Cybersecurity for Small Businesses in the GTA: A Practical Checklist

We drew a random sample of 500 GTA business domains from our regional records on 1 August 2026 and scanned the same sample three times. Figures below are labelled by scan; they come from one sample and do not mix with our smaller July 2026 study.

The checklist follows the Baseline cyber security controls for small and medium organizations from the Canadian Centre for Cyber Security. It is free, written for Canadian organizations, and its 13 controls range from an incident response plan to securing portable media. We have grouped them into the checks a small office can actually run.

1. 01

   [ ] MFA on every account, including the owner's

   Verify: Microsoft Entra or Google Admin console shows every active user enrolled. See the MFA guide.

2. 02

   [ ] Fewer than five full admins, all named, none shared

   Verify: list Global Admins (Microsoft) or Super Admins (Google).

3. 03

   [ ] DMARC at quarantine or reject, DKIM on

   Verify: our email spoof check shows enforcement.

4. 04

   [ ] Leavers removed the day they leave

   Verify: compare HR list to active accounts, including accounting and banking apps.

1. 01

   [ ] Automatic patching for operating systems and apps

   Verify: spot-check three machines; last update within 30 days, no pending restart.

2. 02

   [ ] Security software (EDR or at least managed antivirus) on every device

   Verify: console shows every device reporting in the last 7 days.

3. 03

   [ ] Disk encryption on laptops

   Verify: BitLocker or FileVault status in the management console.

4. 04

   [ ] Nobody works day-to-day as a local administrator

   Verify: check local admin group on three machines.

5. 05

   [ ] No unsupported systems

   Verify: list any Windows 10 machines; see Windows 10 end of support.

1. 01

   [ ] Backups of servers and cloud data, one copy isolated

   Verify: backup list matches asset list; see the isolation spec.

2. 02

   [ ] Restore tested in the last 90 days

   Verify: restore-test log with date and time taken.

3. 03

   [ ] Files shared externally by expiring links, not attachments or 'anyone' links

   Verify: SharePoint/OneDrive sharing report.

1. 01

   [ ] Firewall firmware current, no remote desktop open to the internet

   Verify: firmware version against vendor's latest; external port check.

2. 02

   [ ] Guest Wi-Fi separated from business devices

   Verify: a guest device cannot see office printers or file shares.

3. 03

   [ ] Website forces HTTPS, sends security headers, CMS updated

   Verify: load http:// version of your site; check headers with a free header scanner; WordPress admin shows no pending core or plugin updates.

1. 01

   [ ] A payment-change verification rule

   Verify: written rule that bank detail changes are confirmed by phone to a known number. See payment verification procedure.

2. 02

   [ ] Short awareness training each year, plus phishing reporting

   Verify: attendance record; staff know how to report.

3. 03

   [ ] One-page incident plan and contact sheet

   Verify: printed copy exists with insurer, IT and counsel numbers. Use our incident contact sheet tool.

Fix in this order: MFA and admin accounts, backups with an isolated copy, DMARC enforcement, patching. Those four close most of the routes we see used against small offices. Then work through the rest over a quarter.

Keep the completed checklist with the date. Run it again in six months; the second pass usually takes a third of the time, and the dated record is exactly what an insurer or a client security questionnaire asks you to show. Our cyber insurance readiness checklist maps these items to typical underwriting questions.

The IT health check gives you a scored view, and our security assessment goes deeper if you want an outside review.