Small business cybersecurity, in plain language.
A reading list for BC business owners and office managers. Each section answers one question and links to short articles you can act on.
Book a free IT assessment Our cybersecurity serviceWhere should a small business start with cybersecurity?
Start with how people sign in, then payment fraud, then backups.
Multi-factor sign-in on email and on Microsoft 365 or Google Workspace is where we suggest starting, because a stolen password alone then no longer opens the account. Next, give everyone a password manager so that no password is used twice. After sign-in, deal with two problems that can be costly: payment fraud that arrives by email, and data that cannot be recovered. That means a fixed rule for confirming any change to banking details by phone, and backups that have been restored in a test, not only switched on. Remote access, staff devices and the paperwork that privacy law and insurers ask for come after those. The sections below follow that order, and each one links to articles written for people who do not work in IT.
By the numbers
- 15% of small businesses in Canada were affected by a cyber security incident in 2025, compared with 21% of medium and 25% of large businesses. Statistics Canada, 2025
- Scams and fraud were a method of attack for 55% of the businesses affected. Statistics Canada, 2025
- Ransomware was involved for 8% of affected businesses, and 84% of them did not pay a ransom. Statistics Canada, 2025
- The Canadian Anti-Fraud Centre received over 112,000 fraud reports in 2025, involving more than $704 million in reported losses. Canadian Anti-Fraud Centre, 2025
National figures for 2025, quoted from the linked government sources. The fraud figure covers all reported fraud, not only fraud against businesses.
How do we stop accounts being taken over?
Turn on multi-factor sign-in for every account that supports it, starting with email. Use long, unique passwords kept in a password manager, and give staff ordinary accounts for daily work so that a wrong click is less likely to install software.
- Turning on multi-factor authentication: The single most effective step against account takeover, explained for Microsoft 365 and Google Workspace, with an authenticator app rather than text messages.
- Strong passwords without the headache: Why long passphrases beat complicated ones, why reusing a password is the real danger, and how a password manager makes it easy.
- Why most staff should not be administrators on their computers: The single setting that stops most malware in its tracks, how it affects day-to-day work, and how you still get software installed.
- A Microsoft 365 security checklist for BC small businesses: Nine Microsoft 365 settings worth turning on: multi-factor sign-in, audit logging, external forwarding, DKIM, app consent, sharing and more, in plain language.
How do we avoid fake invoices and phishing?
Treat any message that asks you to click, pay or sign in as unverified until you have checked it another way. Confirm new or changed banking details by calling a number you already had, never one from the message itself.
- Spotting a phishing email: five quick checks: A thirty-second routine for any message that asks you to click, pay or sign in, and what to do when one slips through.
- Phone and text message scams: Scammers now call and text as well as email. The common scripts, and the simple rule that defeats almost all of them.
- Sending sensitive documents and information safely: Contracts, ID, payroll files and banking details should not travel as ordinary email attachments. The safer options, in order of preference.
- Fake invoices and changed banking details: stopping payment fraud in a BC small business: How business email compromise and fake invoice scams target BC small businesses, the warning signs, the controls that stop them, and what to do and who to call if money has been sent.
Will our backups work when we need them?
A backup only counts once a restore has been tested. Keep three copies on two kinds of storage with one away from the office, and check what your Microsoft 365 or Google Workspace plan does not cover.
- The 3-2-1 backup rule, explained for small businesses: Three copies, two kinds of storage, one away from the office. Why it works, and what it looks like for a typical small business.
- What is backed up, and what is not: A plain-language guide to which of your files and emails are protected, where the gaps usually are, and how to keep your work on the safe side.
- Server and shared drive backups: what is covered and how to ask for a restore: If you have a server or network drive in the office, how it is protected, what to tell us when a file or folder is missing, and what a full recovery involves.
- If your office is unavailable: keeping the business running: A power cut, a flood, a break-in or a road closure can keep you out of the office for a day or a month. What to think about now so work can carry on from anywhere.
- Backup and recovery for BC small businesses: how to know your backups work: How BC small businesses can set up backups that actually restore: the 3-2-1 rule, Microsoft 365 and Google Workspace gaps, ransomware-safe copies and restore tests.
- Backup and disaster recovery service
How should staff connect from outside the office?
Do not leave Remote Desktop open to the internet. Use one of the safer routes in the article below, keep a few simple habits on public Wi-Fi, and report a lost laptop or phone straight away so it can be locked or wiped.
- Secure remote access for BC small businesses: four safer ways to reach the office: Why an open remote desktop port is risky, how to check if you have one, and safer ways for BC small businesses to let staff reach office computers from home.
- Working safely on public Wi-Fi and while traveling: Hotels, airports and coffee shops are fine for most work if you follow a few simple habits. What to do and what to avoid.
- Lost or stolen laptop or phone: what to do: Report it to us first, then to the police if it was stolen. What we can do remotely to protect your business data.
- USB sticks and external drives: Handy, easy to lose, and a classic way for malware to get in. When they are fine to use, when they are not, and the better alternatives.
- Browser extensions and free software: what to install and what to avoid: Free tools can be useful or dangerous, and it is hard to tell which from the download page. How we check software, and the signs that something is best avoided.
- Still running Windows 10? A practical upgrade plan for BC small businesses: Windows 10 support has ended. What Extended Security Updates cost, the risks of staying put, and a step-by-step Windows 11 upgrade plan for small businesses in BC.
What do privacy law and insurers expect?
Our article below explains which privacy law applies to a BC business, what PIPA and PIPEDA expect, and the security basics that cover most of it. Insurers ask a similar set of questions every year, and the second article explains what those questions mean.
- PIPA vs PIPEDA: BC privacy law for small businesses, in plain language: Which privacy law applies to your BC business, what PIPA and PIPEDA expect, and the IT security basics that cover most of it.
- Preparing for a cyber insurance questionnaire: Insurers ask the same questions every year, and a wrong answer can void a claim. What they ask, what the questions really mean, and how we help you answer accurately.
- Compliance service
What do we do if something goes wrong?
Tell us as soon as you suspect a problem, before trying to fix it yourself. These articles cover the first steps to take while help is on the way.
- Think your account has been hacked? Do this now: The warning signs that someone else is using your email or Microsoft 365 account, and the first steps to take while we lock it down.
- Ransomware: what to do in the first ten minutes: Files that will not open, strange file names or a ransom note on screen. The steps that limit the damage, and the ones to avoid.
- What happens during a security incident: From the first phone call to the written review afterwards: how we handle a suspected breach, what we need from you, and what you may need to tell others.
- Get support: Open a request and a person picks it up.
More articles: help centre and blog.
Book a free IT assessment
We review your setup without changing anything, then send a written report that puts the three most important fixes first.
Book my free assessment +1 (855) 248-2637Last updated