Cybersecurity for Winnipeg businesses
The Canadian Centre for Cyber Security's baseline controls in plain language, and what to ask a provider about each.
What does cybersecurity mean for a small business?
For a small business, cybersecurity is a short list of routine controls done consistently: patching, security software, two-factor sign-in, tested backups, a firewall, staff training and a written plan for when something goes wrong. The Canadian Centre for Cyber Security (the Cyber Centre) built its baseline controls around this idea, applying an 80/20 rule: 80% of the benefit from 20% of the effort.[1]
Statistics Canada reports that 15% of small businesses were impacted by a cyber security incident in 2025, 14% in 2023, 16% in 2021 and 18% in 2019.[2] Those figures count only incidents businesses judged impactful, so they may not reflect every attack.[3] In 2023, scams and fraud were the most common method (50% of impacted businesses), followed by identity theft (31%) and ransomware (13%).[3]
The Cyber Centre’s baseline controls, and what to ask a provider
The Cyber Centre says its controls are for organizations with fewer than 500 employees whose potential injury from an incident is at or below “medium”, and that organizations should adopt the mindset that a breach will happen at some point and be ready to detect, respond and recover.[1]
| Control area (reference) | In plain language | Ask a provider |
|---|---|---|
| Incident response plan (BC.1) | A written plan: who responds, who to call, what you must report and to whom | “Who responds at 2 a.m., and is the plan written down?” |
| Automatic patching (BC.2) | Updates on for all software and hardware, and old unsupported products replaced | “How do you report patch status, and what happens to devices that no longer get updates?” |
| Security software (BC.3) | Anti-malware that updates and scans automatically, plus software firewalls | “What endpoint protection do you deploy, and who watches its alerts?” |
| Secure configuration (BC.4) | Default admin passwords changed, unneeded features off | “Do you change defaults on printers, routers and cameras?” |
| Two-factor sign-in (BC.5) | Required for financial accounts, administrators, cloud admin and executives | “Is two-factor enforced on every account, including administrators?” |
| Staff awareness training (BC.6) | Spotting malicious email and links, safe use of the internet and approved software | “Is training included, and how often?” |
| Backups (BC.7) | Essential data backed up, encrypted, stored offsite, with restores regularly tested | “When did you last test a restore, and can I see the result?” |
| Mobile devices (BC.8) | Work and personal data separated, apps from trusted sources, devices encrypted | “How are phones and tablets handled?” |
| Perimeter defences (BC.9) | Dedicated firewalls, DNS filtering, VPN with two-factor for remote access, secure Wi-Fi, DMARC and email filtering | “Who manages the firewall and the email filtering?” |
| Cloud and outsourced IT (BC.10) | Judge how providers handle your data and where it is stored; two-factor on cloud admin accounts | “Where are your administrators and data centres located?” |
| Access control (BC.12) | Least privilege, separate admin accounts, accounts removed when staff leave | “How quickly are leavers’ accounts disabled?” |
Source for every row: Canadian Centre for Cyber Security baseline controls.[1] The Cyber Centre notes that readers should not treat its guidance as comprehensive, and that system owners remain responsible for the security of their systems.[1]
Who is responsible for security inside your business?
The Cyber Centre recommends naming someone in a leadership role who is specifically responsible for IT security, and comparing IT security spending with industry guidance of 4 to 7% of the IT budget (citing Gartner), counting outsourcing in that total.[1] An outside provider can run the controls day to day; the business still owns the risk.
What managed security can include
Managed security is scoped around your business. Depending on your needs, it can range from the basics to more advanced work:
- Core controls: patching, endpoint protection, two-factor sign-in, email filtering and backup monitoring.
- Ongoing monitoring: someone watching alerts and responding to them, rather than tools that only record events.
- Specialist work: security reviews, testing, compliance documentation and incident response planning.
Which of these you need depends on the data you hold, your obligations and your risk. See the cost guide for how a tailored quote is built.
Breach duties under PIPEDA
The Office of the Privacy Commissioner of Canada says organizations subject to PIPEDA must report breaches that pose a real risk of significant harm, notify affected individuals as soon as feasible, and keep records of all breaches for two years, whether or not they were reported. It states that this applies to small businesses.[4]
If a provider handles personal information for you, the Privacy Commissioner says your organization generally stays responsible for breach reporting and should have contractual arrangements with the processor that address the breach provisions.[4] Ask any provider how it would notify you of a breach and how quickly.
Cyber insurance
Statistics Canada reports that 22% of Canadian businesses had cyber risk insurance in 2023, up from 16% in 2021.[3] The Cyber Centre suggests considering a policy that covers incident response and recovery as well as liability.[1] Insurance is separate from IT support, and policy terms are between you and the insurer.
This page is general information, not security or legal advice.
Frequently asked questions
What cybersecurity controls does the Government of Canada recommend for small businesses?
The Canadian Centre for Cyber Security publishes 13 baseline control areas for organizations with fewer than 500 employees, including an incident response plan, automatic patching, security software, secure device configuration, two-factor authentication, staff training, encrypted and tested backups, perimeter defences, secure cloud and outsourced services, and access control.
Do small businesses have to report data breaches in Canada?
Organizations subject to PIPEDA must report breaches of security safeguards that pose a real risk of significant harm to the Privacy Commissioner of Canada, notify affected individuals, and keep a record of every breach for two years. The Office of the Privacy Commissioner says this applies to small businesses.
How many Canadian small businesses are hit by cyber incidents?
Statistics Canada reports that 15% of small businesses were impacted by a cyber security incident in 2025, up from 14% in 2023. Its 2023 release defined small as 10 to 49 employees and counted only incidents businesses considered impactful.
Related services
- Managed IT for small business — Ongoing IT support for small offices: help desk, monitoring, patching, security and Microsoft 365 care, scoped around your business.
- Network support — Firewalls, Wi-Fi, remote access and monitoring: what a business network needs and what support typically covers.
- Microsoft 365 and cloud — Administration, migrations and where your Microsoft 365 data is stored, with the Canadian data residency details.