[{"data":1,"prerenderedAt":564},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"post-\u002Fen\u002Fblog\u002Fcybersecurity-audit-small-business-quebec":45,"post-alt-\u002Fen\u002Fblog\u002Fcybersecurity-audit-small-business-quebec":541,"post-rel-\u002Fen\u002Fblog\u002Fcybersecurity-audit-small-business-quebec":543},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":46,"title":47,"body":48,"category":196,"date":495,"description":496,"extension":497,"faq":498,"keyword":511,"meta":512,"minutes":27,"navigation":381,"path":513,"rawbody":514,"seo":515,"sources":516,"stem":534,"tags":535,"translationKey":538,"updated":539,"__hash__":540},"blog_en\u002Fen\u002Fblog\u002Fcybersecurity-audit-small-business-quebec.md","Small Business Cybersecurity Audit: Steps, Timeline and Cost",{"type":49,"value":50,"toc":480},"minimark",[51,55,58,61,82,87,96,99,138,148,152,157,160,164,167,171,179,183,186,190,193,197,201,204,281,284,288,291,353,360,363,367,370,427,430,434,437,463,471,478],[52,53,54],"p",{},"\"We have good antivirus and a reliable IT guy, so we're fine.\" If you run a small business, you may have said something similar. It isn't wrong, exactly. Most organizations do have some protection in place. What they usually lack is the big picture.",[52,56,57],{},"The numbers suggest that picture matters. A KPMG survey found that more than six in ten Quebec SMBs had been hit by a cyberattack in the previous year, and 65% lacked qualified staff to manage the risk. Meanwhile, 77% of Canadian small businesses believe they are too small to be targeted (Coalition, 2025).",[52,59,60],{},"A cybersecurity audit closes the gap between how secure you feel and how secure you are. Here is how one works, how long it takes and what drives the cost.",[62,63,66],"callout",{"title":64,"type":65},"TL;DR","tip",[67,68,69,73,76,79],"ul",{},[70,71,72],"li",{},"An audit compares your actual practices against a recognized framework and produces a prioritized action plan.",[70,74,75],{},"For a business with 20 to 50 employees, expect a few weeks from kickoff to final report, and only a handful of hours of your own time.",[70,77,78],{},"Cost depends mostly on scope: headcount, locations, cloud platforms and whether technical testing is included.",[70,80,81],{},"The real deliverable isn't the report. It's the short list of fixes that cut your risk the most.",[83,84,86],"h2",{"id":85},"what-a-cybersecurity-audit-actually-looks-at","What a cybersecurity audit actually looks at",[52,88,89,90,95],{},"An audit is not an automated scan, and it isn't a penetration test, although it can include one. It's a broad assessment of your technology, your processes and your habits. If the distinction is fuzzy, our article on ",[91,92,94],"a",{"href":93},"\u002Fen\u002Fblog\u002Fsecurity-audit-vs-pentest-vs-vulnerability-scan","security audits vs pentests vs vulnerability scans"," breaks it down.",[52,97,98],{},"A solid small-business audit covers at least:",[67,100,101,108,114,120,126,132],{},[70,102,103,107],{},[104,105,106],"strong",{},"Identity and access",": who has admin rights, whether multi-factor authentication is enforced everywhere, and what happens to accounts when people leave.",[70,109,110,113],{},[104,111,112],{},"Email and collaboration",": Microsoft 365 or Google Workspace settings, phishing protection and external file sharing.",[70,115,116,119],{},[104,117,118],{},"Endpoints and servers",": patching, antivirus or EDR, laptop encryption.",[70,121,122,125],{},[104,123,124],{},"Backups",": whether an offline copy exists, and whether anyone has ever tested a restore.",[70,127,128,131],{},[104,129,130],{},"Incident readiness",": who calls whom on a Saturday morning when ransomware encrypts the file server.",[70,133,134,137],{},[104,135,136],{},"Compliance",": the security measures expected under Law 25, the incident register and the person in charge of protecting personal information.",[52,139,140,141,147],{},"The framework matters. For most small organizations, the Canadian Centre for Cyber Security's ",[91,142,146],{"href":143,"rel":144},"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fbaseline-cyber-security-controls-small-and-medium-organizations",[145],"nofollow","baseline controls"," are an excellent starting point: 13 