[{"data":1,"prerenderedAt":545},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"post-\u002Fen\u002Fblog\u002Fsmall-business-cybersecurity-budget":45,"post-alt-\u002Fen\u002Fblog\u002Fsmall-business-cybersecurity-budget":523,"post-rel-\u002Fen\u002Fblog\u002Fsmall-business-cybersecurity-budget":525},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":46,"title":47,"body":48,"category":242,"date":475,"description":476,"extension":477,"faq":478,"keyword":491,"meta":492,"minutes":23,"navigation":418,"path":493,"rawbody":494,"seo":495,"sources":496,"stem":515,"tags":516,"translationKey":517,"updated":521,"__hash__":522},"blog_en\u002Fen\u002Fblog\u002Fsmall-business-cybersecurity-budget.md","Small Business Cybersecurity Budget: What to Fund First",{"type":49,"value":50,"toc":466},"minimark",[51,55,58,61,82,87,90,93,145,148,160,163,167,170,187,190,194,197,236,239,243,247,250,279,282,286,289,318,321,397,400,404,407,457,460,463],[52,53,54],"p",{},"November is budget season. The managing partner of a 25-person architecture firm in Montréal’s Mile End has three documents on her desk. A product list from her IT provider. The insurer’s renewal questionnaire, which now requires multi-factor authentication. And an email from a large client asking about her “cybersecurity measures.”",[52,56,57],{},"Her question is simple: “What’s a reasonable amount to spend on this?”",[52,59,60],{},"You will find percentage-of-IT-budget rules online. They rest on very different methods and company profiles, and they say nothing about your own risks. We suggest a method instead: start from your risks, then fund in tiers.",[62,63,66],"callout",{"title":64,"type":65},"TL;DR","tip",[67,68,69,73,76,79],"ul",{},[70,71,72],"li",{},"A good security budget starts from your risks, not a generic percentage.",[70,74,75],{},"First turn on what you already pay for (tier 0), then fund the recurring essentials (tier 1).",[70,77,78],{},"Next, verify that your controls actually work (tier 2) and put governance in place (tier 3).",[70,80,81],{},"To win over leadership, compare the budget with the cost of a realistic incident for your business.",[83,84,86],"h2",{"id":85},"start-from-risk-not-a-percentage","Start from risk, not a percentage",[52,88,89],{},"The risk is real for Canadian small businesses. According to a 2025 Coalition study, 86% of small Canadian businesses had experienced a cybersecurity event in the last five years, yet 77% believed they were too small to be targeted. In Québec, a KPMG survey published in October 2023 found that more than six in ten SMEs had been hit by a cyberattack in the previous year, and 65% lacked qualified staff to manage the risk.",[52,91,92],{},"The cost of an incident gives you a first order of magnitude. Here are the average costs for Canadian SMEs, according to industry data cited by Insurance Business Canada (October 2025):",[94,95,96,109],"table",{},[97,98,99],"thead",{},[100,101,102,106],"tr",{},[103,104,105],"th",{},"Type of incident",[103,107,108],{},"Average cost cited",[110,111,112,121,129,137],"tbody",{},[100,113,114,118],{},[115,116,117],"td",{},"Phishing",[115,119,120],{},"$89,000",[100,122,123,126],{},[115,124,125],{},"Wire transfer fraud",[115,127,128],{},"$118,000",[100,130,131,134],{},[115,132,133],{},"Data breach",[115,135,136],{},"$220,000",[100,138,139,142],{},[115,140,141],{},"Ransomware",[115,143,144],{},"$330,000",[52,146,147],{},"Before you pick a single product, answer three questions with your leadership team:",[149,150,151,154,157],"ol",{},[70,152,153],{},"Which system outage would cripple the business within a week?",[70,155,156],{},"Which data would do the most damage if it leaked: client records, employee files, project plans?",[70,158,159],{},"What do your insurers, your clients and the law already require?",[52,161,162],{},"The answers set your priorities. A clinic protects patient records first; a manufacturer protects production.",[83,164,166],{"id":165},"tier-0-turn-on-what-you-already-pay-for","Tier 0: turn on what you already pay for",[52,168,169],{},"The first tier