Frequently asked questions
100 questions about cybersecurity in Québec
100 questions SMBs, MSPs and municipalities ask us, with short answers and, where a fact is at stake, its source. Ten themes, from Law 25 to team training.
01 · 10 questions
Basics and risks
What an SMB, an MSP or a municipality in Québec should know before talking about tools.
What does cybersecurity mean, concretely, for an SMB?
- It is the set of measures that protect your systems, your data and your ability to work: protected access, tested backups, updates, monitoring, and employees who can recognize an attack. For an SMB it is not an isolated IT project but a management routine, like bookkeeping or the physical security of the premises.
Is my SMB really a target?
- Yes, because attacks almost never aim at one company in particular. Automated tools sweep the Internet looking for exposed systems, weak passwords and email users who take the bait. An SMB with fewer protections is simply easier to reach than a large organization, and usually pays better than an individual.
What are the most common attacks against businesses in Québec?
- Email phishing remains the most common entry point, followed by account compromise (reused passwords, no multi-factor authentication), ransomware and wire-transfer fraud. Internet-facing services left unpatched, such as a VPN or a remote access gateway, complete the usual list of entry points.
How much does a cybersecurity incident cost?
- The cost depends on the operational stoppage, the rebuilding of systems, response fees, legal obligations (notices to affected people and to the Commission d'accès à l'information) and lost customers. The most expensive part is almost always the downtime. A prior assessment of your critical assets puts a figure on that risk for your organization.
Where do we start when starting from zero?
- With an inventory: which systems, which data, who has access. Then four measures that remove most common risks: multi-factor authentication everywhere, tested offline backups, updates applied quickly, and a short employee training on phishing. An audit gives you that inventory and the order of priorities.
Is an antivirus enough?
- No. A traditional antivirus recognizes known malware. It does not protect against a stolen password, a convincing phishing email or an exposed configuration. It remains useful as one layer among others, ideally replaced by an endpoint detection and response (EDR) solution that someone actually watches.
How much should an SMB spend on cybersecurity?
- There is no universal percentage. The right method starts from your critical assets and what a one-week stoppage would cost you. The basic measures (multi-factor authentication, backups, updates, training) cost little and cover the essentials; continuous monitoring and penetration tests are justified as soon as a stoppage of your systems becomes expensive.
What is the difference between my IT provider and a cybersecurity provider?
- Your IT provider keeps your systems running: workstations, network, email, backups. A cybersecurity provider checks that those systems withstand an attack, watches for signs of intrusion and steps in during an incident. The two roles complement each other; an independent look avoids having the builder also be the judge.
Does cyber insurance replace prevention?
- No. Insurers increasingly require basic measures before covering you: multi-factor authentication, backups, endpoint detection, a response plan. A policy covers part of the costs after an incident; it restores neither your reputation nor your data. Prevention lowers both the premium and the likelihood of a claim.
How can I tell whether my business is already compromised?
- Common signs: logins at unusual hours, unknown forwarding rules in mailboxes, accounts created for no reason, slowdowns, renamed or encrypted files, authentication prompts nobody asked for. Without logs or monitoring these signs go unnoticed; a review of access and logs is the first step of a check.
02 · 10 questions
Law 25 and compliance
The legal obligations in Québec and the frameworks your customers or partners may require.
What is Law 25?
- Law 25 (adopted in 2021 as Bill 64) modernized Québec's Act respecting the protection of personal information in the private sector. It gives businesses concrete obligations: designate a privacy officer, keep an incident register, publish a privacy policy, frame consent and assess projects that involve personal information.Commission d'accès à l'information — Main changes brought by Law 25
Does Law 25 apply to my small business?
- Yes, as soon as you collect, hold, use or communicate personal information in Québec: names, emails, phone numbers, customer or employee data. The law sets no size threshold. A two-person company has the same obligations in principle as a large one, scaled to the sensitivity of the information and its means.CAI — Scope of the Act (businesses)
Who must be the person in charge of the protection of personal information?
- By default, the person with the highest authority in the business, often the president or the CEO. The function can be delegated in writing to someone else. The officer's title and contact details must be published, notably on the website, so that anyone can exercise their rights of access or rectification.CAI — Person in charge of the protection of personal information
What must we do after a confidentiality incident under Law 25?
