat to do if your business social media account is hacked
• What to doCyber ForensicsWhat to do if your company's data appears on a leak site or the dark web
• What to doCyber ForensicsWhat to do if your domain or DNS is hijacked
• What to doCyber ForensicsWhat to do if your website is hacked or defaced
• What to doCyber ForensicsWhat to do when a vendor asks to change their bank details
• What to doCyber ForensicsWhat to do when a vendor tells you they were breached
• What to doCyber ForensicsWhat to do when antivirus or EDR raises an alert
• Privacy lawPrivacy & AIWho to tell after a cyber incident in Canada
• GuidesCyber ForensicsWorking with your cyber insurer after an incident
• GuidesCyber ForensicsWriting an incident response plan that works for a small organization
• ArticlesManaged ITIT Support for Financial Services Firms: A Security and Compliance Checklist for Ontario Advisors, Dealers and BrokersWhat IT support for a financial services firm should cover: who sets the rules (CIRO, OSC, FSRA, OSFI, FINTRAC, PIPEDA), MFA and access, wire-fraud controls, encrypted…
• ArticlesCyber ForensicsIT and Cybersecurity Checklist for Accounting Firms: A Practical Guide for Canadian CPA PracticesThe IT and security controls an accounting or CPA firm needs: MFA, email authentication, encrypted devices, client file exchange, tested backups, tax-season preparation…
• ArticlesCyber ForensicsIT and Cybersecurity Checklist for Manufacturers: A Practical Guide for Ontario PlantsThe IT and security controls a manufacturer needs: separating office IT from the plant floor, containing legacy machine PCs, ERP and EDI uptime, backups of machine…
• ArticlesManaged ITIT and Cybersecurity Checklist for Nonprofits and CharitiesThe IT and security controls a charity or nonprofit needs: a systems inventory, donor data and CRM access, MFA, shared and volunteer accounts, offboarding, Microsoft 365…
• ArticlesManaged ITIT and Cybersecurity Checklist for Restaurants: Keeping the POS, Wi-Fi and Card Data SafeThe IT and security controls a restaurant needs: keeping the POS running during service, internet failover, separating guest Wi-Fi from payment systems, PCI DSS basics…
• ArticlesManaged ITIT and Cybersecurity Checklist for Schools: Accounts, Devices, Wi-Fi and Student DataThe IT and security controls a private or independent school needs: student and staff accounts with MFA, Chromebook and laptop fleets, separate student, staff and guest…
• ArticlesCyber ForensicsWhat to Do in an IT Emergency: A First-Hour Checklist for GTA BusinessesHow to tell an IT emergency from an urgent ticket, first-15-minute checklists for network outages, server failures, email down, ransomware and payment fraud, what to…
• ArticlesManaged ITWhat Are IT Professional Services? A Guide for GTA BusinessesIT professional services are project work with an end date: migrations, network builds, server replacements, office moves.
• ArticlesCyber ForensicsWhat Does an IT Security Assessment Include? A Guide for GTA BusinessesWhat an IT security assessment checks (MFA, email, patching, firewall, backups, access, monitoring), what the report should contain, introductory review vs paid, and how…
• ArticlesManaged ITVaughan Business Email Security Study 2026: Only 17.9% Enforce DMARCDNS measurement of SPF and DMARC records across 354 business domains located in the City of Vaughan, Ontario, drawn from OpenStreetMap features with a website or email…
• ArticlesManaged ITWhat a Managed IT Services Contract Should Include: Ontario GuideWhat a managed IT services contract should include for Ontario businesses: scope and exclusions, SLA priority and response terms, onboarding, data ownership, PIPEDA and…
• ArticlesManaged ITHow to Switch IT Providers Without Losing Access or DataHow to switch IT providers safely: what to check in your contract, the domain, admin, licence and backup ownership to secure first, and the order to cut over.
• ArticlesManaged ITOffice Move IT Checklist for GTA BusinessesAn office move IT checklist for GTA businesses: when to order the internet circuit, network drops, phones, backups, and the order to cut over on move weekend.
• ArticlesLegal TechnologyCybersecurity Checklist for Ontario Law Firms35 cybersecurity controls for Ontario law firms, each tied to LSO, LAWPRO, PIPEDA or cyber insurance requirements, plus a printable checklist.
• ArticlesLegal TechnologyLSO Technology Competence: What Ontario Law Firms NeedWhat LSO rule 3.1-2 technology competence requires of Ontario law firms, with a checklist by firm size, common gaps and how to document compliance.
