HowyGuardWhat are the cyber insurance requirements for a small business in Canada?
There's no single national list in Canada. Each insurer writes its own application form. Canadian forms commonly ask about MFA on email, backups, endpoint protection, updates, email filtering, encryption and staff training, and the Canadian Centre for Cyber Security's baseline controls for small businesses cover much the same ground.
Is there one list every Canadian insurer uses?
No. Each insurer puts its own questions on its own application form, and updates that form from time to time. The useful question is what the forms ask, and on that they agree more than they differ. The checklist goes through every item.
Two neutral Canadian sources are worth having open while you read. The Insurance Bureau of Canada publishes a cyber insurance guide and a self-assessment for small business owners. The Canadian Centre for Cyber Security publishes a set of basic security controls for small and mid-sized businesses, covering strong sign-in, backups and encryption, security software, automatic updates and staff training.
What do Canadian forms ask about MFA?
Two-step sign-in on email comes up on nearly every form. Watch for the words "enforce", "all" and "always": everyone has to use it, on every account, with no opting out. A business where most people use MFA but one inbox doesn't can't truthfully answer yes. How to turn on MFA for email.
And about backups?
Forms ask whether backups are kept offline or separate from your network, and how often you make them. Some ask for daily, some monthly, and some ask you to describe your routine. How to set up an offline backup.
Which other items come up?
| Item | How to set it up |
|---|---|
| Endpoint protection or EDR | Check your antivirus and EDR |
| Updates and patching | Keep every computer patched |
| Email filtering and DMARC | Set up email filtering and DMARC |
| Encryption | Encrypt your computers and data |
| Staff training | Set up yearly training |
| Payment checks | Verify payment requests |
| Incident response plan | Write a one-page plan |
What to do next
- Get the form your broker actually sent, and go down these items with its exact wording in front of you.
- Check each one against how your business runs today, and fix anything that isn't true yet.
Common questions
Do Canadian forms ask about EDR?
Some do, by name. Others ask for a paid endpoint protection product, or just list it as a tick-box, so whether you need EDR depends on your form.
Do they ask for an incident response plan?
Some list it as a tick-box. Others don't ask.
Are these the only questions on the form?
No. Forms also ask about your business, your revenue, the personal information you keep and any past attacks. This page covers the security questions only.
Sources
- Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizationscyber.gc.ca
- Insurance Bureau of Canada: Cyber Savvy insurance guidecybersavvycanada.ca
- Insurance Bureau of Canada: cyber insurance self-assessment for small businessibc.ca
- Get Cyber Safe (Government of Canada): Get Cyber Safe guide for small businessesgetcybersafe.gc.ca