For a small business, cybersecurity comes down to practical questions: Can we keep serving customers? Can we trust a payment request? Could we recover our records if a laptop or account were compromised?
Having an IT provider gives you someone to help, but the scope of their security responsibilities still needs to be clear. Use these ten actions to agree on what needs attention, who will do the work, and how you will know it is complete.
This is Strategic Outlook Advisory’s practical selection, informed by the Canadian Centre for Cyber Security and NIST guidance below. It is a starting point to tailor to your business, rather than an official ranking or a complete security assessment.
1. Name an owner and identify what matters most
Assign a business leader to make security decisions and an IT contact to implement them. List your essential systems, devices, suppliers, and sensitive information. Include email, payroll, banking, customer records, your website, and any AI tools staff use. Ask what would happen if each became unavailable or its information were exposed. [1]
Check it: Can you show one current list with a named owner and a recovery priority for each essential service?
2. Require stronger sign-ins
Enable multi-factor authentication (MFA), which requires more than a password, on every account that supports it. Start with email, banking, administrator accounts, and remote access. Prefer phishing-resistant options such as FIDO security keys or appropriately configured passkeys. Where those are unavailable, use the strongest supported option; an authenticator app with number matching is a useful improvement over basic approval prompts. Store recovery methods securely. [2]
Check it: Ask for a report showing MFA is enforced, including for administrators, and document any exceptions.
3. Keep software and equipment supported
Turn on automatic security updates where practical. Include laptops, phones, browsers, routers, and website software. Give your IT provider responsibility for updates that need scheduling or testing, and agree how urgent vulnerabilities will be handled. Replace unsupported products or document a temporary protection and replacement plan. [3]
Check it: Review a short list of overdue updates and unsupported equipment, with owners and completion dates.
4. Limit access and stop reusing passwords
Give people individual accounts and only the access their work requires. Use separate accounts for administration, remove access when staff or contractors leave, and review old vendor accounts. Use a business password manager for unique passwords instead of reusing them or keeping a shared password spreadsheet. Protect the password manager with MFA. [4] [5]
Check it: Select one recent departure and confirm that email, business applications, and remote access were all revoked.
5. Prove you can restore your data
Back up essential information and systems, encrypt the backups, and protect them from compromise of your everyday accounts. Keep an offline or suitably isolated, immutable copy that attackers cannot easily alter or delete. Confirm what your cloud services actually back up and how long recovery remains possible. File synchronisation alone is not proof of recoverability. [5]
Check it: Restore a sample of important data into a safe test location. Record whether it was usable, how long recovery took, and how much recent work would have been lost.
6. Practise spotting scams and verifying payments
Give staff short, regular training using situations they encounter: changed supplier bank details, unexpected login links, fake technical support, and urgent executive requests. Verify sensitive requests through an independent channel using contact details already on file. A familiar voice or convincing message is insufficient proof; AI can help impersonate trusted people. Make reporting a suspicious message easy and blame-free. [6]
Check it: Walk the finance team through a fictional bank-detail change. Can they explain the verification and approval steps before money moves?
7. Protect your business email and domain
Ask your provider to configure spam and phishing protection, review forwarding rules, and enable alerts for suspicious mailbox activity. Have them configure SPF, DKIM, and DMARC—the settings that help receiving systems check whether email is authorized to use your domain. Validate legitimate senders before moving DMARC to enforcement. These measures reduce domain spoofing; they do not block every scam or stop misuse of a compromised account. [7]
Check it: Request confirmation that your invoicing, marketing, and ordinary business email still pass authentication checks.
8. Secure devices and separate guest networks
Enable supported anti-malware protection, firewalls, device encryption, and screen locks. Change default router and device passwords. Keep guest Wi-Fi separate from business systems and ask your provider to restrict unnecessary remote access. Agree what security settings personal devices need before they access company information. [3] [4]
Check it: Ask for a device coverage report and confirmation that a guest device cannot reach internal business resources.
9. Put provider responsibilities in writing
For your IT provider and critical services, confirm who manages updates, access, backups, monitoring, and incident response. Ask where information is stored, who can access it, how incidents will be communicated, and how you can retrieve or delete your data when leaving. Review security evidence relevant to the service you actually use. [8]
Check it: Create a one-page responsibility table. Every essential security task should have a named owner, agreed coverage, and an escalation contact.
10. Make sure someone sees alerts and can respond
Agree who reviews security alerts and how urgent issues are escalated, including outside business hours. Write a short incident plan covering account compromise, lost devices, payment fraud, and ransomware. Include decision-makers, technical support, bank and insurance contacts where applicable, and a way to communicate if email is unavailable. Keep an offline copy and rehearse it. [1] [9]
Check it: Run a 30-minute exercise: “Our email is compromised and a supplier payment may have been redirected.” Record the decisions, missing contacts, and follow-up actions.
Your first 30 days
Use this suggested sequence to begin. Bring urgent weaknesses forward and adjust the schedule to your operations. Thirty days is a starting window, not a promise that every gap can be closed.
Choose owners and secure critical accounts
Identify essential services, check MFA, remove obsolete access, and create the incident contact list.
Address updates and test a restore
Review unsupported equipment, close urgent update gaps, and record the result of a backup recovery test.
Review email, payments, and providers
Practise payment verification, confirm email protections, and agree provider responsibilities.
Test the response and set the next priorities
Run the incident exercise and assign an owner and target date to each remaining gap.
For each action, ask: Who owns it? What evidence shows it works? When will we check it again?
Keep a simple monthly view of MFA coverage, overdue updates, backup test results, and open high-priority actions. This gives leadership a practical basis for deciding where time and money should go next.
Sources and further guidance
Primary guidance reviewed October 6, 2026. The selection, evidence checks, and 30-day sequence above are Strategic Outlook Advisory’s suggested application of these resources.
- NIST: Cybersecurity Framework 2.0 Small Business Quick-Start Guide
- Canadian Cyber Centre: Secure your accounts and devices with MFA
- Canadian Cyber Centre: Baseline controls for small and medium organizations
- Canadian Cyber Centre: Top measures to enhance cybersecurity
- Canadian Cyber Centre: Ransomware prevention and recovery
- Canadian Cyber Centre: Email security best practices
- Canadian Cyber Centre: Security considerations for consumers of managed services
- Canadian Cyber Centre: Developing your incident response plan
Turn your gaps into an achievable plan
Strategic Outlook Advisory helps small and medium-sized businesses assess cybersecurity gaps, prioritise improvements, and clarify accountability. We can work alongside your existing IT provider to connect technical findings with business decisions and a practical roadmap.
Discuss your cybersecurity priorities