- Record the incident in a register, take measures to limit the harm, then assess whether it presents a risk of serious injury. If so, you must notify the Commission d'accès à l'information and the people concerned. An incident includes unauthorized access, use or communication, and the loss of personal information.CAI — Confidentiality incidents and security measures
What are the penalties under Law 25?
- The Commission d'accès à l'information can impose administrative monetary penalties of up to 10 million dollars or 2% of worldwide turnover. Penal proceedings can reach 25 million dollars or 4% of worldwide turnover. The higher of the two amounts applies. Affected people can also claim damages.CAI — Penalties
Do I need consent for the cookies on my website?
- Yes for technologies that can identify, locate or profile a person, such as audience-analytics tools that use cookies. Consent must be manifest, free and informed, and privacy settings must offer the highest level of protection by default. A banner that actually blocks those tools until consent is the expected practice.
What is a privacy impact assessment (PIA)?
- An analysis to carry out before any project to acquire, develop or overhaul a system that handles personal information, or before communicating information outside Québec. It documents the information at stake, the risks for the people and the measures to reduce them. Its depth is proportionate to the sensitivity of the information.
Law 25 or PIPEDA: which one applies to me?
- The Québec law applies to businesses operating in Québec. PIPEDA, the federal law, applies to federally regulated organizations (banks, telecommunications, interprovincial transport) and to interprovincial or international exchanges of information. Many Québec businesses fall under both; Law 25's requirements are generally the stricter ones.
Do I need ISO 27001?
- ISO/IEC 27001 is an international standard for information security management systems. It becomes relevant when customers, tenders or partners require it, or when you want a recognized framework to structure your controls. An SMB can draw on it without getting certified; certification requires an external audit and yearly follow-up.
Who are SOC 2 and PCI DSS for?
- SOC 2 concerns service providers that handle customer data, often software-as-a-service companies, and reassures their customers about their controls. PCI DSS applies to any organization that processes, stores or transmits payment card data, with requirements scaled to volume. A prior audit shows the gap to close before committing.
03 · 10 questions
Phishing and email
The number one attack vector, and what you can do this week.
How do I recognize a phishing email?
- Check the sender's real domain, not only the displayed name. Be wary of urgency ("within 24 hours"), threats, generic greetings, links whose text does not match their destination, and unexpected attachments, especially compressed ones. When in doubt, contact the organization through a channel you already know, never through the email received.
I clicked a suspicious link, what should I do?
- Enter nothing more. Disconnect the device from the network if a file was opened, change the password of the affected account immediately from another device, enable multi-factor authentication and tell your IT lead or your security provider. Report the email rather than deleting it: it serves the investigation.
What is CEO fraud or wire-transfer fraud?
- A fraudster poses as an executive, a supplier or an accountant and requests an urgent transfer or a change of banking details. The email is often credible because it follows a real mailbox compromise. The defence is procedural: every change of banking details or unusual transfer is confirmed by phone at a number already known.
SPF, DKIM, DMARC: what are they for?
- They are three records in your domain's DNS. SPF lists the servers allowed to send on your behalf, DKIM signs your emails, DMARC tells recipients what to do when a message fails those checks and sends you reports. Together they make spoofing your domain much harder and improve the delivery of your legitimate email.
How do I know whether a mailbox has been compromised?
- Look for forwarding or auto-delete rules nobody created, logins from unusual places in the account's log, sent messages the user does not recognize, and complaints from contacts receiving strange emails. These checks are quick in Microsoft 365 and Google Workspace and should be part of a regular review.
Should we run phishing simulations with employees?
- Yes, if they serve to train rather than to trap. A well-run campaign measures the click rate, shows the missed clues immediately and repeats a few times a year with realistic scenarios. The useful result is not a zero rate but employees who report suspicious messages quickly, which gives the team time to act.
Does phishing also happen by text message and by phone?
- Yes. By text, it is fake delivery, refund or bank notices with a link to click. By phone, a caller poses as technical support, a financial institution or even a colleague, sometimes with an imitated voice. The same reflexes apply: give nothing on request, hang up and call back at a known number.
Is a spam filter enough against phishing?
- It blocks a large share of messages, but targeted attacks get through regularly, especially those sent from a legitimate mailbox that is already compromised. The filter must be completed by multi-factor authentication, link and attachment protection at click time, a report button for employees and a review of forwarding rules in mailboxes.
