Is your business actually ready? Find out in 5 minutes.

MFA stops most account takeovers even when a password leaks. Turn it on everywhere it's offered - start with email and money.

It makes strong, unique passwords effortless and is the single easiest upgrade for a small team.

Reused passwords mean one breached site can unlock several of yours. A manager makes this painless.

Browse, email and work in a normal account; only switch to admin when you actually need to. It limits the blast radius if something goes wrong.

Old logins are a quiet, common risk. Have a simple off-boarding step that disables accounts the same day.

Phishing is how most attacks start. People need to recognise the bait and have a no-blame way to flag it fast.

If an invoice or "new banking details" arrives, call a known number to confirm - never trust the contact info in the message itself. This stops invoice fraud cold.

These email settings make it much harder for scammers to send mail that looks like it's from you. Your IT provider can confirm they're in place.

Most attacks exploit known, already-patched flaws. Auto-updates close the door before anyone walks through it.

If a device is lost or stolen, encryption keeps the data on it unreadable. It's built into modern Windows, macOS, iOS and Android.

A locked screen with a PIN or password is a simple barrier against walk-up access in shared or public spaces.

Modern protection catches and contains malware automatically. Make sure it's installed and actually turned on.

A "found" USB stick is a classic way in. Agree as a team to never plug in anything you didn't buy or trust.

Three copies of your data, on two types of media, with one kept off-site. It's the standard that survives most disasters.

Ransomware tries to encrypt your backups too. A copy it can't reach - offline or write-protected - is your way back.

A backup you've never restored is a guess. Do a test restore so you know it works before you ever need it.

In a real incident, the first hour matters. A simple one-pager beats improvising under pressure.

You don't want to be searching for phone numbers mid-crisis. Keep them somewhere you can reach even if systems are down.

People hide mistakes when they fear blame, and that delay costs you. Make speedy reporting safe and expected.

Your risk includes your suppliers. Start with a simple list of who touches your systems or customer data.

A few questions - MFA, backups, breach history - tell you a lot. Set sensible expectations for the ones that matter most.

Data you don't hold can't be lost. Collecting and keeping less is good privacy practice and good security - and it's what PIPEDA expects.

Not just an LMS video everyone clicks through. People remember what they've practised - when they've actually felt an attack and learned to spot the real thing, they react well under pressure. That's the gap most checklists can't close on their own.