• ArticlesCyber ForensicsCottage Cyber Security in Muskoka: Wealth Makes a TargetCyber security for Muskoka cottage owners and the executives who work from the lake: Starlink and Wi-Fi hygiene, cameras and smart locks, wire fraud on purchases and…
• ArticlesLegal TechnologyIT for Law Firms in Mississauga: What the LSO ExpectsIT for Mississauga law firms: LSO technology expectations, document management, wire fraud on closings, MFA and secure remote work, with a checklist.
• ArticlesManaged ITIT for Medical and Dental Offices in MississaugaWhat PHIPA expects of a Mississauga medical or dental office's IT: breach reporting, EMR vendors, backups, MFA, phishing and patient Wi-Fi separation.
• ArticlesManaged ITIT Support for Logistics Companies: Mississauga Warehouses and 3PLsIT support for Mississauga logistics and warehousing firms: WMS uptime, warehouse Wi-Fi and scanners, EDI and carrier portals, 24/7 shifts, ransomware.
• ArticlesManaged ITMississauga Small Business IT: Streetsville and Port CreditSmall business IT for Streetsville and Port Credit: POS, Microsoft 365, backups, Wi-Fi and when to move from informal help to managed IT in Mississauga.
• ArticlesManaged ITVirtual CISO (vCISO): What It Is, and Whether Your Business Needs OneWhat a virtual CISO actually does, how a vCISO differs from a vCIO and from a managed IT provider, the honest test for whether a Toronto business needs one, and what to…
• ArticlesManaged ITIT Support for Retail Stores: What Stops the Till, and What It CostsWhat IT support covers for a retail store in Ontario: the network behind the till, where the POS vendor stops, payment segmentation, guest Wi-Fi and staying open when…
• ArticlesManaged ITIT Network Support: What It Covers, and What Breaks Without ItWhat IT network support covers for a GTA business, firewalls, switches, Wi-Fi, cabling and the internet circuit, and the handoff problem that turns a short outage into a…
• ArticlesManaged ITBusiness IT Monitoring: What 24/7 Monitoring Actually Watches, and What It MissesWhat business IT monitoring actually watches, servers, endpoints, backups, network gear and Microsoft 365, and how to tell it apart from a dashboard nobody reads.
• ArticlesManaged ITIT Services Thornhill: Managed IT on Both Sides of Yonge StreetIT services and managed IT services in Thornhill: the Vaughan side, the Markham side of Yonge Street, and what to check before you hire a provider.
• ArticlesManaged ITIT Support and Security Services in Toronto: One Provider or Two?Should IT support and cybersecurity come from one provider or two? What each half covers, the handover points where split arrangements fail, and what to ask.
• ArticlesManaged IT24/7 IT Support in Toronto: What Round-the-Clock Actually Means at 3 a.m.Every Toronto IT provider advertises 24/7 support. What separates a staffed overnight desk from an answering service, and the questions that expose the difference.
• ArticlesManaged ITIT Outsourcing in Burlington: What You Actually Hand Over, and What You KeepIT outsourcing services in Burlington explained: what a provider takes over, what is included, how onboarding works, pricing models and what to keep in your control.
• ArticlesManaged ITIT Support for Construction and Trades Companies in OntarioConstruction and trades IT is site trailers, tablets in trucks and invoice fraud, not office desks. What support should cover for Ontario contractors.
• ArticlesManaged ITIT Support in Durham Region: What Businesses in Pickering, Ajax, Whitby and Oshawa Should ExpectWhat managed IT support looks like across Durham Region: coverage from Pickering to Oshawa, on-site reality, and what to check before you hire a provider.
• ArticlesManaged ITManaged Email Services in Vaughan and the GTA: What Managed Business Email Should IncludeA managed email service is more than a Microsoft 365 licence. What belongs in it, authentication, backup, continuity, monitoring, and how to compare providers.
• ArticlesManaged ITHow to Compare Managed IT Quotes Without Getting BurnedTwo managed IT quotes, twice the price, near-identical summaries. How to compare them line by line, and the questions to get in writing before you sign.
• ArticlesManaged ITIT Support in Halton Region: What Businesses in Milton, Oakville, Burlington and Georgetown Should ExpectWhat managed IT support looks like across Halton Region: coverage from Milton to Burlington, on-site response, and what to check before hiring a provider.