costs mostly time. Many small businesses pay for Microsoft 365 or Google Workspace licences whose security features sit unused.",[67,171,172,175,178,181,184],{},[70,173,174],{},"Turn on multi-factor authentication for every account, starting with administrators.",[70,176,177],{},"Set up SPF, DKIM and DMARC to make it harder to spoof your domain.",[70,179,180],{},"Enable automatic updates for workstations, browsers and software.",[70,182,183],{},"Remove administrator rights from everyday accounts.",[70,185,186],{},"Disable former employees’ accounts and unused access.",[52,188,189],{},"The Canadian Centre for Cyber Security publishes its baseline controls for small and medium organizations for free. They are designed around the 80\u002F20 rule: get 80% of the benefit with 20% of the effort. It is an excellent starting list for this tier.",[83,191,193],{"id":192},"tier-1-the-recurring-essentials","Tier 1: the recurring essentials",[52,195,196],{},"This tier becomes a fixed budget line, often billed per user per month.",[67,198,199,206,212,224,230],{},[70,200,201,205],{},[202,203,204],"strong",{},"A business password manager",", to put an end to reused passwords.",[70,207,208,211],{},[202,209,210],{},"Endpoint detection and response (EDR)",", which flags suspicious behaviour, not just known viruses.",[70,213,214,217,218,223],{},[202,215,216],{},"Backups"," following the ",[219,220,222],"a",{"href":221},"\u002Fen\u002Fblog\u002F3-2-1-1-0-backup-rule-ransomware","3-2-1-1-0 rule",", including for Microsoft 365 or Google Workspace, with an offline or immutable copy.",[70,225,226,229],{},[202,227,228],{},"Email filtering"," against phishing and malicious attachments.",[70,231,232,235],{},[202,233,234],{},"Staff training",", short and repeated, rather than one annual presentation.",[52,237,238],{},"Ask your IT provider what is already included in your licences before buying a separate tool. Sometimes a licence upgrade costs less than two separate products. And count your users carefully: contractors, shared mailboxes and seasonal staff are often forgotten in the estimate, then show up on the invoice.",[240,241],"cta",{"variant":242},"audit",[83,244,246],{"id":245},"tier-2-verify-that-it-holds","Tier 2: verify that it holds",[52,248,249],{},"Buying tools does not prove they are configured properly. This tier is made of one-time expenses, planned across the year.",[67,251,252,262,273],{},[70,253,254,261],{},[202,255,256,257],{},"A ",[219,258,260],{"href":259},"\u002Fen\u002Fblog\u002Fcybersecurity-audit-small-business-quebec","cybersecurity audit"," every year or two, to measure the gap between what is planned and what is actually in place.",[70,263,264,267,268,272],{},[202,265,266],{},"A penetration test"," when you expose services to the internet or a client asks for one. Canadian vendors publish very wide ranges, from a few thousand to several tens of thousands of dollars depending on scope (for example, Packetlabs, August 2026); a small external test sits at the low end. Our article on ",[219,269,271],{"href":270},"\u002Fen\u002Fblog\u002Fpenetration-testing-cost-quebec","penetration testing costs"," explains what drives the price. Every test requires the business’s written authorization (Criminal Code, s. 342.1).",[70,274,275,278],{},[202,276,277],{},"A phishing simulation",", to measure whether the training is working.",[52,280,281],{},"Schedule these ahead of your insurance renewal or a major client review, so the results are in hand when the questions arrive.",[83,283,285],{"id":284},"tier-3-govern-and-prepare","Tier 3: govern and prepare",[52,287,288],{},"The last tier keeps you on course and helps you react fast on the day everything else fails.",[67,290,291,297,303],{},[70,292,293,296],{},[202,294,295],{},"A written incident response plan",", with the numbers to call, tested once a year.",[70,298,299,302],{},[202,300,301],{},"Cyber insurance"," that fits your activities. Read the exclusions and the notice conditions.",[70,304,305,308,309,312,313,317],{},[202,306,307],{},"Governance support",", such as