Does multi-factor authentication stop phishing?
- It stops most password theft, but not all. Some attacks capture the one-time code in real time or wear the user down with notifications until one is approved. Phishing-resistant methods, such as security keys and passkeys, close that door. Choose them first for administrator accounts and executives.
Where do I report a phishing attempt in Canada?
- To your IT team first, to block the sender and check the other mailboxes. Then to the Canadian Anti-Fraud Centre for fraud attempts, and to the Canadian Centre for Cyber Security for incidents affecting an organization. If personal information was exposed, Law 25 requires recording the incident and, depending on the risk, notifying the Commission d'accès à l'information.Canadian Centre for Cyber Security — Report a cyber incident · Canadian Anti-Fraud Centre
04 · 10 questions
Passwords and access
Accounts are the target; here is how to make them hard to steal and easy to revoke.
What does a good password look like in 2026?
- Long before complicated: a passphrase of four words or more, unique per service, never reused. Forced changes every three months do not improve security and push people toward predictable variants; a password is changed when it may have been compromised. A password manager makes all of this possible without a superhuman memory.
Is a password manager safe?
- Yes, far safer than reuse or note files. A manager generates and stores unique passwords, encrypted with a master password only you know. Protect that master account with a strong passphrase and multi-factor authentication, choose a business edition with controlled sharing, and plan recovery for when an employee leaves.
What is multi-factor authentication (MFA)?
- A second proof of identity on top of the password: a code generated by an app, a notification to approve, a physical security key or a passkey. A stolen password is no longer enough to get in. It is the best effort-to-protection measure for an SMB; it should be mandatory on email, remote access and every administrator account.
What are passkeys, and should we adopt them?
- A passkey replaces the password with a pair of cryptographic keys tied to your device and unlocked by fingerprint, face or code. Nothing to type, nothing to phish: a fraudulent site cannot obtain the key. Microsoft, Google, Apple and most major services support them. Start with administrator accounts and executives.
Should my employees be administrators of their computers?
- No. A standard account is enough for daily work and limits what malware can do if it runs. Administrator rights are kept for separate accounts, used only to install or configure, with multi-factor authentication. This separation is one of the most effective measures against ransomware, and one of the cheapest.
What happens to access when an employee leaves?
- Revoke it the same day, from a list kept up to date: email, VPN, cloud applications, file shares, alarm codes, access cards, shared passwords. Transfer the mailbox and the files to a manager rather than keeping the account active. A written offboarding process avoids forgotten accounts, a classic entry point.
Can several employees share one account?
- Avoid it. A shared account prevents knowing who did what, complicates revocation when someone leaves and makes multi-factor authentication painful. When a service does not allow individual accounts, use the controlled sharing of a password manager, change the secret at every departure and log its use.
How do we secure remote access to our systems?
- Never a remote desktop exposed directly to the Internet. Go through a VPN or a zero-trust access solution, with multi-factor authentication, individual accounts, updates applied quickly on the gateway and logging of connections. Unpatched remote access gateways are among the most exploited entry points against SMBs.
What is the principle of least privilege?
- Each person, service account and application gets only the access needed for its task, no more, and no longer than necessary. Applied to file shares, cloud roles and administrator rights, this principle limits the damage of a compromised account and simplifies audits. A quarterly access review keeps it true over time.
How often should access be reviewed?
- At least quarterly for sensitive access (administration, finance, personal information) and at every role change or departure. The review confirms that each account still exists for a reason, that rights match the role and that service accounts have an owner. It is also a common requirement of frameworks such as ISO 27001 and SOC 2.
05 · 10 questions
Ransomware and incidents
What to do when it happens, whom to tell, and how to recover.
What is ransomware?
- Malware that encrypts your files and servers, then demands a ransom for the decryption key. Current groups also steal the data before encrypting it and threaten to publish it, which turns the event into a confidentiality incident under Law 25. It most often gets in through phishing, exposed remote access or a compromised account.
What should we do in the first hour of an incident?
- Isolate the affected systems from the network without powering them off, cut remote access and suspicious accounts, alert management and your security responder, and start a time-stamped log of facts and decisions. Pay nothing and do not negotiate alone. Preserve the evidence: it serves the investigation, the insurer and the legal obligations.