control areas, designed for organizations with fewer than 500 employees, and free. Heavier frameworks such as ISO 27001 can come later.",[83,149,151],{"id":150},"the-five-steps-of-a-small-business-audit","The five steps of a small-business audit",[153,154,156],"h3",{"id":155},"_1-scoping","1. Scoping",[52,158,159],{},"A one-hour meeting to agree on what's in scope: which locations, systems and sensitive data. A food distributor in the West Island with a warehouse and handheld scanners has a very different footprint from a fully cloud-based design studio in the Mile End. If any technical testing is planned, this is also when written authorization gets signed.",[153,161,163],{"id":162},"_2-information-gathering","2. Information gathering",[52,165,166],{},"A questionnaire, an asset inventory and any existing documents (policies, your managed service provider contract). Then short interviews with leadership, whoever handles IT and sometimes one or two staff members. That's usually where the shared password on a sticky note turns up.",[153,168,170],{"id":169},"_3-technical-verification","3. Technical verification",[52,172,173,174,178],{},"Configuration reviews (firewall, Microsoft 365, backups), vulnerability scanning of internet-facing systems and a check of your email DNS records. Depending on the engagement, this step can include a ",[91,175,177],{"href":176},"\u002Fen\u002Fblog\u002Fpenetration-testing-cost-quebec","penetration test",".",[153,180,182],{"id":181},"_4-risk-analysis","4. Risk analysis",[52,184,185],{},"Each finding is rated on likelihood and business impact. An unencrypted laptop is far more serious at a Montreal law firm whose lawyers carry client files than at a cabinet-making shop.",[153,187,189],{"id":188},"_5-report-and-debrief","5. Report and debrief",[52,191,192],{},"An executive summary for leadership, technical detail for your IT team or provider and, most importantly, a prioritized plan: what to do this week, this quarter and this year.",[194,195],"cta",{"variant":196},"audit",[83,198,200],{"id":199},"how-long-does-it-take","How long does it take?",[52,202,203],{},"Here is a typical timeline for a business with roughly 20 to 50 employees. Treat it as an example; the real duration depends on scope and on how quickly your people respond.",[205,206,207,223],"table",{},[208,209,210],"thead",{},[211,212,213,217,220],"tr",{},[214,215,216],"th",{},"Step",[214,218,219],{},"Example timeline",[214,221,222],{},"Your time commitment",[224,225,226,238,249,260,271],"tbody",{},[211,227,228,232,235],{},[229,230,231],"td",{},"Scoping and authorization",[229,233,234],{},"Week 1",[229,236,237],{},"1 to 2 hours",[211,239,240,243,246],{},[229,241,242],{},"Information gathering and interviews",[229,244,245],{},"Weeks 1 and 2",[229,247,248],{},"3 to 5 hours, spread out",[211,250,251,254,257],{},[229,252,253],{},"Technical verification",[229,255,256],{},"Weeks 2 and 3",[229,258,259],{},"Provide access",[211,261,262,265,268],{},[229,263,264],{},"Analysis and writing",[229,266,267],{},"Week 3",[229,269,270],{},"None",[211,272,273,276,279],{},[229,274,275],{},"Report debrief",[229,277,278],{},"Week 4",[229,280,237],{},[52,282,283],{},"The biggest source of delay is rarely technical. It's waiting for access. If your provider takes ten days to create a read-only account, the schedule slips by ten days. Give them a heads-up as soon as you sign.",[83,285,287],{"id":286},"what-does-it-cost-the-factors-that-drive-price","What does it cost? The factors that drive price",[52,289,290],{},"There's no reliable public price list for small-business audits in Canada, because scope varies so much between engagements. Be wary of a flat price quoted without a single question about your environment.",[205,292,293,303],{},[208,294,295],{},[211,296,297,300],{},[214,298,299],{},"Factor",[214,301,302],{},"Effect on price",[224,304,305,313,321,329,337,345],{},[211,306,307,310],{},[229,308,309],{},"Number of employees and devices",[229,311,312],{},"More accounts and endpoints to review",[211,314,315,318],{},[229,316,317],{},"Number of physical locations",[229,319,320],{},"Each site adds network scope, sometimes travel",[211,322,323,326],{},[229,324,325],{},"Cloud platforms",[229,327,328],{},"Microsoft 365, Google Workspace, Azure