a part-time vCISO, to track the plan, handle client security questionnaires and report to leadership. Our ",[219,310,311],{"href":25},"ongoing security partner service"," is built for this. To compare options, see ",[219,314,316],{"href":315},"\u002Fen\u002Fcomparisons\u002Fmsp-vs-mssp-vs-vciso-vs-in-house","MSP vs MSSP vs vCISO vs in-house",".",[52,319,320],{},"In summary:",[94,322,323,339],{},[97,324,325],{},[100,326,327,330,333,336],{},[103,328,329],{},"Tier",[103,331,332],{},"Examples",[103,334,335],{},"Type of spending",[103,337,338],{},"When to start",[110,340,341,355,369,383],{},[100,342,343,346,349,352],{},[115,344,345],{},"0 — Turn on",[115,347,348],{},"MFA, DMARC, updates, admin rights",[115,350,351],{},"Internal or IT provider time",[115,353,354],{},"Now",[100,356,357,360,363,366],{},[115,358,359],{},"1 — Essentials",[115,361,362],{},"Password manager, EDR, backups, filtering, training",[115,364,365],{},"Recurring, per user",[115,367,368],{},"Within three months",[100,370,371,374,377,380],{},[115,372,373],{},"2 — Verify",[115,375,376],{},"Audit, penetration test, phishing simulation",[115,378,379],{},"One-time, planned",[115,381,382],{},"Once tiers 0 and 1 are in place",[100,384,385,388,391,394],{},[115,386,387],{},"3 — Govern",[115,389,390],{},"Response plan, insurance, vCISO",[115,392,393],{},"Recurring or flat fee",[115,395,396],{},"In parallel, as requirements dictate",[52,398,399],{},"What can usually wait? Tools that nobody has time to watch. A log platform that generates alerts no one reads, or a formal certification pursued before multi-factor authentication is even turned on, consumes budget without lowering risk much. The same goes for overlapping products: two antivirus tools or three backup services usually mean gaps in configuration, not extra protection. Fund the lower tiers first, then climb.",[83,401,403],{"id":402},"presenting-the-budget-to-leadership","Presenting the budget to leadership",[52,405,406],{},"Leadership approves a budget tied to a business risk far more easily than a product list.",[67,408,411,422,429,436,443,450],{"className":409},[410],"contains-task-list",[70,412,415,421],{"className":413},[414],"task-list-item",[416,417],"input",{"disabled":418,"type":419,"aria-label":420},true,"checkbox","Name your top three risks in business terms: production shutdown, client data leak, wire fraud"," Name your top three risks in business terms: production shutdown, client data leak, wire fraud",[70,423,425,428],{"className":424},[414],[416,426],{"disabled":418,"type":419,"aria-label":427},"Tie each expense to a risk and a tier"," Tie each expense to a risk and a tier",[70,430,432,435],{"className":431},[414],[416,433],{"disabled":418,"type":419,"aria-label":434},"Compare the total with the cost of a realistic incident, plus the days of downtime"," Compare the total with the cost of a realistic incident, plus the days of downtime",[70,437,439,442],{"className":438},[414],[416,440],{"disabled":418,"type":419,"aria-label":441},"Show what your insurers and clients already require"," Show what your insurers and clients already require",[70,444,446,449],{"className":445},[414],[416,447],{"disabled":418,"type":419,"aria-label":448},"Lay out a 12-month calendar with a quarterly check-in"," Lay out a 12-month calendar with a quarterly check-in",[70,451,453,456],{"className":452},[414],[416,454],{"disabled":418,"type":419,"aria-label":455},"Pick two or three simple indicators: MFA coverage, tested backups, patches up to date"," Pick two or three simple indicators: MFA coverage, tested backups, patches up to date",[52,458,459],{},"Time is a cost too. According to a CDW study published in 2025, small Canadian organizations took an average of 6.8 days to detect an incident and 25.7 days to recover. Nearly a month of disruption is an argument every leadership team understands.",[52,461,462],{},"If you want a prioritized, costed list for your own business, a detailed quote is the simplest place to