Should we pay the ransom?
- Canadian authorities advise against it: paying guarantees neither the recovery of the data nor the attackers' silence, and it funds further attacks. A payment may also breach economic sanctions depending on the group. The decision belongs to management with its legal advisers and insurer; tested offline backups make the question secondary.Canadian Centre for Cyber Security — Ransomware: how to prevent and recover
Whom must I notify after an attack in Québec?
- Depending on the case: the police (Sûreté du Québec or the municipal service) to file a complaint, the Canadian Centre for Cyber Security to report the incident, your insurer within the policy's deadlines, and the Commission d'accès à l'information and the people concerned if personal information presents a risk of serious injury. Affected customers and partners must also be informed.
What is the 3-2-1 backup rule?
- Three copies of your data, on two different media, one of them off site and ideally offline or immutable, meaning impossible to alter from the network. Ransomware also encrypts reachable backups; only a disconnected copy guarantees recovery. A backup only exists if its restoration was tested recently.
Do I need an incident response plan?
- Yes, even a short one. One page that says who decides, who calls whom (responder, insurer, lawyer, authorities), where the backups are, how to communicate without the compromised email, and which steps to follow in the first hours. Tested once a year as a tabletop exercise, that plan is the difference between a hard day and a week of downtime.
How long does recovery take after ransomware?
- From a few days to several weeks, depending on the state of the backups, the extent of the encryption and the availability of the teams. Recovery goes through rebuilding systems from clean sources, changing every password and verifying that no persistent access remains. A recovery plan with priorities per system shortens that delay.
What does my insurer require after an incident?
- Prompt notice, often within 24 to 72 hours, access to the responders it approves, a log of the facts, preserved evidence and proof that the measures required by the contract (multi-factor authentication, backups, detection) were in place. Read your policy before the incident: the exclusions and deadlines are in it.
Is data theft without encryption an incident?
- Yes. An extraction of personal information, even without a service interruption, is a confidentiality incident that must be recorded and assessed under Law 25, and often notified. These attacks are quiet; they are detected by monitoring unusual outbound transfers and access to data stores, not by an outage.
What should we do after the incident so it does not happen again?
- A cold review: how the attacker got in, what slowed detection, what worked. Then fixes ranked by priority, often multi-factor authentication, segmentation, monitoring and training, with dates and an owner. A penetration test a few months later verifies that the door is really closed.
06 · 10 questions
Penetration tests and audits
Measure before investing: what a test or an audit actually delivers.
What is a penetration test?
- A simulated attack, authorized and framed by contract, carried out by specialists who use attackers' methods to find the weaknesses of your systems before they do. The result is a report: each weakness with its evidence, its severity, its impact for your business and the recommended fix. The test ends with a retest after remediation.
What is the difference between a vulnerability scan and a penetration test?
- The scan is automated: it compares your systems against a database of known vulnerabilities and produces a list, with false positives. The penetration test adds human judgement: chaining several weaknesses, bypassing a protection, measuring the real impact. Scanning happens often; penetration testing, periodically and after a major change.
How often should we run a penetration test?
- At least once a year and after any major change: a new application, a cloud migration, a network overhaul. Some frameworks require it explicitly, such as PCI DSS for the payment card environment. Between two tests, regular scanning and monitoring cover newly published vulnerabilities.
How much does a penetration test cost?
- The price depends on the scope (number of systems, applications, addresses), the depth (black, grey or white box), the duration and whether the retest is included. A test focused on one web application costs less than a full test of the external and internal infrastructure. A free scoping call allows a precise quote rather than a range.
Black, grey or white box: which one to choose?
- In black box, the testers know nothing, like an external attacker. In white box, they have access to the code, the documentation and accounts, which finds more weaknesses in less time. Grey box, with a user account and some information, is the most common compromise for an SMB that wants realistic and complete results.
What does a penetration test report contain?
- A scope and a method, an executive summary, each finding with its severity (often a CVSS score), the evidence (requests, screenshots), the concrete impact, the recommended fix and a suggested deadline, then an ordered remediation plan. A good report reads for a manager and for a technician; it ends with a scheduled retest.
Security audit or penetration test: which one first?
