HowyGuard

Cyber insurance checklist for therapists and counsellors

Howy the walrus holding a clipboard with a checklist

Set up two-step sign-in on your email and your notes system, encrypt your laptop, turn on automatic updates, check your antivirus, keep a backup you unplug, set up DMARC on your email domain, and list anyone outside who can log in. Each item below links to the steps, and to how to save proof it's done.

This is the list of things to set up in a counselling business, one at a time.

The checklist

  1. Two-step sign-in on your email. Every inbox you use for clients, including any old or shared ones. Google Workspace, Microsoft 365, or a personal Gmail or Outlook.com address.
  2. Two-step sign-in on your notes and booking system. Look in that system's account or security settings for two-step sign-in, and turn it on for every user. If you can't find it, ask the company.
  3. Encryption on every computer. Turn on FileVault or BitLocker, and set a passcode on any phone that gets work email.
  4. Automatic updates. Turn them on in Windows and macOS.
  5. Antivirus. Check it's on on each computer.
  6. A backup you unplug. Set up File History or Time Machine on a drive, then test a restore.
  7. DMARC on your email domain. Google Workspace or Microsoft 365.
  8. A list of outside logins. Anyone who set up your website, computer or software. Make the list.
  9. Admin and remote access. Turn off remote access you don't use.
  10. A call-back rule for payments. Phone before any bank detail change.
  11. A one-page plan for a bad day. Write it.
  12. Yearly training for anyone else who uses your email. Set it up.

How to show it's done

Take a dated screenshot as you finish each item, and keep them in one folder with your policy. Leave client names out of every picture. How to save proof shows what each screenshot needs.

Common questions

I use a personal Gmail address for clients. Can I still do this?

You can turn on two-step sign-in (item 1). You can't set up DMARC (item 7), because the domain belongs to Google. For that, you need an address on your own domain first.

My records system is online. Do I still need a backup?

Yes, for everything else on your computer. Ask the records company in writing how they back up your files, and keep their answer in your proof folder.

I work alone. Can I skip the training item?

If nobody else uses your email, yes. Do the course yourself anyway if your form asks about training.

Sources

  1. Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizationscyber.gc.ca
  2. Get Cyber Safe: Get Cyber Safe guide for small businessesgetcybersafe.gc.ca

Related