start.",[240,464],{"variant":465},"devis",{"title":467,"searchDepth":11,"depth":15,"links":468},"",[469,470,471,472,473,474],{"id":85,"depth":11,"text":86},{"id":165,"depth":11,"text":166},{"id":192,"depth":11,"text":193},{"id":245,"depth":11,"text":246},{"id":284,"depth":11,"text":285},{"id":402,"depth":11,"text":403},"2026-10-24","How much should a small business spend on cybersecurity? A tiered method to build a realistic budget, prioritize spending and get buy-in from leadership.","md",[479,482,485,488],{"q":480,"a":481},"Is there a standard percentage of the IT budget to spend on security?","Various percentage rules circulate, but they rest on very different methods and company profiles. None of them accounts for your data, your obligations or your risk tolerance. A budget built from your main risks, tier by tier, is much easier to justify.",{"q":483,"a":484},"Can cyber insurance replace security spending?","No. Insurance transfers part of the financial cost of an incident, but it does not prevent downtime or the loss of client trust. Insurers also increasingly require basic controls, such as multi-factor authentication and tested backups, before they will offer coverage.",{"q":486,"a":487},"Should we hire in-house security staff or use a provider?","For a business under 50 employees, a full-time security position is often hard to justify. A combination of an IT provider for day-to-day operations and part-time or ongoing support for governance often buys more expertise for the same money. The right mix depends on how complex your systems are and what compliance demands you face.",{"q":489,"a":490},"How often should the security budget be reviewed?","At least once a year, alongside the general budget, and after any major event: an incident, a demanding new client, a change of core software, an insurance renewal. A quarterly check on planned actions keeps the budget from gathering dust.","small business cybersecurity budget",{},"\u002Fen\u002Fblog\u002Fsmall-business-cybersecurity-budget","---\ntitle: \"Small Business Cybersecurity Budget: What to Fund First\"\ndescription: \"How much should a small business spend on cybersecurity? A tiered method to build a realistic budget, prioritize spending and get buy-in from leadership.\"\ndate: 2026-10-24\ncategory: audit\ntags: [\"budget\", \"small business\", \"governance\", \"planning\"]\ntranslationKey: budget\nkeyword: \"small business cybersecurity budget\"\nfaq:\n  - q: \"Is there a standard percentage of the IT budget to spend on security?\"\n    a: \"Various percentage rules circulate, but they rest on very different methods and company profiles. None of them accounts for your data, your obligations or your risk tolerance. A budget built from your main risks, tier by tier, is much easier to justify.\"\n  - q: \"Can cyber insurance replace security spending?\"\n    a: \"No. Insurance transfers part of the financial cost of an incident, but it does not prevent downtime or the loss of client trust. Insurers also increasingly require basic controls, such as multi-factor authentication and tested backups, before they will offer coverage.\"\n  - q: \"Should we hire in-house security staff or use a provider?\"\n    a: \"For a business under 50 employees, a full-time security position is often hard to justify. A combination of an IT provider for day-to-day operations and part-time or ongoing support for governance often buys more expertise for the same money. The right mix depends on how complex your systems are and what compliance demands you face.\"\n  - q: \"How often should the security budget be reviewed?\"\n    a: \"At least once a year, alongside the general budget, and after any major event: an incident, a demanding new client, a change of core software, an insurance renewal. A quarterly check on planned actions keeps the budget from gathering dust.