- The audit if you have never taken stock: it covers the organization, processes, access, backups and compliance, not only the technology. The penetration test if you expose a critical application or service on the Internet and want to know whether it holds. The two complement each other; the audit says what to prioritize, the test verifies.
Can a penetration test break my systems?
- The risk exists but is managed: written scope and rules of engagement, sensitive systems excluded or tested outside business hours, destructive techniques forbidden, an emergency contact on both sides. A serious test is less risky than a real attack, which takes none of these precautions. Tell your IT provider and your host before it starts.
What do we do after the report?
- Fix in order of severity, starting with what is exploitable from the Internet, then retest to confirm. Organizational findings (no multi-factor authentication, shared accounts, late patches) often matter more than isolated technical flaws. Set an owner and a date per finding; without that, the report sleeps in a drawer.
Can an audit cover Law 25 at the same time?
- Yes. A compliance audit checks the designated officer, the incident register, the privacy policy, consent, privacy impact assessments and the security measures that protect personal information. The same controls also serve ISO 27001 or SOC 2. The deliverable is a documented gap and an action plan, not a certificate.
07 · 10 questions
Monitoring, SOC and response
Seeing the attack before it sees you: what continuous monitoring changes.
What is a SOC?
- A security operations centre: people, tools and procedures that watch your systems continuously, analyze alerts and step in during an incident. For an SMB it takes the form of an outsourced service, available around the clock, rather than an in-house team. Its value is measured by the time between intrusion and reaction.
EDR and antivirus: what is the difference?
- Antivirus recognizes known malware and blocks it. EDR (endpoint detection and response) watches behaviour on each workstation and server, detects attacks without a known signature, isolates a machine remotely and keeps the history for the investigation. It is only worth it when supervised: an alert with no response stops nothing.
What does MDR mean?
- Managed detection and response: a provider operates the EDR and the other sensors for you, triages alerts, investigates and intervenes, often by isolating machines and blocking accounts. It is how an SMB gets 24/7 monitoring without hiring a team. Check the contractual response times and what the response includes.
Why keep logs, and for how long?
- Without logs, nobody knows how an attacker got in or what they touched, which makes assessing a confidentiality incident impossible. Keep at least authentication, email, remote access and administration logs, centrally and protected from deletion. Twelve months of retention is a common benchmark; longer if a framework requires it.
What is a SIEM?
- A system that collects the logs of all your sources (workstations, servers, email, cloud, network), correlates them and raises alerts according to rules. It is the central tool of a SOC. For an SMB, a SIEM operated by a provider beats a product installed and left unwatched; the value lies in the rules and the people who read them.
What are honeypots and sensors for?
- A honeypot is a decoy system that has no legitimate reason to be contacted: every connection is an attack attempt. Deployed as a network, these sensors reveal which services are targeted, from where and with which methods, with no customer data at all. Those signals feed detection and allow blocking active sources before they reach your systems.
How long does an intrusion go unnoticed?
- Without monitoring, weeks, sometimes months: the attacker explores, escalates privileges and exfiltrates before showing up, often with ransomware. With endpoint detection and log review, that delay is counted in hours. Reducing that time is the main goal of monitoring, more than preventing every intrusion.
Is 24/7 monitoring affordable for an SMB?
- Yes, as a shared service: the cost is monthly, per monitored workstation or server, with no hiring and no equipment. It compares to a fraction of the cost of a single day of downtime. The right level depends on your critical assets; start with email, workstations and remote access, where most incidents concentrate.
What happens when an alert fires?
- An analyst qualifies it: real incident or false positive. If it is real, they isolate the machine or block the account, notify you through the agreed channel, investigate the origin and the extent, then support you through remediation and, if needed, the legal obligations. The contract sets the response times and what requires your authorization.
Does monitoring help with Law 25 compliance?
- Yes: the law requires reasonable security measures and a response to incidents, with an assessment of the risk of injury. Detecting quickly, knowing what was touched thanks to logs and documenting the actions are exactly what is needed to keep the incident register and decide which notices to give. Without monitoring, the incident is discovered too late to respond well.
08 · 10 questions
Cloud and remote work
Microsoft 365, Google Workspace, AWS, Azure: security changes shape, not importance.
Does my cloud provider take care of my security?
