Cyber Risk Office — Executive Cyber Risk Leadership

Resources

Practical checklists for Canadian business leaders.

Short, business-language checklists to help you prepare for insurance renewal, prevent payment fraud, and reduce ransomware risk. Each one leads back to the Cyber Risk Office Scorecard.

Check Your Cyber Risk

Small-Business Cyber Readiness Checklist

Ten fundamentals every Canadian SMB should have in place.

  • Multi-factor authentication on email and admin accounts
  • Secure administrator accounts (separate admin identities)
  • Employee cybersecurity awareness program
  • Tested backups with a proven restore
  • Documented incident-response contacts
  • Cyber insurance preparation
  • Documented vendor access list
  • Written security and acceptable-use policies
  • Microsoft 365 or Google Workspace security review
  • Payment-verification procedures
Check Your Cyber Risk

Email & Payment Fraud Prevention Checklist

Reduce business email compromise and invoice-fraud risk with process, not just tools.

  • Independently verify banking-information changes
  • Never rely only on email for urgent payments
  • Use two-person approval for significant transactions
  • Verify unusual requests using a known phone number
  • Review mailbox forwarding rules regularly
  • Protect email with multi-factor authentication
  • Train employees to recognize impersonation
  • Documented process for reporting suspicious requests
Check Your Cyber Risk

Cyber Insurance Renewal Checklist

Prepare accurate answers before your next cyber insurance questionnaire.

  • Multi-factor authentication across mailboxes and admin accounts
  • Endpoint protection deployed and monitored
  • Reliable, isolated backups
  • Documented restoration testing
  • Employee cybersecurity training
  • Incident-response planning
  • Administrator access controls
  • Vendor oversight
  • Security monitoring in place
  • Accurate insurer questionnaire responses
Check Your Cyber Risk

Ransomware Readiness Checklist

What to have in place before ransomware, not after.

  • Identify critical systems and dependencies
  • Maintain protected, isolated backups
  • Test restoration on a schedule
  • Define leadership roles for a cyber incident
  • Maintain emergency contacts (IT, insurer, legal, IR)
  • Business-continuity procedures documented
  • Employee communication plan for downtime
  • Review insurance notification requirements
  • Identify qualified incident-response support in advance
Check Your Cyber Risk

Cybersecurity Due-Diligence Checklist for Business Transactions

Buying a business, investing in a company, entering a partnership, or selecting a critical supplier can introduce hidden cybersecurity and privacy risks. Use this checklist to identify important questions before completing the transaction.

  • Ownership of systems and data
  • Previous cybersecurity incidents
  • Privacy complaints or investigations
  • Cyber insurance claims history
  • Current security policies
  • Employee and contractor access
  • Software licences
  • Cloud accounts and administrator credentials
  • Backups and recovery capability
  • Vendor contracts and security obligations
  • Customer security obligations
  • Regulatory requirements
  • Penetration-testing history
  • Known vulnerabilities
  • Pending security projects
  • Incident-response arrangements
  • Data-retention practices
  • Intellectual property protection
  • Estimated cost of required remediation
Request a Cyber Due-Diligence Review