\"\nsources:\n  - title: \"Canadian Centre for Cyber Security — Baseline cyber security controls for small and medium organizations\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fbaseline-cyber-security-controls-small-and-medium-organizations\"\n  - title: \"Canadian Underwriter — Canadian small businesses underestimate cyber risk (Coalition, July 2025)\"\n    url: \"https:\u002F\u002Fcanadianunderwriter.ca\u002F2025\u002F07\u002F16\u002Fcanadian-small-businesses-underestimate-cyber-risk-study-finds\u002F\"\n  - title: \"KPMG (via Newswire) — Cybercrime hit more than six in ten Québec SMEs in the past year (Oct. 2023, French)\"\n    url: \"https:\u002F\u002Fwww.newswire.ca\u002Ffr\u002Fnews-releases\u002Fla-cybercriminalite-a-touche-plus-de-six-petites-et-moyennes-entreprises-quebecoises-sur-dix-au-cours-de-la-derniere-annee-894649671.html\"\n  - title: \"Insurance Business Canada — AI-powered attacks push cyber risks higher for Canada's SMEs (October 2025)\"\n    url: \"https:\u002F\u002Fwww.insurancebusinessmag.com\u002Fca\u002Fnews\u002Fcyber\u002Faipowered-attacks-push-cyber-risks-higher-for-canadas-smes-zensurance-551828.aspx\"\n  - title: \"CDW Canada — IT and cybersecurity trends for small businesses in Canada (2025)\"\n    url: \"https:\u002F\u002Fwww.cdw.ca\u002Fcontent\u002Fcdwca\u002Fen\u002Farticles\u002Fsecurity\u002Fit-and-cybersecurity-trends-for-small-businesses-in-canada.html\"\n  - title: \"Packetlabs — Guide to the average cost of a pentest in Canada (August 2026)\"\n    url: \"https:\u002F\u002Fwww.packetlabs.net\u002Fposts\u002Fguide-to-the-average-cost-of-a-pentest-in-canada\u002F\"\n---\n\nNovember is budget season. The managing partner of a 25-person architecture firm in Montréal’s Mile End has three documents on her desk. A product list from her IT provider. The insurer’s renewal questionnaire, which now requires multi-factor authentication. And an email from a large client asking about her “cybersecurity measures.”\n\nHer question is simple: “What’s a reasonable amount to spend on this?”\n\nYou will find percentage-of-IT-budget rules online. They rest on very different methods and company profiles, and they say nothing about your own risks. We suggest a method instead: start from your risks, then fund in tiers.\n\n::callout{type=\"tip\" title=\"TL;DR\"}\n- A good security budget starts from your risks, not a generic percentage.\n- First turn on what you already pay for (tier 0), then fund the recurring essentials (tier 1).\n- Next, verify that your controls actually work (tier 2) and put governance in place (tier 3).\n- To win over leadership, compare the budget with the cost of a realistic incident for your business.\n::\n\n## Start from risk, not a percentage\n\nThe risk is real for Canadian small businesses. According to a 2025 Coalition study, 86% of small Canadian businesses had experienced a cybersecurity event in the last five years, yet 77% believed they were too small to be targeted. In Québec, a KPMG survey published in October 2023 found that more than six in ten SMEs had been hit by a cyberattack in the previous year, and 65% lacked qualified staff to manage the risk.\n\nThe cost of an incident gives you a first order of magnitude. Here are the average costs for Canadian SMEs, according to industry data cited by Insurance Business Canada (October 2025):\n\n| Type of incident | Average cost cited |\n|---|---|\n| Phishing | $89,000 |\n| Wire transfer fraud | $118,000 |\n| Data breach | $220,000 |\n| Ransomware | $330,000 |\n\nBefore you pick a single product, answer three questions with your leadership team:\n\n1. Which system outage would cripple the business within a week?\n2. Which data would do the most damage if it leaked: client records, employee files, project plans?\n3. What do your insurers, your clients and the law already require?\n\nThe answers set your priorities. A clinic protects patient records first; a manufacturer protects production.\n\n## Tier 0: turn on what you already pay for\n\nThe first tier costs mostly time. Many small businesses pay for Microsoft 365 or Google Workspace licences whose security features sit unused.\n\n- Turn on multi-factor authentication for every account, starting with administrators.\n- Set up SPF, DKIM and DMARC to make it harder to spoof your domain.\n- Enable automatic updates for workstations, browsers and software.