October 28, 2026 Best Practices 9 min read

Cybersecurity Policy for Small Business Canada: A Guide

By Omer Segoly, CISM | Published October 28, 2026

Canadian small businesses need written cybersecurity policies covering incident response, access control, passwords, backups, acceptable use, and data handling. Statistics Canada's 2023 Canadian Survey of Cyber Security and Cybercrime found that only 26% of Canadian businesses had written cybersecurity policies in place. The 2025 survey, released October 2026, found that 16% of Canadian businesses were impacted by a cybersecurity incident in 2025, unchanged from 2023. This guide explains which policies your business actually needs, what PIPEDA and the Canadian Centre for Cyber Security expect, and how to make policies real. This is informational context (not legal advice).

Which Cybersecurity Policies Does a Canadian Small Business Need?

A Canadian small business needs written policies covering incident response, authentication and passwords, data backup, acceptable use, and access control. The specific policies depend on your operations, but the Canadian Centre for Cyber Security's Baseline Cyber Security Controls for Small and Medium Organizations and PIPEDA's accountability principle provide a practical starting point.

Here are the core policies mapped to CCCS baseline controls and legal principles:

Incident Response Plan (BC.1): The CCCS baseline control BC.1.2 states that "organizations should have a written incident response plan that details who is responsible for handling incidents including any relevant contact information for communicating to external parties, stakeholders and regulators." Our guide to building an incident response plan covers the structure in detail.

Password and Authentication Policy (BC.5): Baseline control BC.5.3 states that "organizations should have clear policies on password length and reuse, the use of password managers and if, when, and how users can physically write down and securely store a password." BC.5.1 recommends implementing two-factor authentication wherever possible and documenting any business decision not to do so.

Data Backup Policy (BC.7): Baseline control BC.7.1 states that "organizations should back up systems that contain essential business information, and ensure that recovery mechanisms effectively and efficiently restore these systems from back-ups." BC.7.2 adds that long-term backups must be stored offline.

Acceptable Use Policy: While not a single baseline control, several CCCS controls address acceptable use. Section 3.6 of the baseline controls says training should focus on "practical and easily implementable measures such as the: Use of effective password policies; Identification of malicious emails and links; Use of approved software; Appropriate usage of the Internet; Safe use of social media." BC.6.1 summarizes: "Organizations should invest in cyber security awareness and training for their employees." BC.8.3 states that organizations should ensure employees only download mobile device apps from the organization's list of trusted sources.

Access Control Policy (BC.12): Baseline control BC.12.1 states that "organizations should provision accounts with the minimum functionality necessary for tasks and, in particular, should restrict administrator privileges to an as-required basis." BC.12.3 states that organizations should remove accounts when employees no longer require them.

Secure Configuration Policy (BC.4): Baseline control BC.4.1 states that "organizations should implement secure configurations for all their devices changing all default passwords, turning off unnecessary features, and enabling all relevant security features."

Other policies to consider based on your operations include mobile device and BYOD policies (BC.8), vendor and cloud service requirements (BC.10), and an AI usage policy for controlling what data employees share with AI tools.

What Does PIPEDA Require for Cybersecurity Policies?

PIPEDA Schedule 1, Principle 4.1.4 requires organizations to implement policies and practices to give effect to the ten privacy principles. The law does not mandate specific named policy documents, but it does require documented procedures covering protection, training, complaints, and transparency.

According to the official law text, Principle 4.1.4 states: "Organizations shall implement policies and practices to give effect to the principles, including (a) implementing procedures to protect personal information; (b) establishing procedures to receive and respond to complaints and inquiries; (c) training staff and communicating to staff information about the organization's policies and practices; and (d) developing information to explain the organization's policies and procedures."

Principle 4.7 adds the safeguards requirement: "Personal information shall be protected by security safeguards appropriate to the sensitivity of the information." Principle 4.7.4 requires that "organizations shall make their employees aware of the importance of maintaining the confidentiality of personal information."

The Office of the Privacy Commissioner of Canada's accountability guidance translates these principles into practical steps: develop and implement personal information-handling policies and procedures, document and implement breach and incident-management protocols, develop and deliver appropriate privacy training for employees, and regularly review your privacy management program.

For a broader overview of Canadian privacy law, see our guide to Canada's privacy landscape.

What Does Quebec Law 25 Require for Governance Policies?

Quebec's Law 25 goes further than PIPEDA by explicitly requiring governance policies. Section 3.2 of the Act respecting the protection of personal information in the private sector states: "Any person carrying on an enterprise must establish and implement governance policies and practices regarding personal information that ensure the protection of such information."