- Only partly. The provider secures the infrastructure; you remain responsible for configuration, identities, access, data and its backup. That is the shared responsibility model. Most cloud incidents come from a misconfiguration or a compromised account, therefore from your side of the line.
How do we secure Microsoft 365 or Google Workspace?
- Multi-factor authentication for everyone, phishing-resistant for administrators; separate administrator accounts; legacy protocols blocked; conditional access rules; an audit of forwarding rules; link and attachment protection; audit logs enabled and retained. These settings already exist in your subscription; they mostly need to be applied and verified.
Should I back up my Microsoft 365 or Google Workspace data?
- Yes. The provider guarantees the availability of its service, not the recovery of your data after a deletion, ransomware or human error beyond recycle bins and retention periods. An independent backup of your emails, files and collaboration sites, tested by restoration, is your responsibility, as it is for a local server.
VPN or zero-trust access?
- A VPN opens a tunnel to the whole network once the user is authenticated. Zero-trust access verifies identity, device and context for each application, without granting network access. For an SMB both are acceptable if multi-factor authentication is in place; zero trust limits the damage of a compromised workstation and simplifies remote work.
How do we secure remote work?
- Company-managed devices, encrypted, up to date and supervised by an EDR; multi-factor authentication on everything; access to applications through VPN or zero trust; clear guidance on public Wi-Fi, personal devices and file sharing; and a way to reach the IT team when in doubt. The workstation at home is a company workstation.
Can I let employees use their personal devices?
- Yes, within limits: access to applications through the browser or managed apps, multi-factor authentication, separation of business data, remote wipe of the business part, and no access to sensitive data from an unencrypted device. A written policy, accepted by the employee, states what is allowed and what happens in case of loss.
What are the most common cloud misconfigurations?
- Publicly accessible storage buckets, access keys in code or in repositories, root accounts used daily without multi-factor authentication, administration ports open to the whole Internet, audit logs disabled and overly broad roles. A configuration audit against the provider's recommendations finds them within hours.
Is my data encrypted in the cloud?
- Generally at rest and in transit by default, with keys managed by the provider. That protects against the physical theft of disks, not against a compromised account that reads the data normally. The useful question is therefore: who can access it, with which authentication, and is it logged. Customer-managed keys are warranted for the most sensitive data.
Can I host personal information outside Québec?
- Yes, provided you carry out a privacy impact assessment concluding that the information receives adequate protection, and frame the transfer by contract. This applies to common American cloud services. Document where the data is, who accesses it and under which law; the major providers offer Canadian regions.
Is my office Wi-Fi a risk?
- It is if the password is shared with visitors, if personal devices and servers sit on the same network or if the equipment was never updated. A separate guest network, recent encryption (WPA3, or WPA2 with a long passphrase), access point updates and segmentation of sensitive equipment are enough for most SMBs.
09 · 10 questions
Providers, MSPs and municipalities
Security also plays out at those who hold your access, and public bodies have their own rules.
What minimum security should I require from my IT provider or MSP?
- Multi-factor authentication on its own administration tools, named rather than shared accounts, logging of its access to your systems, tested offline backups, an incident response plan, updates within defined delays, and a written commitment to notify you of an incident on its side. Its access to your systems is your access.
What is third-party risk?
- The risk that a provider (software, host, accountant, MSP) is compromised and serves as a gateway to you, or loses your data. It is managed through an inventory of providers holding access or data, contractual requirements, limiting their access to the strict minimum, and periodic verification. Attacks against managed service providers target precisely their customers.
Which questions should I ask a provider before entrusting data?
- Where the data is hosted, who accesses it, how it is encrypted and backed up, which certifications or external audits (SOC 2, ISO 27001) exist, what the incident notification process is, what the restoration times are, and how the data is returned or destroyed at the end of the contract. Require written answers.
What are a Québec municipality's cybersecurity obligations?
- A municipality is a public body subject to the Act respecting access to documents held by public bodies and the protection of personal information, also modernized by Law 25: a designated officer, an incident register and notifications, privacy impact assessments, proportionate security measures. Its citizen services and control systems additionally require business continuity.
Where should a small municipality start?
- With the inventory of systems and citizen data, the designation of the officer, multi-factor authentication on email and remote access, tested offline backups and a short training for employees and elected officials. Then an audit sets the priorities and supports budget requests and funding programs.