\n- Remove administrator rights from everyday accounts.\n- Disable former employees’ accounts and unused access.\n\nThe Canadian Centre for Cyber Security publishes its baseline controls for small and medium organizations for free. They are designed around the 80\u002F20 rule: get 80% of the benefit with 20% of the effort. It is an excellent starting list for this tier.\n\n## Tier 1: the recurring essentials\n\nThis tier becomes a fixed budget line, often billed per user per month.\n\n- **A business password manager**, to put an end to reused passwords.\n- **Endpoint detection and response (EDR)**, which flags suspicious behaviour, not just known viruses.\n- **Backups** following the [3-2-1-1-0 rule](\u002Fen\u002Fblog\u002F3-2-1-1-0-backup-rule-ransomware), including for Microsoft 365 or Google Workspace, with an offline or immutable copy.\n- **Email filtering** against phishing and malicious attachments.\n- **Staff training**, short and repeated, rather than one annual presentation.\n\nAsk your IT provider what is already included in your licences before buying a separate tool. Sometimes a licence upgrade costs less than two separate products. And count your users carefully: contractors, shared mailboxes and seasonal staff are often forgotten in the estimate, then show up on the invoice.\n\n::cta{variant=\"audit\"}\n::\n\n## Tier 2: verify that it holds\n\nBuying tools does not prove they are configured properly. This tier is made of one-time expenses, planned across the year.\n\n- **A [cybersecurity audit](\u002Fen\u002Fblog\u002Fcybersecurity-audit-small-business-quebec)** every year or two, to measure the gap between what is planned and what is actually in place.\n- **A penetration test** when you expose services to the internet or a client asks for one. Canadian vendors publish very wide ranges, from a few thousand to several tens of thousands of dollars depending on scope (for example, Packetlabs, August 2026); a small external test sits at the low end. Our article on [penetration testing costs](\u002Fen\u002Fblog\u002Fpenetration-testing-cost-quebec) explains what drives the price. Every test requires the business’s written authorization (Criminal Code, s. 342.1).\n- **A phishing simulation**, to measure whether the training is working.\n\nSchedule these ahead of your insurance renewal or a major client review, so the results are in hand when the questions arrive.\n\n## Tier 3: govern and prepare\n\nThe last tier keeps you on course and helps you react fast on the day everything else fails.\n\n- **A written incident response plan**, with the numbers to call, tested once a year.\n- **Cyber insurance** that fits your activities. Read the exclusions and the notice conditions.\n- **Governance support**, such as a part-time vCISO, to track the plan, handle client security questionnaires and report to leadership. Our [ongoing security partner service](\u002Fen\u002Fservices\u002Fongoing-security-partner) is built for this. To compare options, see [MSP vs MSSP vs vCISO vs in-house](\u002Fen\u002Fcomparisons\u002Fmsp-vs-mssp-vs-vciso-vs-in-house).\n\nIn summary:\n\n| Tier | Examples | Type of spending | When to start |\n|---|---|---|---|\n| 0 — Turn on | MFA, DMARC, updates, admin rights | Internal or IT provider time | Now |\n| 1 — Essentials | Password manager, EDR, backups, filtering, training | Recurring, per user | Within three months |\n| 2 — Verify | Audit, penetration test, phishing simulation | One-time, planned | Once tiers 0 and 1 are in place |\n| 3 — Govern | Response plan, insurance, vCISO | Recurring or flat fee | In parallel, as requirements dictate |\n\nWhat can usually wait? Tools that nobody has time to watch. A log platform that generates alerts no one reads, or a formal certification pursued before multi-factor authentication is even turned on, consumes budget without lowering risk much. The same goes for overlapping products: two antivirus tools or three backup services usually mean gaps in configuration, not extra protection. Fund the lower tiers first, then climb.