The law specifies that these policies must "provide a framework for the keeping and destruction of the information, define the roles and responsibilities of the members of its personnel throughout the life cycle of the information and provide a process for dealing with complaints regarding the protection of the information." The policies must be "proportionate to the nature and scope of the enterprise's activities and be approved by the person in charge of the protection of personal information."

Section 3.2 also requires publication: "Detailed information about those policies and practices, in particular as concerns the content required under the first paragraph, must be published in simple and clear language on the enterprise's website or, if the enterprise does not have a website, made available by any other appropriate means."

This requirement came into force on September 22, 2023. For businesses serving Quebec customers from outside the province, our Quebec Law 25 compliance guide explains the full scope of obligations.

How Do You Make Cybersecurity Policies Real?

A policy that exists only in a drawer or an unread shared drive is not protecting your business. Making policies real requires five elements: ownership, approval, acknowledgement, training, and review.

Ownership: The CCCS baseline controls state in OC.5.1 that "organizations should identify someone in a leadership role who is specifically responsible for their IT security." This person owns the policies, ensures they stay current, and has authority to enforce them. Our guide on who is responsible for cybersecurity explains how to assign these roles.

Approval: Policies should be formally approved by leadership. Quebec Law 25 section 3.2 explicitly requires that governance policies "be approved by the person in charge of the protection of personal information." Even where not legally required, documented approval shows the policy is official, not just a suggestion.

Staff Acknowledgement: PIPEDA Principle 4.1.4(c) requires "training staff and communicating to staff information about the organization's policies and practices." Staff should sign or electronically acknowledge that they have read and understood each policy. This creates a record and reinforces that the policy applies to them.

Training: A written policy is not enough. CCCS baseline control BC.6.1 states that organizations should invest in cybersecurity awareness and training for their employees. PIPEDA Principle 4.7.4 requires organizations to make employees aware of the importance of maintaining confidentiality. Our guide to employee security awareness training covers what actually changes behaviour.

Annual Review: Policies become outdated as systems change, threats evolve, and staff turn over. The OPC recommends that organizations regularly review their privacy management program. The CCCS guidance recommends that organizations have an "up-to-date hard copy version" of their incident response plan. Set a calendar reminder to review all policies at least annually and after any significant change.

Evidence: Keep records of approvals, acknowledgements, training completion, and review dates. If a customer, insurer, or regulator asks about your policies, you need to demonstrate not just that they exist, but that they are implemented and maintained.

What Do Insurers and Customers Ask About Policies?

Cyber insurance adoption is growing. Statistics Canada's 2025 survey found that over one-third (34%) of Canadian businesses had cyber risk insurance in 2025, up from 22% in 2023. The CCCS baseline controls address the connection between policies and insurance: BC.1.3 states that "organizations should consider purchasing a cyber security insurance policy that includes coverage for incident response and recovery activities OR provide a rationale for not purchasing one."

Be ready to show whether you have a written incident response plan, whether you require multi-factor authentication, what your password policy requires, and when policies were last reviewed. Organizations that implement the baseline controls and document their policies can answer these questions with specific evidence rather than vague assurances.

For businesses considering certification, the CyberSecure Canada program gives certified businesses "official recognition of their compliance to the baseline security controls." Our guide to cybersecurity audits in Canada explains the difference between assessment and certification.

One Question to Ask Your IT Provider

"Which of our security policies are written, approved, and acknowledged by staff, and when were they last reviewed?"

If your IT lead or managed service provider cannot answer this question, that conversation is where your policy work should start. A policy that has not been reviewed since it was created, or that staff have never seen, is a policy that may not hold up when tested.

Where Does Your Business Stand on the Baseline Controls?

Understanding which policies you need starts with knowing where your organization stands today. Our free cybersecurity assessment evaluates your practices against the Canadian Centre for Cyber Security's 13 Baseline Control areas. The assessment covers incident response planning, authentication, security awareness, data backup, access control, and eight other areas. It takes under 30 minutes, your answers stay in your browser, and progress is saved locally for 48 hours. The results show which control areas need attention, so you know which policies to write first.

Frequently Asked Questions

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). Cybersecurity Policy for Small Business Canada: A Guide. Retrieved from https://cybersecuritycanada.ca/news/posts/cybersecurity-policy-for-small-business-canada/

Permanent URL: https://cybersecuritycanada.ca/news/posts/cybersecurity-policy-for-small-business-canada/ · Published October 28, 2026