I am an MSP: how do I protect my customers and myself?
- Secure your remote administration tools and consoles first: phishing-resistant multi-factor authentication, named accounts, logging, segmentation per customer, fast updates. Offer monitoring and response as a service, with a security partner if you lack the team. An incident at an MSP hits all of its customers at once.
How do we evaluate cybersecurity in a tender?
- Ask for evidence rather than promises: audit or certification reports, results of a recent penetration test, written policies, an incident response plan, notification and restoration-time commitments, and references. Weight these criteria like the price. A serious provider answers without difficulty; no answer is an answer.
Which security clauses belong in a contract with a provider?
- Confidentiality, location and return of data, minimum security measures, incident notification within a precise delay, a right to audit or the provision of audit reports, framed subcontracting, insurance, and consequences in case of breach. For personal information, Law 25 requires a written contract framing its communication to a third party.
Is open-source software less secure?
- Not by nature. Its security depends, as with commercial software, on maintenance, updates and configuration. The real risk is the forgotten component: a vulnerable library in an application or a server nobody updates. An inventory of components and tracking of published vulnerabilities, such as CISA's KEV catalogue, settles the question.
Is there financial help for SMB cybersecurity in Québec?
- Government and sector programs exist and change regularly; they often cover part of an audit, a security plan or training. Check with your region's economic development bodies and the programs of the Québec and Canadian governments before launching a project. A prior audit produces the plan those programs ask for.
10 · 10 questions
Training and culture
Employees are the first line of defence when given the means to be.
How often should employees be trained?
- A short training at hiring, a refresher at least once a year and regular exercises, for instance quarterly phishing simulations. Thirty-minute sessions built on real cases stick better than long presentations. The goal is a reflex: report quickly, without fear of blame.
What should a basic training cover?
- Recognizing phishing by email, text and phone; passwords and multi-factor authentication; what to do and whom to call in case of doubt or error; secure file sharing; remote work and devices; and confidentiality obligations toward personal information. Adapt the examples to the tools your teams really use.
Do executives need specific training?
- Yes. They are the preferred targets of wire-transfer fraud and impersonation, they hold the broadest access, and they decide during an incident. A dedicated session covers those attacks, their own accounts, decision-making in a crisis and their legal responsibilities, including that of privacy officer.
What is a tabletop exercise?
- An incident simulation in a meeting room, without touching the systems: a realistic scenario unfolds (ransomware on a Friday evening, the accountant's mailbox compromised) and everyone says what they would do. In two hours, the gaps in the plan appear: who decides, how to communicate, where the backups are. It is the best-yielding exercise for a management team.
How do we get employees to report their mistakes?
- By never punishing a report, even a late one. An employee who clicked and says so within a minute allows action before the damage; one who is afraid stays silent and the attacker gains days. A simple report button, a fast response and a public thank-you to those who report build that reflex better than any policy.
Do I need a written security policy?
- Yes, short and read: a few pages that say what is expected (passwords, multi-factor authentication, devices, data sharing, reporting) and what is forbidden. It serves as the reference for training, employment contracts and audits, and insurers and customers often require it. A forty-page policy nobody reads protects nothing.
How do we build security into a new employee's onboarding?
- Accounts created with the access of their role only, multi-factor authentication enabled before the first login, a password manager provided, a managed and encrypted device, the security policy signed and a thirty-minute training in the first week. This documented path is also the template for the offboarding process.
Can my employees use generative AI tools at work?
- Yes, with rules: no personal information, trade secret or customer data in a consumer tool; a preference for business editions whose data is not used for training; and verification of the results before use. Attackers also use these tools to write flawless phishing emails, which makes vigilance more necessary.
How do we know whether the training works?
- Through simple measures tracked over time: click rate and above all report rate during simulations, the delay between a test email and the first report, the number of incidents avoided thanks to an employee, adoption of multi-factor authentication and of the password manager. A rising report rate is worth more than a falling click rate.
Which daily habits make the difference?
- Locking the workstation when standing up, checking the sender before clicking, never approving an authentication prompt you did not trigger, confirming every banking change by phone, restarting to apply updates, and reporting what looks odd. None requires technical skill; all close a door attackers use.
Your question is not here?
Write or call: a human answer, and a proposed first step if you want one.