or AWS each have their own settings",[211,330,331,334],{},[229,332,333],{},"Technical testing included",[229,335,336],{},"A penetration test raises the budget",[211,338,339,342],{},[229,340,341],{},"Compliance requirements",[229,343,344],{},"Law 25, insurer or defence-contract requirements mean more documentation",[211,346,347,350],{},[229,348,349],{},"Report depth",[229,351,352],{},"A simple action plan or a board-ready report",[52,354,355,356,178],{},"For a sense of scale on the testing component: Canadian vendors publish very wide ranges for a penetration test, from a few thousand to several tens of thousands of dollars depending on scope (for example, Packetlabs, August 2026), and a small external test sits at the low end. Those are indicative benchmarks, not a quote. For our own packages, see our ",[91,357,359],{"href":358},"\u002Fen\u002Fpricing","pricing page",[52,361,362],{},"Put that in perspective: according to industry data cited by Insurance Business Canada (October 2025), a phishing incident costs $89,000 on average, and a ransomware attack $330,000.",[83,364,366],{"id":365},"how-to-prepare","How to prepare",[52,368,369],{},"A well-prepared business gets a faster, cheaper and more useful audit. Before kickoff, pull together:",[67,371,374,385,392,399,406,413,420],{"className":372},[373],"contains-task-list",[70,375,378,384],{"className":376},[377],"task-list-item",[379,380],"input",{"disabled":381,"type":382,"aria-label":383},true,"checkbox","A list of current employees, plus anyone who left in the past year"," A list of current employees, plus anyone who left in the past year",[70,386,388,391],{"className":387},[377],[379,389],{"disabled":381,"type":382,"aria-label":390},"A list of your software and cloud services, including those paid by company credit card"," A list of your software and cloud services, including those paid by company credit card",[70,393,395,398],{"className":394},[377],[379,396],{"disabled":381,"type":382,"aria-label":397},"Your IT provider's contact details and service agreement"," Your IT provider's contact details and service agreement",[70,400,402,405],{"className":401},[377],[379,403],{"disabled":381,"type":382,"aria-label":404},"Your cyber insurance policy and the last questionnaire you filled out, if any"," Your cyber insurance policy and the last questionnaire you filled out, if any",[70,407,409,412],{"className":408},[377],[379,410],{"disabled":381,"type":382,"aria-label":411},"Existing policies, even incomplete ones (passwords, remote work, backups)"," Existing policies, even incomplete ones (passwords, remote work, backups)",[70,414,416,419],{"className":415},[377],[379,417],{"disabled":381,"type":382,"aria-label":418},"A network diagram, even a hand-drawn one"," A network diagram, even a hand-drawn one",[70,421,423,426],{"className":422},[377],[379,424],{"disabled":381,"type":382,"aria-label":425},"The name of the person responsible for protecting personal information"," The name of the person responsible for protecting personal information",[52,428,429],{},"Let your IT provider know, too. An audit isn't a performance review of their work, but they'll want to understand why someone is looking at their configurations. The best audits are done with them, not against them.",[83,431,433],{"id":432},"after-the-audit-from-report-to-action","After the audit: from report to action",[52,435,436],{},"A report sitting in a drawer protects nobody. The businesses that get the most out of an audit do three things:",[438,439,440,451,457],"ol",{},[70,441,442,445,446,450],{},[104,443,444],{},"They take the quick wins immediately."," Turning on MFA for everyone, disabling former employees' accounts and blocking automatic email forwarding often takes just a few hours. If you're on Microsoft 365, our ",[91,447,449],{"href":448},"\u002Fen\u002Fblog\u002Fmicrosoft-365-security-audit","15 Microsoft 365 settings to check"," are a good place to start.",[70,452,453,456],{},[104,454,455],{},"They assign one owner per action",", with a due date. Not \"IT\": a named person.",[70,458,459,462],{},[104,460,461],{},"They measure progress"," after 90 days, then re-audit the following year to compare.",[52,464,465,466,470],{},"If Law 25 is on your radar, cross-reference the action