What Does a Canadian Small Business Actually Need for Cyber Security in 2026?

By Cody Wise, founder of Wise Media, Calgary. Last updated 6 November 2026. General information, not legal or security advice. A live incident needs a professional, not an article.

Summary

• Statistics Canada reports 15% of small Canadian businesses were impacted by a cyber security incident in 2025, against 21% of medium and 25% of large.
• Scams and fraud were the method in 55% of impacted businesses, not sophisticated intrusion. The threat is mostly social.
• The Cyber Centre’s baseline names 13 control areas. Five of them cover most of the real risk for a small business.
• Its guidance tells small businesses to enable two-factor authentication wherever possible and, notably, to stop forcing routine password changes.
• CyberSecure Canada still exists but ISED stopped being the program authority on 31 March 2023. Anyone describing it as a current federal program is working from old information.

Table Of Contents

• What The Canadian Data Actually Says
• The Cyber Centre Baseline, And Its Age
• The Five Controls That Carry The Weight
• Multi-Factor Authentication, Done Properly
• The Password Advice That Reversed
• What The Law Requires After An Incident
• Certification: What Is Real And What Changed
• What A Sensible Baseline Costs
• Common Mistakes
• FAQ

What The Canadian Data Actually Says

Most cyber security statistics circulating online are vendor surveys with undisclosed samples, usually American, often designed to sell something. There is a better source. Statistics Canada runs the Canadian Survey of Cyber Security and Cybercrime, and its release on the impact of cybercrime on Canadian businesses for 2025, published 21 October 2026, is the authoritative picture.

What it reports:

• “about one in six (16%) Canadian businesses were impacted by cyber security incidents”, unchanged from 2023 and five percentage points lower than 2019.
• By size: large businesses 25%, medium 21%, small 15%. Statistics Canada defines small as 10 to 49 employees.
• “Scams and fraud were identified as a method of attack for over half (55%) of the businesses impacted”, up from 50% in 2023 and 44% in 2021.
• Identity theft accounted for 28% and exploitation of software, hardware or network vulnerabilities 23%.
• Ransomware was involved for 8% of impacted businesses, down from 13% in 2023, and “over four in five (84%) of them did not make a ransom payment.”
• 86% of businesses used some cyber security prevention measure. The most common were email security (73%), anti-malware (69%) and network security (67%).
• 34% of businesses held cyber risk insurance, up from 22% in 2023 and 16% in 2021.
• Only 11% of impacted businesses reported the incident to police.

Two things worth taking from that. First, the headline risk is lower than the marketing suggests and it is not zero. Second, and more useful: the dominant attack method is scams and fraud, which means the threat facing a 12 person Canadian business is overwhelmingly someone being tricked, not someone breaking a firewall. That changes where the money should go. It is also why our cyber security work starts with people and process rather than with tooling.

One caution on numbers you may see quoted elsewhere. Statistics Canada reports an average spend of $54,772 CAD on prevention measures in 2025, but that is across all business sizes and is not what a small business spends. There is no official Canadian cost-of-incident figure broken out for small business, so treat any specific dollar claim about what a breach costs a small Canadian firm as unsourced unless it names its methodology.

The 50 Word Version

Turn on multi-factor authentication everywhere, enable automatic updates, keep one offline backup and test restoring it, train staff on fraud because that is 55% of real attacks, and write a one page incident plan naming who does what. That covers most of the risk for most Canadian small businesses.

The Cyber Centre Baseline, And Its Age

The Canadian Centre for Cyber Security publishes Baseline cyber security controls for small and medium organizations, which defines small and medium as “those with fewer than 500 employees” and frames itself around the 80/20 rule: “achieve 80% of the benefit from 20% of the effort.”

The 13 control areas are: incident response planning, automatic patching, security software, secure device configuration, strong user authentication, employee awareness training, backup and encryption, secure mobility, basic perimeter defences, securing cloud and outsourced IT, securing websites, access control and authorisation, and secure portable media.

Know the date before anyone presents this to you as current. It is version 1.2 and the page’s date modified is 18 February 2020. It is the Cyber Centre’s flagship small business document and it has not been revised in over six years. The maintained short-form version is ITSAP.10.035, published February 2024, which covers the same thirteen controls in current language. Use that one as your working reference and the baseline document for the detail.