\n\n## Presenting the budget to leadership\n\nLeadership approves a budget tied to a business risk far more easily than a product list.\n\n- [ ] Name your top three risks in business terms: production shutdown, client data leak, wire fraud\n- [ ] Tie each expense to a risk and a tier\n- [ ] Compare the total with the cost of a realistic incident, plus the days of downtime\n- [ ] Show what your insurers and clients already require\n- [ ] Lay out a 12-month calendar with a quarterly check-in\n- [ ] Pick two or three simple indicators: MFA coverage, tested backups, patches up to date\n\nTime is a cost too. According to a CDW study published in 2025, small Canadian organizations took an average of 6.8 days to detect an incident and 25.7 days to recover. Nearly a month of disruption is an argument every leadership team understands.\n\nIf you want a prioritized, costed list for your own business, a detailed quote is the simplest place to start.\n\n::cta{variant=\"devis\"}\n::\n",{"title":47,"description":476},[497,500,503,506,509,512],{"title":498,"url":499},"Canadian Centre for Cyber Security — Baseline cyber security controls for small and medium organizations","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fbaseline-cyber-security-controls-small-and-medium-organizations",{"title":501,"url":502},"Canadian Underwriter — Canadian small businesses underestimate cyber risk (Coalition, July 2025)","https:\u002F\u002Fcanadianunderwriter.ca\u002F2025\u002F07\u002F16\u002Fcanadian-small-businesses-underestimate-cyber-risk-study-finds\u002F",{"title":504,"url":505},"KPMG (via Newswire) — Cybercrime hit more than six in ten Québec SMEs in the past year (Oct. 2023, French)","https:\u002F\u002Fwww.newswire.ca\u002Ffr\u002Fnews-releases\u002Fla-cybercriminalite-a-touche-plus-de-six-petites-et-moyennes-entreprises-quebecoises-sur-dix-au-cours-de-la-derniere-annee-894649671.html",{"title":507,"url":508},"Insurance Business Canada — AI-powered attacks push cyber risks higher for Canada's SMEs (October 2025)","https:\u002F\u002Fwww.insurancebusinessmag.com\u002Fca\u002Fnews\u002Fcyber\u002Faipowered-attacks-push-cyber-risks-higher-for-canadas-smes-zensurance-551828.aspx",{"title":510,"url":511},"CDW Canada — IT and cybersecurity trends for small businesses in Canada (2025)","https:\u002F\u002Fwww.cdw.ca\u002Fcontent\u002Fcdwca\u002Fen\u002Farticles\u002Fsecurity\u002Fit-and-cybersecurity-trends-for-small-businesses-in-canada.html",{"title":513,"url":514},"Packetlabs — Guide to the average cost of a pentest in Canada (August 2026)","https:\u002F\u002Fwww.packetlabs.net\u002Fposts\u002Fguide-to-the-average-cost-of-a-pentest-in-canada\u002F","en\u002Fblog\u002Fsmall-business-cybersecurity-budget",[517,518,519,520],"budget","small business","governance","planning",null,"1UizGQmwFirspRy8QfqBKxBiQo6U63lGhxzK8TjOK9A",{"path":524},"\u002Fblogue\u002Fbudget-cybersecurite-pme",[526,533,537],{"path":527,"title":528,"description":529,"category":242,"minutes":27,"tags":530},"\u002Fen\u002Fblog\u002Fbusiness-continuity-plan-cyberattack","Business Continuity Plan After a Cyberattack: A Template","Critical processes, RTO and RPO, manual workarounds: a practical business continuity plan template so your small business keeps serving clients after an attack.",[531,532,518,520],"business continuity","ransomware",{"path":259,"title":534,"description":535,"category":242,"minutes":27,"tags":536},"Small Business Cybersecurity Audit: Steps, Timeline and Cost","What a cybersecurity audit for a Quebec small business involves: the five steps, a realistic timeline, what drives the cost and how to prepare for it.",[242,518,519],{"path":538,"title":539,"description":540,"category":541,"minutes":23,"tags":542},"\u002Fen\u002Fblog\u002Fnist-csf-2-small-business","NIST CSF 2.0 for Small Business: The Six Functions Explained","NIST CSF 2.0 explained for Canadian small businesses: the six functions including Govern, the NIST quick-start guide and how to build a target profile.","compliance",[543,519,544,518],"nist csf","security framework",1792972906017]