A useful cybersecurity review starts with evidence. Can you show that important accounts have the intended protection, that devices receive updates and that someone knows what to do when a problem is reported?
Use this checklist to organise a conversation with your IT provider or the person responsible for technology. For each item, record “verified,” “needs work” or “unknown,” along with an owner and a next action. Treat unknowns as tasks to investigate, not proof that an incident has occurred.
This is a practical starting point for a small business in Toronto or the GTA. It is not a security audit, certification or assurance of compliance. Businesses handling sensitive information or meeting industry-specific obligations may need a more detailed assessment.
1. Identify important systems and their owners
Create a working list of business accounts, devices, applications and information stores. The Canadian Centre for Cyber Security’s baseline guidance recommends identifying the technology in scope and assessing the potential harm if information is exposed, altered or unavailable. Canadian baseline controls
For your review, start with five systems you would need tomorrow morning. Beside each, write the business owner and the support contact. Include a way to reach help if your normal email system is unavailable.
2. Verify multifactor authentication
Multifactor authentication, or MFA, requires more than a password to prove who is signing in. Microsoft Entra supports several methods, including authenticator apps and passkeys. Microsoft MFA overview
Ask your provider to show which important accounts are covered by the intended policy, and compare your setup with these Microsoft 365 security basics, not just which users have registered a phone. Include administrators and remote access. Review exceptions and account recovery arrangements so a lost phone does not leave the business improvising access.
3. Improve how passwords are managed
Use a different strong password or passphrase for each account that requires one. A password manager can help employees manage unique credentials instead of reusing them. Canadian password guidance
Ask where the business currently stores shared credentials. If the answer includes an unprotected spreadsheet or a departing employee’s personal account, assign someone to review the arrangement. Decide how authorised staff obtain access and how access is removed when responsibilities change.
4. Check update and security software status
Maintaining updates and security software is part of the Cyber Centre’s baseline guidance. Canadian baseline controls
Request an exception report: which devices are overdue, unsupported or not reporting? A statement that updates are “automatic” is less useful than knowing where that process has failed. Ask for a named owner and a completion date for each important exception, taking business application requirements into account.
5. Confirm laptop encryption
Disk encryption helps protect stored information if a laptop is lost or stolen. Windows BitLocker is designed to address this risk. Microsoft BitLocker overview
Ask for current evidence of protection and secure recovery-key handling. Do not assume a sign-in password proves the drive is protected. Identify any machines that cannot meet the intended policy and decide whether to replace them or restrict the information they hold.
6. Review who can access sensitive information
Choose a sample: payroll, customer records and one shared project folder. Ask the business owner to confirm who needs access and compare that answer with the actual permissions.
Include former employees, contractors and external guests. Check whether routine work is being performed with administrator access and whether that access is justified. Keep a record of approvals so IT does not have to guess which permissions a new employee should receive.
7. Make suspicious requests easy to report
Phishing can arrive through email, text messages, calls or other channels. It often uses apparent authority or urgency to prompt someone to reveal information or transfer money. Canadian phishing guidance
Give staff one clear reporting route. For an unexpected change to a supplier’s banking details, require verification using independently trusted contact details rather than the number in the message. Practise this with a fictional example during a team meeting. Encourage reporting even when someone has already clicked or replied.
8. Ask for a recovery demonstration
Choose one important business process and ask how its information would be recovered. Request a controlled test, a record of the result and an explanation of what is outside the backup scope.
Make the question concrete: “If this folder were unavailable tomorrow, who would restore it and how would we know the recovered version was usable?” Read our article Does Microsoft 365 Back Up Everything? for a fuller set of recovery questions.
9. Rehearse a simple incident scenario
Bring the owner, office manager and IT contact together for a short discussion. An employee reports a missing laptop containing work information. Who receives the report? Who can restrict access? Who assesses privacy implications and communicates with the employee?
Write down gaps as you discover them. The exercise is useful even if nobody knows all the answers at the start. Keep emergency contacts available somewhere other than the systems you may lose access to.
Turn the checklist into a manageable plan
Choose three improvements based on business impact and exposure. Assign an owner and a realistic deadline to each. At the next review, ask for evidence that the change works and check whether anything new has been added to the environment.
Avoid treating a total number of checked boxes as a security score. One serious gap can matter more than several completed housekeeping tasks. The purpose is to make responsibility and follow-through visible.
BlinkNetworks provides cybersecurity and managed IT services for growing businesses across Toronto and the GTA. Contact BlinkNetworks to discuss the gaps this review identifies and which improvements to prioritise.