The Five Controls That Carry The Weight

Thirteen controls is more than a small business will implement in one go. Given that 55% of Canadian incidents come through scams and fraud, these five address most of the actual exposure.

Notice what is not on that list: expensive security software. 86% of Canadian businesses already run prevention tooling, and incidents continue, because tooling does not stop a convincing invoice redirection email. The highest return control for a small Canadian business is a team that pauses before acting on an urgent payment request.

The Fraud Training That Actually Works

Not an annual slide deck. Three specific rules, repeated:

• Any change to banking details is verified by phone, on a number you already had, never a number in the message. This single rule prevents the most costly category of small business fraud.
• Urgency is the signal. Legitimate requests survive a fifteen minute delay. Teach people that pressure is itself the red flag, including when the message appears to be from the owner.
• Nobody is in trouble for checking. If your culture punishes the person who double-checks a request from the boss, you have built the vulnerability yourself.

Multi-Factor Authentication, Done Properly

The Cyber Centre’s baseline is direct: “Organizations should implement two-factor authentication wherever possible”, and adds the pragmatic note that “Not all two-factor solutions are equal, but all improve an organization’s overall cyber security posture.” In other words, do not let the search for the best option delay turning on the available one.

Its dedicated guidance, ITSAP.30.030, updated February 2024, is worth ten minutes. The distinctions that matter:

• Factors come from three categories: something you know, something you have, something you are. True two-factor uses two different categories. Two passwords is two-step verification, not two-factor.
• Phishing-resistant, FIDO-based MFA is the strongest option the guidance names. Hardware keys are cheap now and worth it for administrator accounts specifically.
• Number matching defends against MFA fatigue, where an attacker spams approval prompts until someone taps accept. Turn it on if your provider offers it.
• Limit MFA request volume for the same reason.

Where to apply it first, in order: email, because it is the reset path for everything else; banking and payroll; your domain registrar and DNS, because control of those is control of your business online; cloud storage; and your CRM. An attacker who reaches your registrar can redirect your mail and your website, and plenty of small businesses have MFA on their bank and nothing on their domain.

The Password Advice That Reversed

This one surprises people, and it comes straight from the Cyber Centre’s baseline: “Organizations should only enforce password changes on suspicion or evidence of compromise.”

Forced 90 day rotation is obsolete guidance. It pushes people toward predictable patterns, a base word with an incrementing number, which is easier to guess than a strong password kept for two years. If your IT policy still mandates quarterly changes, your own national cyber agency disagrees with it.

What to do instead:

• Length over complexity. The Cyber Centre’s MFA guidance suggests at least 12 characters, or a passphrase of at least four words and 15 characters where possible.
• A password manager, so every account can have a unique credential nobody has to remember.
• Rotate on evidence of compromise, on staff departure, and on a shared credential changing hands. Not on a calendar.
• Clear policies on length and reuse, which the baseline also calls for.

What The Law Requires After An Incident

Recovering is not the only obligation. If personal information was involved, PIPEDA imposes duties with teeth.

• Report to the Privacy Commissioner, under s. 10.1(1), for any breach of security safeguards involving personal information under your control where “it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual”, made “as soon as feasible”.
• Notify affected individuals under s. 10.1(3), with notification that is “conspicuous” and “given directly to the individual”.
• Keep a record of every breach, under s. 10.3(1), reportable or not. The Breach of Security Safeguards Regulations set retention at 24 months from the day you determine the breach occurred.
• Significant harm is defined broadly in s. 10.1(7) to include “bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.”
• Penalties under s. 28 for knowingly contravening the reporting or record-keeping requirements: up to $10,000 CAD on summary conviction, up to $100,000 CAD on indictment.

A nuance most summaries get wrong: the Privacy Commissioner does not levy those fines. The OPC can refer possible offences to the Attorney General of Canada. That is a different mechanism from a regulator issuing a penalty directly.

Two currency points, because this area is in flux. PIPEDA is the law in force today; a replacement bill was introduced in June 2026 and sits at second reading, so nothing in it applies yet. And Alberta, British Columbia and Quebec have their own private sector privacy statutes deemed substantially similar to PIPEDA, so which law governs you depends on where you operate. Our guide to website data breach reporting in Canada covers the mechanics in detail.

Certification: What Is Real And What Changed

Two programs get confused, and one of them changed hands in a way most articles have not caught up with.