plan with our ",[91,467,469],{"href":468},"\u002Fen\u002Fblog\u002Fquebec-law-25-cybersecurity-checklist","Law 25 cybersecurity checklist",". Many fixes serve both goals.",[52,472,473,474,477],{},"Our team delivers ",[91,475,476],{"href":5},"cybersecurity audits"," sized for small and mid-sized businesses, with a plain-language action plan instead of a 200-page report.",[194,479],{"variant":196},{"title":481,"searchDepth":11,"depth":15,"links":482},"",[483,484,491,492,493,494],{"id":85,"depth":11,"text":86},{"id":150,"depth":11,"text":151,"children":485},[486,487,488,489,490],{"id":155,"depth":15,"text":156},{"id":162,"depth":15,"text":163},{"id":169,"depth":15,"text":170},{"id":181,"depth":15,"text":182},{"id":188,"depth":15,"text":189},{"id":199,"depth":11,"text":200},{"id":286,"depth":11,"text":287},{"id":365,"depth":11,"text":366},{"id":432,"depth":11,"text":433},"2026-10-24","What a cybersecurity audit for a Quebec small business involves: the five steps, a realistic timeline, what drives the cost and how to prepare for it.","md",[499,502,505,508],{"q":500,"a":501},"Is a cybersecurity audit mandatory for a small business in Quebec?","No law requires every small business to undergo a formal audit. However, Quebec's Law 25 requires reasonable security measures to protect personal information, and insurers and large customers increasingly ask for evidence. An audit is often the simplest way to document those measures; confirm your specific obligations with your legal counsel.",{"q":503,"a":504},"How often should we repeat a cybersecurity audit?","Once a year is a reasonable rhythm for most small businesses, with a lighter mid-year check-in on the action plan. You should also re-audit after any major change, such as a cloud migration, an acquisition, a new line-of-business application or a security incident.",{"q":506,"a":507},"Will an audit disrupt our day-to-day operations?","Very little. Most of the work is done through interviews, configuration reviews and read-only tools. Any more intrusive testing is scheduled with you in advance, covered by written authorization and can be done outside business hours.",{"q":509,"a":510},"How is an audit different from CyberSecure Canada certification?","An audit is a tailored diagnosis that tells you where you stand and what to fix first. CyberSecure Canada is a voluntary federal certification program: you adopt a set of baseline controls, then an accredited third-party body verifies them. An audit is often good preparation for certification.","cybersecurity audit for small business",{},"\u002Fen\u002Fblog\u002Fcybersecurity-audit-small-business-quebec","---\ntitle: \"Small Business Cybersecurity Audit: Steps, Timeline and Cost\"\ndescription: \"What a cybersecurity audit for a Quebec small business involves: the five steps, a realistic timeline, what drives the cost and how to prepare for it.\"\ndate: 2026-10-24\ncategory: audit\ntags: [\"audit\", \"small business\", \"governance\"]\ntranslationKey: audit-pme\nkeyword: \"cybersecurity audit for small business\"\nfaq:\n  - q: \"Is a cybersecurity audit mandatory for a small business in Quebec?\"\n    a: \"No law requires every small business to undergo a formal audit. However, Quebec's Law 25 requires reasonable security measures to protect personal information, and insurers and large customers increasingly ask for evidence. An audit is often the simplest way to document those measures; confirm your specific obligations with your legal counsel.\"\n  - q: \"How often should we repeat a cybersecurity audit?\"\n    a: \"Once a year is a reasonable rhythm for most small businesses, with a lighter mid-year check-in on the action plan. You should also re-audit after any major change, such as a cloud migration, an acquisition, a new line-of-business application or a security incident.\"\n  - q: \"Will an audit disrupt our day-to-day operations?\"\n    a: \"Very little. Most of the work is done through interviews, configuration reviews and read-only tools. Any more intrusive testing is scheduled with you in advance, covered by written authorization and can be done outside business hours.\"\n  - q: \"How is an audit different from CyberSecure Canada certification?