• ArticlesManaged ITWindows Server 2016 End of Support (January 12, 2027): What Ontario Businesses Should Do NowWindows Server 2016 gets its last security update January 12, 2027. Upgrade paths to 2019/2022/2025, Azure, Microsoft 365, ESU facts and a migration checklist.
• ArticlesManaged ITIT Helpdesk Mississauga: What 24/7 Support Should IncludeHow Mississauga businesses should evaluate an IT helpdesk: 24/7 coverage, escalation, on-site dispatch, security ownership, backups, and monthly pricing.
• ArticlesManaged ITDental Office IT Support: What Ontario Practices Need to Get RightDental office IT support in Ontario: chair-side uptime, practice management and imaging ownership, PHIPA safeguards, backups that restore, what to ask a provider.
• ArticlesCyber ForensicsWhat 470 GTA Business Websites Say About Web Security in 2026Original 2026 research: 45.5% of 470 GTA business websites send no security headers at all, and 82.7% of WordPress sites publish their version number.
• ArticlesCyber ForensicsMicrosoft 365 vs Google Workspace in the GTA: What 479 Business Domains Actually RunOriginal 2026 research: 46.8% of 479 GTA business domains run Microsoft 365 and 25.1% Google Workspace, and the two enforce DMARC at very different rates.
• ArticlesManaged ITIT Consulting Services in Toronto: What a Technology Consultant Actually DoesWhat IT consulting services cover, how consulting differs from managed IT and a vCIO, how engagements are scoped and priced, and how to choose a consultant in the GTA.
• ArticlesManaged ITIT Outsourcing Services: What Outsourced IT Support Actually IncludesWhat IT outsourcing services include, the three models providers sell, what outsourced IT support costs, and how to evaluate a provider in Toronto and the GTA.
• ArticlesManaged ITNetwork Security for Toronto and GTA Businesses: The Controls That MatterWhat network security services include, which controls actually matter, and how to tell a managed service from a firewall that was installed once and forgotten.
• ArticlesCyber ForensicsThe State of GTA Small-Business Cybersecurity 2026Original 2026 research: police-reported cybercrime fell across Canada but rose 11.2% in Toronto, and only 20.6% of 481 GTA business domains enforce DMARC.
• ArticlesManaged ITWhat Is a vCIO? Virtual CIO Services, Cost, and When You Need OneWhat a vCIO actually does, how virtual CIO services differ from IT consulting, what they cost, and when a Toronto or GTA business genuinely needs one.
• ArticlesCyber ForensicsChoosing Cybersecurity Services in Toronto: What Your Business Actually NeedsWhat cybersecurity services Toronto businesses need in 2026: 24/7 monitoring and MDR, email security, MFA, backups, and how to choose the right provider.
• ArticlesManaged ITIT Companies in Toronto: Which Type Does Your Business Actually Need?Toronto IT companies range from break-fix shops to full MSPs and security-focused MSSPs. What each type actually does, what it costs, and how to pick the right fit.
• ArticlesCyber Forensics24/7 MDR Services: A Guide to Managed Threat Detection and Monitoring for GTA BusinessesWhat 24/7 MDR services and managed threat detection actually do, how MDR differs from antivirus, and what to look for when choosing a provider: for Toronto & GTA…
• ArticlesCyber ForensicsGTA Email Spoofing Pilot, July 2026: 118 Business DomainsThis was our July 2026 pilot of 118 GTA business domains. The current figure is in our August 2026 report of 481 domains: 20.6% enforce DMARC.
• ArticlesManaged ITBusiness VoIP Phone Systems: A Buyer's Guide for Small BusinessMoving your business phones to VoIP? What VoIP actually is, the features that matter, the questions to ask providers, and the network requirements nobody mentions until…
• ArticlesCyber ForensicsDisaster Recovery and Business Continuity for Ontario Small Businesses: How to Build the PlanA backup is not a plan. Disaster recovery and business continuity for Ontario small businesses, step by step: set recovery objectives, map critical systems, write a…
• ArticlesCyber ForensicsIs Your Company Email Easy to Spoof? SPF, DKIM & DMARC ExplainedMost small businesses have never checked whether criminals can send email as their domain. A plain-English guide to SPF, DKIM, and DMARC, and how to close the gap.
• ArticlesManaged ITWindows 10 End of Support: What GTA Businesses Must Do NowWindows 10 reached end of support on October 14, 2025. What that actually means, the real options, upgrade, replace, or Extended Security Updates, and how to plan the…
• ArticlesCyber ForensicsCyber Insurance Readiness: What Insurers Now Require from Your ITCyber insurers now demand specific security controls before they will write or renew a policy. Here is what they ask for and how to get ready.
