Small Business Cybersecurity Incident Response Checklist (Canada, 2026)
The six phases
Prepare, identify, contain, eradicate, recover, and review. Most small businesses skip 'prepare' and 'review' — the two cheapest phases and the ones that decide how the other four go.
Who does what
Name one decision-maker, one technical contact, and one communications contact before an incident. In a five-person shop these may be two people, but the roles must be assigned, not improvised mid-crisis.
The Canadian reporting step
Under PIPEDA and Quebec's Law 25 you may be legally required to report a breach involving real risk of harm — to regulators and to affected individuals. Build that step into the plan so it isn't missed in the panic. IT Cares can stand up the technical containment and recovery side.
Action checklist
- ✅ Assign decision, technical and communications leads now
- ✅ Keep offline backups you can restore from
- ✅ Write down how to isolate an infected device
- ✅ Know your PIPEDA / Law 25 breach-reporting duties
- ✅ Keep an incident log for evidence and review
- ✅ Run a tabletop test once a year
FAQ
What should a small business do first in a cyber incident?
Contain it — disconnect affected devices from the network to stop spread — then identify scope, preserve evidence, and start recovery from clean offline backups. Assign roles in advance so this happens fast.
Do Canadian businesses have to report a data breach?
Often yes. Under PIPEDA and Quebec's Law 25, breaches that pose a real risk of significant harm must be reported to regulators and affected individuals. Build the reporting step into your incident-response plan.
Get a free assessment
Tell us where you are — we send back a clear, no-pressure plan. Leads only, no payment.