CyberSecure Canada. The ISED program page states: “As of March 31, 2023, Innovation, Science and Economic Development Canada (ISED) is no longer the program authority”, and directs readers to the Standards Council of Canada. The underlying standard is CAN/DGSI 104, maintained by the Digital Governance Standards Institute, with a Revision 1 issued in 2024. No fee is published by any government or standards body source, so be sceptical of anyone quoting you a certification cost as official. If a customer or insurer asks for it, treat it as a real requirement to investigate directly with SCC, not as a box most small businesses need to tick.

The Canadian Program for Cyber Security Certification. This is defence procurement and almost certainly does not apply to you. Level 1 is an annual self-assessment against 13 controls, available to suppliers from 1 April 2026 and appearing in select defence contracts from summer 2026. If you heard that Canada now has mandatory cyber certification, this is what was being described, and it applies to defence suppliers rather than to businesses generally.

What A Sensible Baseline Costs

All CAD, published vendor pricing, for a business of roughly 5 to 50 people. Verify current rates.

A 15 person business can reach a defensible baseline for well under $3,000 CAD a year and about 20 hours of setup. The barrier is not budget. It is that nobody owns it.

Two adjacent pieces worth reading if your exposure is mostly through your website: the WordPress hacked site cleanup and hardening guide, and what a maintenance plan should actually include.

Common Mistakes

• Buying tooling before turning on MFA. The free control outperforms the paid product.
• MFA on the bank but not the domain registrar. Control of DNS is control of your email and your website.
• Forced quarterly password changes. The Cyber Centre explicitly advises against routine rotation.
• Backups nobody has restored. An untested backup is a hope.
• Treating awareness training as an annual slide deck. Three repeated rules beat one forgotten course.
• A culture where checking is discouraged. If staff fear questioning an urgent request from the owner, fraud works.
• Assuming small means invisible. 15% of small Canadian businesses were impacted in 2025.
• Ignoring the record-keeping duty. Every breach must be recorded for 24 months, not just the reportable ones.

FAQ

What Does A Small Business Actually Need For Cyber Security?

Multi-factor authentication on every account, automatic patching, one offline backup that has been restored at least once, quarterly fraud awareness for staff, and a one page incident plan. That is the baseline. Everything else is refinement.

How Common Are Cyber Attacks On Canadian Small Businesses?

Statistics Canada reported that 15% of small businesses were impacted by a cyber security incident in 2025, compared with 21% of medium and 25% of large businesses. Scams and fraud were the method in 55% of impacted businesses.

Is CyberSecure Canada Still Running?

The program exists but ISED stopped being the program authority on 31 March 2023 and pointed to the Standards Council of Canada. The underlying standard is CAN/DGSI 104. No certification fee is published by any official source, so verify directly with SCC rather than relying on figures from third-party articles.

Should I Force Staff To Change Passwords Regularly?

No. The Canadian Centre for Cyber Security advises enforcing password changes “only on suspicion or evidence of compromise”. Routine rotation produces predictable passwords. Use length, uniqueness, a password manager and MFA instead.

Do I Have To Report A Breach In Canada?

Under PIPEDA you must report to the Privacy Commissioner where a breach involving personal information under your control creates a real risk of significant harm, and notify affected individuals. Separately you must record every breach, reportable or not, for 24 months. Alberta, BC and Quebec have their own statutes. Get legal advice on a real incident.

Do I Need Cyber Insurance?

34% of Canadian businesses carried it in 2025, up sharply from 16% in 2021. Whether it suits you depends on what data you hold and what downtime costs. Read the conditions carefully, since insurers increasingly require specific controls such as MFA to be in place for a claim to be payable.

Where Should I Start If I Have Done Nothing?

One afternoon: turn on MFA for email, banking and your domain registrar, enable automatic updates everywhere, and confirm a backup exists somewhere your main login cannot reach. That is the bulk of the risk reduction available, and it costs nothing.

Conclusion

The honest version of small business cyber security in Canada is less dramatic than the marketing. Most attacks are social, most of the effective controls are free, and the national guidance is published openly by the Cyber Centre. Turn on MFA, patch automatically, keep an offline backup you have actually restored, teach three fraud rules, and write the plan down. Then give it to somebody by name, because the control that fails is always the one nobody owns.

If your main exposure is the website and the systems around it, tell us what you are running through our intake form and we will tell you which of these you already have and which you only think you have.