Ransomware can shut operations down. Stolen credentials and business email compromise can redirect payments. A supplier’s cyber incident can expose customer information. Cyber insurance may cover certain response costs, but it doesn’t defend your business or restore operations. To help, we reviewed Canada’s National Cyber Threat Assessment 2025–2026, the Cyber Centre’s baseline controls for small and medium organizations, Public Safety Canada’s Bill C-8 Royal Assent notice, and the federal Privacy Commissioner’s breach-reporting guidance. In the guide that follows, you’ll learn what to fix in the next 30 days, how to respond when something goes wrong, how to stay within Canada’s privacy rules, and what to ask before relying on a cyber insurance policy.
What should Canadian businesses do about growing cyber threats?
Protect the accounts, devices, data, third-party vendors and other assets that support your organization’s money flows and/or that can’t afford to be offline for a day. Assign an owner to bring them back up. Use strong multi-factor authentication for critical and privileged accounts. Limit admin rights. Apply security updates for supported systems. Protect encrypted, offline, regularly tested data backups. Monitor systems that support critical activities. Review vendor relationships. Practice your response plan. Ask questions about cyber insurance: what’s covered and not covered if something goes wrong? A short, practical, business-oriented list goes further than a long, technical, security-oriented list with no one to manage it.
Why Cyber Threats Are Escalating in Canada
Canada’s National Cyber Threat Assessment cites financially motivated cybercrime and state actors as the main threats that continue to escalate. Increased digitization expands the attack surface for bad actors. New tools make it easier than ever for cybercriminals to create convincing malicious content and impersonate victims. Attackers do not need to defeat every defence. One bad apple is all it takes: one compromised account, one unsecured remote access service, or one hacked third-party vendor, for an attacker to get through.
What Are Everyday Risks for Businesses?
| Threat | Business effect | Control to test first |
|---|---|---|
| Phishing and credential theft | The takeover of businesses’ email, cloud, and financial accounts. | Multi-factor authentication (MFA) Password managers Login alerts Email filtering An account-recovery process that is documented and tested. |
| Business email compromise | Changes to payment or banking information are sent to the fraudster. | Call back to verify any changes to payment information Require secondary approval for business transactions Limit mailbox rules that forward or filter emails |
| Ransomware | What is the impact on business? Possible theft of business data, encryption of company systems leading to the cessation of business activity. | Use vendor-supported hardware and software, deploy endpoint security, segment networks, and have encrypted, offline backups, and test that they can be restored. |
| Vendor or cloud compromise | Service outages impacting everyday business operations Third party could expose your data or access | Vendor inventory Least-privilege access Contacts for contracts and incident response Logging Backup and contingency plans that actually work. |
| Lost device or insider misuse | Businesses’ information is always under threat of duplication, modification or disclosure either accidentally or willfully. | Device encryption, access based on job need, removal of stale accounts and activity logging |
The State of Cyber Security in Canada Today
Bill C-8 received Royal Assent on June 16, 2026. This legislation amends the Telecommunications Act and creates a new statute: the Critical Cyber Systems Protection Act. The legislation applies to “designated operators” in federally regulated industries in the transportation, energy, telecommunications, and finance sectors. It does not apply to all companies. Public Safety Canada has indicated it intends to implement the legislation in phases. This is not a one-size-fits-all cybersecurity law that all Canadian businesses will be expected to comply with. Other cybersecurity requirements may apply to your company depending on the province(s) in which you operate, your industry, contractual obligations, or the kind of personal or other information that your company collects, processes, or stores. Rather than treating one piece of legislation as a panacea, it’s important to understand which cybersecurity laws apply to your company.
What You Can Do to Protect Your Business
| Period | Work to complete | Evidence that it works |
|---|---|---|
| Days 1–7 | Name an incident lead; inventory critical services, accounts, data and vendors; record emergency contacts | The owner can show which function is restored first and who can make containment decisions |
| Days 8–14 | Enable MFA on important accounts; separate administrator and everyday accounts; remove stale access; patch exposed systems | An access review shows who has privileged rights, and test accounts cannot bypass MFA |
| Days 15–21 | Create encrypted backups that are separated from the network; define recovery order; turn on useful logs and alerts | A clean restore test recovers a critical system within the target time, and alerts reach a named person |
| Days 22–30 | Review cloud and vendor access; run a ransomware or payment-fraud exercise; compare insurance and breach duties | Document the decisions, gaps, deficiencies, recovery times and corrective fixes identified during the exercise. Also document questions about who would need to be notified. |
Read More: Use the Business Cyber-Attack Protection Guide
If an incident is happening now
Notify your incident lead and IT security provider, and your cyber insurer’s approved response contact (if you have one), subject to policy terms, via an uncompromised, preferably out-of-band, means of communication.
Contain affected user accounts and devices, preserving evidence where possible. Disconnect affected devices from the network on advice from your IT security provider or incident response team. Contact financial institutions where transactions may be fraudulent and/or unauthorized transactions can be stopped or validated.
Never use the contact details in suspicious communications; use existing and trusted contacts instead. Record events, decisions, actions, times, message archives, logs, images, and other evidence. Preserve all evidence. Understand what data may be compromised. Understand what business processes have been interrupted.
Engage legal/privacy counsel to determine notification and disclosure requirements. Report criminal activity to law enforcement and applicable federal agencies. Recover from known-good backups once entry point(s) are identified and remediated. Test affected systems and business processes before reconnecting to the network.
Read More: Read the Small-Business Data Breach Guide
Privacy breach duties are not identical for every business.
Businesses and organizations should be aware that obligations vary. For example, under the federal private-sector privacy legislation (PIPEDA), an organization must report breaches of security safeguards that pose a real risk of significant harm to the federal Privacy Commissioner, notify affected individuals of certain breaches, and document all breaches. In addition, PIPEDA may be supplemented or replaced by a provincial private-sector or health information privacy law. That said, not all cybersecurity incidents are privacy breaches requiring mandatory notification. But all incidents should undergo a documented initial assessment.
How to inspect cyber insurance
| Policy field | Question to ask |
|---|---|
| Breach response | Which forensic, legal, notification, call-centre and credit-monitoring costs are covered, and must panel vendors be used? |
| Business interruption | Which incident triggers coverage, what waiting period applies and how are income loss and extra expense measured? |
| Cybercrime | Are social engineering, fraudulent instruction and funds-transfer loss included, excluded or subject to a small sublimit? |
| Ransomware and extortion | Which response and payment costs may be considered, what consents are required and what legal restrictions apply? |
| Vendor outage | Does dependent business-interruption coverage include your cloud, payment and managed-service providers? |
| Privacy liability | Which defence, settlement and regulatory costs are included, and are fines covered only where legally insurable? |
| Exclusions and conditions | How do prior events, unsupported software, security representations, war or state-linked activity and failure to maintain controls affect coverage? |
| Limit structure | Which costs share the main limit, which have sublimits, what retention applies and do defence costs reduce the limit? |
Provide truthful responses on the insurance application, and keep evidence to support the security measures you claim to have. Understand how coverage is determined. Coverage will depend on the specific terms of the policy, the nature of the breach, and your compliance with the terms of the policy. Check the emergency telephone numbers and approval process. Don’t wait for an incident.
Read More: Explore Cyber Liability Insurance