Cyber Insurance for Small Businesses: Controls First

Why controls come before the policy

Small businesses usually think about cyber insurance after a scare: a client's email account is hijacked, a laptop is stolen, a ransomware note appears on the shared drive. The insurer's first question at that point is not "how much cover do you want?" but "what controls do you have?"

The numbers suggest most small firms are not ready for that question. In a survey commissioned by the Insurance Bureau of Canada (IBC) and published October 1, 2025, only 47% of small and medium-sized business respondents said their business was prepared for a cyber attack or data breach, fewer than half (48%) had implemented any form of cyber defence, just 22% carried cyber insurance and only 12% had a dedicated stand-alone cyber policy ^[1]. The same release cites research from BDC that 73% of small businesses have experienced a cyber security incident.

This guide puts the free homework first: the federal Cyber Centre's baseline controls. Then it covers what a cyber policy typically pays for, what insurers ask, and the Quebec legal duties that apply whether or not you are insured.

This article is general information, not insurance or legal advice.

Step 1: The Cyber Centre's 13 baseline controls

The Canadian Centre for Cyber Security publishes Baseline Cyber Security Controls for Small and Medium Organizations (version 1.2). Its stated aim is to apply "the 80/20 rule (achieve 80% of the benefit from 20% of the effort)" to the cyber security of small and medium organizations ^[2]. It lists 13 controls:

The guidance is meant for organizations without a large IT team, and it says so in its recommendations. For example, on patching it recommends that small and medium organizations "enable automatic updates for all software and hardware if such an option is available - or consider replacing products with ones that provide the option," instead of the full patch management programs it advises for large enterprises (same source).

The five controls with the biggest payoff for a small team

1. Two-factor authentication (3.5). The Cyber Centre recommends two-factor authentication "wherever possible," and says organizations should require it for important accounts such as financial accounts, documenting any case where they decide not to. It also recommends changing passwords only when there is suspicion or evidence of compromise, rather than on a fixed schedule (same source). Start with email, banking, payroll, accounting software and your domain registrar.

2. Backups with an offline copy (3.7). The baseline recommends backing up essential business information regularly to an external secure location, storing backups encrypted with restricted access, and considering offline storage at a secure offsite location or documenting a rationale for not doing so. It specifies that long-term backups (for example weekly) must be offline, while frequent backups (for example daily) may be online (same source). A cloud sync folder is not a backup if ransomware can encrypt it too.

3. Automatic updates (3.2). Turn them on for laptops, phones, routers and browsers. Replace the old router that no longer receives updates.

4. Awareness training (3.6). The baseline lists practical topics: password policies, identifying malicious emails and links, approved software, appropriate internet use and safe social media use (same source). A 30-minute session each year, plus a rule that any payment-detail change is confirmed by phone, covers most invoice-fraud attempts.

5. An incident response plan (3.1). The Cyber Centre's advice is to assume incidents will occur and to have a plan to respond and recover, as part of business continuity planning (same source). Our small business continuity plan template has a section you can adapt.

If your team works remotely or in shared spaces, our remote work security checklist applies these controls to home networks and public Wi-Fi.

Step 2: What a cyber policy is for

A cyber policy pays for the costs that controls fail to prevent. Get Cyber Safe, the federal awareness campaign, and IBC list the costs a stand-alone cyber policy can help cover ^[3]:

IBC lists the risks more broadly: losses related to personal data security breaches, cyber extortion, technology disruptions and more ^[4].

Why your existing business policy may not be enough

IBC's guidance is direct: "most property or liability policies don't expressly cover cyber risks, or have very limited coverage," so a stand-alone cyber policy may be worth considering, alongside preventive measures (same IBC page). If you already have a commercial general liability or package policy, ask your broker in writing which of the four categories above it covers, and up to what amount. Our freelancer insurance guide explains the other policies a small business typically carries.

Step 3: What insurers will ask you

IBC built a free 10-question self-assessment tool that helps owners learn about the security protocols and best practices most cyber insurers look for, and that poses some of the questions insurers may ask during the application. Examples of what it asks owners to consider: their cyber risk, whether they collect and store customers' personal information, what security procedures they have, and how often employees receive cyber safety training. IBC notes that the tool "cannot provide an actual risk assessment," but it can help gauge readiness ^[4].

Before you call a broker, prepare answers to questions like these, mapped to the baseline:

Answer honestly. A policy's value depends on the application being accurate; if your controls are not in place yet, the better move is usually to implement them and then apply.

Step 4: Questions to ask before you sign

Policy wordings differ, and no public source sets a standard small-business cyber policy. Questions to ask your broker:

1. Which of the four coverage categories (data restoration, notification, forensics, legal and damages) are included, and what is the limit for each?
2. Is there a deductible or waiting period before business interruption cover starts?
3. Does the policy cover social engineering or invoice fraud (a client paying a fraudster after a fake email)?
4. Does it cover incidents at your cloud or IT providers?
5. Which controls are conditions of coverage (for example, two-factor authentication must be on)?
6. Does the insurer provide an incident hotline, and must you use its vendors?
7. Does it cover regulatory investigations and the costs of notifying people under Quebec law?

Step 5: Quebec's legal duties after an incident

Insurance or not, a Quebec business that holds personal information has legal duties when something goes wrong. Under the Act respecting the protection of personal information in the private sector ^[5]:

• What counts. A "confidentiality incident" is access, use or communication of personal information not authorized by law, or the loss of personal information or any other breach of its protection (s. 3.6). The Commission d'accès à l'information (CAI) gives examples including an employee consulting information without authorization, sending it to the wrong recipient, and a cyberattack such as phishing or ransomware ^[6].
• Act to reduce harm. If you have cause to believe an incident occurred, you must take reasonable measures to reduce the risk of injury and to prevent new incidents of the same nature (s. 3.5).
• Notify when the risk is serious. If the incident presents a risk of serious injury, you must promptly notify the CAI and the persons whose information is concerned (s. 3.5). In assessing that risk you must consider the sensitivity of the information, the anticipated consequences of its use and the likelihood it will be used for injurious purposes, and consult the person in charge of the protection of personal information (s. 3.7).
• Keep a register. You must keep a register of confidentiality incidents, and send a copy to the CAI at its request (s. 3.8). That applies to every incident, not only the serious ones.
• Providers do not take the duty off you. The CAI states that a business that entrusts personal information to a third party remains responsible for its obligations in case of an incident: measures, register and notices ^[6].

The CAI suggests assessing an incident quickly with six questions: who is affected, how many people, what information, when it happened and was discovered, where (inside the business or at a provider), and why the security measures failed (same CAI page). Put those questions in your incident response plan.

If you have not set up the rest of Law 25 compliance, start with our Law 25 checklist for micro-businesses.

A 30-day starter plan