\"\n    a: \"An audit is a tailored diagnosis that tells you where you stand and what to fix first. CyberSecure Canada is a voluntary federal certification program: you adopt a set of baseline controls, then an accredited third-party body verifies them. An audit is often good preparation for certification.\"\nsources:\n  - title: \"KPMG Canada: cyber crime strikes more than six in ten Quebec companies (2023, French release)\"\n    url: \"https:\u002F\u002Fwww.newswire.ca\u002Fnews-releases\u002Fcybercrime-strikes-more-than-six-in-10-quebec-small-and-medium-sized-businesses-in-the-past-year-830782346.html\"\n  - title: \"Canadian Underwriter: Canadian small businesses underestimate cyber risk (Coalition, 2025)\"\n    url: \"https:\u002F\u002Fcanadianunderwriter.ca\u002F2025\u002F07\u002F16\u002Fcanadian-small-businesses-underestimate-cyber-risk-study-finds\u002F\"\n  - title: \"Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fbaseline-cyber-security-controls-small-and-medium-organizations\"\n  - title: \"Insurance Business Canada: AI-powered attacks push cyber risks higher for Canada's SMEs (October 2025)\"\n    url: \"https:\u002F\u002Fwww.insurancebusinessmag.com\u002Fca\u002Fnews\u002Fcyber\u002Faipowered-attacks-push-cyber-risks-higher-for-canadas-smes-zensurance-551828.aspx\"\n  - title: \"Packetlabs: Guide to the average cost of a pentest in Canada (August 2026)\"\n    url: \"https:\u002F\u002Fwww.packetlabs.net\u002Fposts\u002Fguide-to-the-average-cost-of-a-pentest-in-canada\u002F\"\n  - title: \"CyberSecure Canada\"\n    url: \"https:\u002F\u002Fised-isde.canada.ca\u002Fsite\u002Fcybersecure-canada\u002Fen\"\n---\n\n\"We have good antivirus and a reliable IT guy, so we're fine.\" If you run a small business, you may have said something similar. It isn't wrong, exactly. Most organizations do have some protection in place. What they usually lack is the big picture.\n\nThe numbers suggest that picture matters. A KPMG survey found that more than six in ten Quebec SMBs had been hit by a cyberattack in the previous year, and 65% lacked qualified staff to manage the risk. Meanwhile, 77% of Canadian small businesses believe they are too small to be targeted (Coalition, 2025).\n\nA cybersecurity audit closes the gap between how secure you feel and how secure you are. Here is how one works, how long it takes and what drives the cost.\n\n::callout{type=\"tip\" title=\"TL;DR\"}\n- An audit compares your actual practices against a recognized framework and produces a prioritized action plan.\n- For a business with 20 to 50 employees, expect a few weeks from kickoff to final report, and only a handful of hours of your own time.\n- Cost depends mostly on scope: headcount, locations, cloud platforms and whether technical testing is included.\n- The real deliverable isn't the report. It's the short list of fixes that cut your risk the most.\n::\n\n## What a cybersecurity audit actually looks at\n\nAn audit is not an automated scan, and it isn't a penetration test, although it can include one. It's a broad assessment of your technology, your processes and your habits. If the distinction is fuzzy, our article on [security audits vs pentests vs vulnerability scans](\u002Fen\u002Fblog\u002Fsecurity-audit-vs-pentest-vs-vulnerability-scan) breaks it down.\n\nA solid small-business audit covers at least:\n\n- **Identity and access**: who has admin rights, whether multi-factor authentication is enforced everywhere, and what happens to accounts when people leave.\n- **Email and collaboration**: Microsoft 365 or Google Workspace settings, phishing protection and external file sharing.\n- **Endpoints and servers**: patching, antivirus or EDR, laptop encryption.\n- **Backups**: whether an offline copy exists, and whether anyone has ever tested a restore.\n- **Incident readiness**: who calls whom on a Saturday morning when ransomware encrypts the file server.\n- **Compliance**: the security measures expected under Law 25, the incident register and the person in charge of protecting personal information.\n\nThe framework matters. For most small organizations, the Canadian Centre for Cyber Security's [baseline controls](https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fbaseline-cyber-security-controls-small-and-medium-organizations) are an excellent starting point: 13 control areas, designed for organizations with fewer than 500 employees, and free. Heavier frameworks such as ISO 27001 can come later.