• ArticlesManaged ITHow to Buy IT Support in the GTA: 2026 Buyer's GuideThe buying process from first conversation to signed contract, in six steps.
• ArticlesPrivacy & AIPIPEDA Compliance Checklist for Canada: The IT Controls Small Businesses NeedA PIPEDA compliance checklist for Canadian small and mid-sized businesses: the IT safeguards, breach reporting and record-keeping the law expects, with practical notes…
• ArticlesPrivacy & AIQuebec's Law 25: What Ontario & GTA Businesses Serving Quebec Customers Need to KnowIf your Ontario business collects personal information from Quebec residents, Quebec's Law 25 privacy rules can apply to you.
• ArticlesManaged ITBreak-Fix vs Managed IT: Why GTA Businesses Are Making the SwitchBreak-fix means you pay by the hour when something breaks. Managed IT means you pay a provider to keep a defined list of things from breaking.
• ArticlesManaged ITCo-Managed vs Fully Managed IT: Which Model Fits Your Business?Co-managed IT splits the work between your internal IT person and an outside provider. Fully managed hands the whole lot to the provider.
• ArticlesManaged ITMicrosoft 365 Security Best Practices for 2026Eight settings that close the gaps we find most often in small-business Microsoft 365 tenants, each with where to find it and which licence it needs.
• ArticlesManaged ITMSP vs MSSP: Do You Need Managed IT or Managed Security?An MSP keeps your technology working. An MSSP watches it for attackers and responds.
• ArticlesPrivacy & AIRolling Out Microsoft Copilot Safely: A Guide for GTA BusinessesMicrosoft 365 Copilot does not create new access. It finds everything a user can already open, much faster than they ever could.
• ArticlesManaged IT7 Signs Your Business Has Outgrown Break-Fix ITSeven tests you can run on your own records in an afternoon. Each has a threshold and a next step. If you pass most of them, break-fix may still be fine for you.
• ArticlesCyber ForensicsCloud Backup and Disaster Recovery: A Practical Guide for GTA BusinessesWhat Microsoft 365 and other cloud services keep for you, what they do not, and how to set up and prove a backup that covers the gap.
• ArticlesManaged ITHow to Stop Phishing Attacks: Email Security and Employee TrainingThe specific Microsoft 365 settings, sign-in rules and staff habits that stop most phishing at small and mid-sized businesses, and what to do when someone clicks anyway.
• ArticlesManaged ITMulti-Factor Authentication: Why Every GTA Business Needs ItWhich MFA method to use, how to switch it on in Microsoft 365 and Google Workspace, and the awkward cases (shared mailboxes, emergency admin accounts, staff without…
• ArticlesManaged ITAfter-Hours IT Problems: When to Call a 24/7 Incident LineWhat an after-hours call to our 24/7 incident line is for, what to have ready, what happens on the call, and which problems can wait until morning.
• ArticlesManaged ITManaged IT Services and IT Support for Small Businesses in the GTA: What to ExpectWhat good IT support should actually deliver to an office of 5 to 25 people: the first-week onboarding list, the Microsoft 365 settings that get changed, what monitoring…
• ArticlesManaged ITManaged IT Services Pricing in Canada (2026): Toronto & GTA Cost GuideWe do not publish price lists, and we are wary of anyone's 'average cost per user' because it hides what is in the scope.
• ArticlesManaged ITManaged IT Services vs In-House IT: Which Is Right for Your GTA Business?Hiring your own IT person and paying a provider are both reasonable.
• ArticlesManaged ITCybersecurity for Small Businesses in the GTA: A Practical ChecklistA checklist built on the Canadian Centre for Cyber Security's baseline controls, with a how-to-verify step for each item.
• ArticlesManaged ITMicrosoft 365 Migration for Toronto Businesses: A Step-by-Step GuideA working runbook for moving a small or mid-sized business to Microsoft 365: picking the migration method for your current system, the DNS changes and their timing, what…
• ArticlesCyber ForensicsRansomware Protection for Ontario Businesses: 2026 Defence GuideTwo halves: the controls that make ransomware survivable, with a concrete backup isolation spec, and the first hour if it happens, including who in Canada and Ontario…
• ArticlesManaged ITWhat to Look for in a Managed IT Services Provider in TorontoA scoring sheet for the meeting itself. Ten questions to ask any managed IT provider, what a good answer contains, and the answers that should worry you.