\n\n## The five steps of a small-business audit\n\n### 1. Scoping\n\nA one-hour meeting to agree on what's in scope: which locations, systems and sensitive data. A food distributor in the West Island with a warehouse and handheld scanners has a very different footprint from a fully cloud-based design studio in the Mile End. If any technical testing is planned, this is also when written authorization gets signed.\n\n### 2. Information gathering\n\nA questionnaire, an asset inventory and any existing documents (policies, your managed service provider contract). Then short interviews with leadership, whoever handles IT and sometimes one or two staff members. That's usually where the shared password on a sticky note turns up.\n\n### 3. Technical verification\n\nConfiguration reviews (firewall, Microsoft 365, backups), vulnerability scanning of internet-facing systems and a check of your email DNS records. Depending on the engagement, this step can include a [penetration test](\u002Fen\u002Fblog\u002Fpenetration-testing-cost-quebec).\n\n### 4. Risk analysis\n\nEach finding is rated on likelihood and business impact. An unencrypted laptop is far more serious at a Montreal law firm whose lawyers carry client files than at a cabinet-making shop.\n\n### 5. Report and debrief\n\nAn executive summary for leadership, technical detail for your IT team or provider and, most importantly, a prioritized plan: what to do this week, this quarter and this year.\n\n::cta{variant=\"audit\"}\n::\n\n## How long does it take?\n\nHere is a typical timeline for a business with roughly 20 to 50 employees. Treat it as an example; the real duration depends on scope and on how quickly your people respond.\n\n| Step | Example timeline | Your time commitment |\n|---|---|---|\n| Scoping and authorization | Week 1 | 1 to 2 hours |\n| Information gathering and interviews | Weeks 1 and 2 | 3 to 5 hours, spread out |\n| Technical verification | Weeks 2 and 3 | Provide access |\n| Analysis and writing | Week 3 | None |\n| Report debrief | Week 4 | 1 to 2 hours |\n\nThe biggest source of delay is rarely technical. It's waiting for access. If your provider takes ten days to create a read-only account, the schedule slips by ten days. Give them a heads-up as soon as you sign.\n\n## What does it cost? The factors that drive price\n\nThere's no reliable public price list for small-business audits in Canada, because scope varies so much between engagements. Be wary of a flat price quoted without a single question about your environment.\n\n| Factor | Effect on price |\n|---|---|\n| Number of employees and devices | More accounts and endpoints to review |\n| Number of physical locations | Each site adds network scope, sometimes travel |\n| Cloud platforms | Microsoft 365, Google Workspace, Azure or AWS each have their own settings |\n| Technical testing included | A penetration test raises the budget |\n| Compliance requirements | Law 25, insurer or defence-contract requirements mean more documentation |\n| Report depth | A simple action plan or a board-ready report |\n\nFor a sense of scale on the testing component: Canadian vendors publish very wide ranges for a penetration test, from a few thousand to several tens of thousands of dollars depending on scope (for example, Packetlabs, August 2026), and a small external test sits at the low end. Those are indicative benchmarks, not a quote. For our own packages, see our [pricing page](\u002Fen\u002Fpricing).\n\nPut that in perspective: according to industry data cited by Insurance Business Canada (October 2025), a phishing incident costs $89,000 on average, and a ransomware attack $330,000.\n\n## How to prepare\n\nA well-prepared business gets a faster, cheaper and more useful audit. Before kickoff, pull together:\n\n- [ ] A list of current employees, plus anyone who left in the past year\n- [ ] A list of your software and cloud services, including those paid by company credit card\n- [ ] Your IT provider's contact details and service agreement\n- [ ] Your cyber insurance policy and the last questionnaire you filled out, if any\n- [ ] Existing policies, even incomplete ones (passwords, remote work, backups)\n- [ ] A network diagram, even a hand-drawn one\n- [ ] The name of the person responsible for protecting personal information\n\nLet your IT provider know, too. An audit isn't a performance review of their work, but they'll want to understand why someone is looking at their configurations. The best audits are done with them, not against them.\n\n## After the audit: from report to action\n\nA report sitting in a drawer protects nobody. The businesses that get the most out of an audit do three things:\n\n1. **They take the quick wins immediately.** Turning on MFA for everyone, disabling former employees' accounts and blocking automatic email forwarding often takes just a few hours. If you're on Microsoft 365, our [15 Microsoft 365 settings to check](\u002Fen\u002Fblog\u002Fmicrosoft-365-security-audit) are a good place to start.\n2. **They assign one owner per action**, with a due date. Not \"IT\": a named person.\n3. **They measure progress** after 90 days, then re-audit the following year to compare.\n\nIf Law 25 is on your radar, cross-reference the action plan with our [Law 25 cybersecurity checklist](\u002Fen\u002Fblog\u002Fquebec-law-25-cybersecurity-checklist). Many fixes serve both goals.\n\nOur team delivers [cybersecurity audits](\u002Fen\u002Fservices\u002Fcybersecurity-audit) sized for small and mid-sized businesses, with a plain-language action plan instead of a 200-page report.\n\n::cta{variant=\"audit\"}\n::\n",{"title":47,"description":496},[517,520,523,525,528,531],{"title":518,"url":519},"KPMG Canada: cyber crime strikes more than six in ten Quebec companies (2023, French release)","https:\u002F\u002Fwww.newswire.ca\u002Fnews-releases\u002Fcybercrime-strikes-more-than-six-in-10-quebec-small-and-medium-sized-businesses-in-the-past-year-830782346.html",{"title":521,"url":522},"Canadian Underwriter: Canadian small businesses underestimate cyber risk (Coalition, 2025)","https:\u002F\u002Fcanadianunderwriter.ca\u002F2025\u002F07\u002F16\u002Fcanadian-small-businesses-underestimate-cyber-risk-study-finds\u002F",{"title":524,"url":143},"Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations",{"title":526,"url":527},"Insurance Business Canada: AI-powered attacks push cyber risks higher for Canada's SMEs (October 2025)","https:\u002F\u002Fwww.insurancebusinessmag.com\u002Fca\u002Fnews\u002Fcyber\u002Faipowered-attacks-push-cyber-risks-higher-for-canadas-smes-zensurance-551828.aspx",{"title":529,"url":530},"Packetlabs: Guide to the average cost of a pentest in Canada (August 2026)","https:\u002F\u002Fwww.packetlabs.net\u002Fposts\u002Fguide-to-the-average-cost-of-a-pentest-in-canada\u002F",{"title":532,"url":533},"CyberSecure Canada","https:\u002F\u002Fised-isde.canada.ca\u002Fsite\u002Fcybersecure-canada\u002Fen","en\u002Fblog\u002Fcybersecurity-audit-small-business-quebec",[196,536,537],"small business","governance","audit-pme",null,"GBvxcx60FefeI87Dvlbyu-rsZob9XcxLPmFsb3eJV3c",{"path":542},"\u002Fblogue\u002Faudit-cybersecurite-pme-quebec",[544,551,557],{"path":545,"title":546,"description":547,"category":196,"minutes":27,"tags":548},"\u002Fen\u002Fblog\u002Fhow-to-choose-cybersecurity-audit-firm-quebec","How to Choose a Cybersecurity Audit Firm in Quebec: 12 Criteria","Written authorization, methodology, sample report, retest, fixed price, independence: 12 vendor-neutral criteria for choosing a cybersecurity audit firm.",[196,549,550,536],"penetration testing","vendor selection",{"path":93,"title":552,"description":553,"category":196,"minutes":23,"tags":554},"Security Audit vs Pentest vs Vulnerability Scan: Which One?","Security audit, penetration test or vulnerability scan? The real differences, what each one delivers and the order that makes sense for a growing business.",[196,555,556,536],"pentest","vulnerability scan",{"path":558,"title":559,"description":560,"category":196,"minutes":23,"tags":561},"\u002Fen\u002Fblog\u002Fsmall-business-cybersecurity-budget","Small Business Cybersecurity Budget: What to Fund First","How much should a small business spend on cybersecurity? A tiered method to build a realistic budget, prioritize spending and get buy-in from leadership.",[562,536,537,563],"budget","planning",1792971360243]