If a cyberattack made your systems unavailable tomorrow morning, would you know who to call and which business activities to restore first? For your small or medium-sized business (SMB), the impact goes beyond computers: your employees need to keep working, your customers are waiting for orders, and your data needs protection. Planning your response lets you make these decisions before you have to act under pressure.
In 2023, about 1 in 6 Canadian businesses experienced a cybersecurity incident that affected their operations, according to Statistics Canada. Recovery spending reached $1.2 billion. In this article, I explain what to prepare before an attack, how to respond in the first few hours, and what to consider when restoring operations, communicating with affected people and meeting your privacy obligations.
[BLOG_POST_SUMMARY]
How can you prepare your SMB for a cyberattack?
Write an incident response plan
Create a practical incident response plan that is easy to access. It should explain:
-
- Who makes decisions, who responds and who communicates, with designated backups for each role.
- How to reach your IT provider, insurer and legal counsel.
- Which communication channels to use if email is compromised.
- Which systems to restore first and which activities can continue through alternative arrangements.
Rank your systems by their importance to operations and identify their dependencies. For a distributor, bringing order management back online may require restoring access and inventory data first. Keep a copy of the plan that you can access without your usual network. A cybersecurity assessment can help identify which risks to address first.
Prepare backups that can withstand an attack
Ransomware groups may try to locate your backups before encrypting your data. Protect at least one backup copy from being changed or deleted by an attacker. Offline and immutable backups serve this purpose in different ways.
-
-
Offline backups
-
An offline backup is disconnected from your day-to-day systems. Check that it stays isolated between backup operations and that you can access it when you need to restore data.
-
-
Immutable backups
-
An immutable backup prevents data from being changed or deleted for a defined period, depending on its configuration. Check the protection period, administrator permissions and whether immutability is configured correctly.
These protections can complement each other. In both cases, make sure the backup includes the data you need to resume operations.
Review administrator access as well: a single compromised account should not allow an attacker to erase both your data and every backup copy. Schedule restoration tests, for example quarterly, based on your risks. Each test should confirm that the data is usable and
Reduce entry points
One of the best cybersecurity practices for SMBs is to enable multi-factor authentication (MFA) wherever possible, especially for email, financial, administrator and executive accounts. MFA requires a second form of verification beyond a password, so a stolen password alone is not enough to gain access.
Coordinate patching with your IT maintenance and support team. To help employees recognize phishing attempts and understand the main types of cyberattacks, arrange training with phishing simulations.
Review your cyber insurance
According to Statistics Canada, 22% of Canadian businesses with 10 or more employees had cyber insurance in 2023. If you have coverage, review these three areas of your policy before you need to make a claim:
-
- How to report an incident and the deadline for doing so.
- Required security measures and coverage conditions.
- Approved providers and any authorizations needed before engaging specialists.
If your policy requires multi-factor authentication (MFA) on specific accounts or systems, failing to enable it as required could affect coverage for a claim, depending on the policy terms. Confirm these requirements with your broker. Ask how to reach the insurer outside business hours, too. Your plan should let you find this information without using an affected computer.
Run a tabletop exercise
Once a year, bring management, operations leads and your IT team together to simulate an incident. For example: “It’s 7 a.m. on Monday. Files on the accounting server have been renamed, and a ransom note appears.” Each participant explains what they would do, how employees would be informed and which tasks could continue through alternative arrangements. Gaps in the plan will quickly become apparent.
A tabletop exercise involves discussing decisions without disrupting your systems. Record any uncertainty, assign responsibility for improvements and repeat the exercise after any significant change to your environment.
What should you do in the first few hours of a cyberattack?
Recognize the warning signs
Report unreadable files, a ransom note, unusual sign-ins or messages sent without your knowledge immediately. Do not wait until every employee is affected before contacting your IT team.
Ransomware can block access to files and may also involve data theft. Record the time and the symptoms you notice. Use a phone or a device believed to be uncompromised to contact responders.
Contain the attack without destroying evidence
Isolate affected devices and preserve evidence that could help the investigation:
-
- Disconnect affected devices from the network, including Ethernet cables and Wi-Fi.
- Once devices are isolated, avoid shutting them down: some evidence is held in memory.
- Disable remote access and suspend vendor connections.
- Do not delete files or reinstall anything until specialists tell you to do so.
- Have your IT team coordinate the suspension of compromised access.
- Document each action and when it was taken.
Think of a compromised device as an incident scene: trying to restore it too quickly could erase evidence that helps explain what happened.
The Canadian Centre for Cyber Security recommends leaving an isolated device powered on to preserve evidence.
Know who to call and in what order
First, call your IT team or the incident response lead named in your plan. Notify management and your insurer promptly, following your policy requirements. Involve legal counsel and your privacy officer as soon as a privacy breach is suspected.
The exact order depends on your plan and the circumstances: do not wait until technical work is complete to meet a notification deadline. You can also report the incident to the Canadian Centre for Cyber Security and the police. Proactive monitoring 24/7/365 helps detect suspicious activity and initiate a response.
Address the ransom demand
Do not make a payment decision alone. Involve specialists, your insurer and legal counsel. Paying does not guarantee that you will recover your files or that stolen data will be deleted.
A ransomware attack may combine encryption with a threat to release stolen data. This is known as double extortion. The Ransomware playbook also explains that payment can raise legal issues. Available backups alone do not resolve the consequences of data theft.
The Canadian Centre for Cyber Security identifies ransomware as the leading cybercrime threat to Canada’s critical infrastructure. Among Canadian businesses affected by cybersecurity incidents in 2023, 13% (more than 1 in 8) reported a ransomware attack, according to Statistics Canada.
How can you resume operations after a cyberattack?
Restore from clean backups
Have your environment and backups checked before restoring them. The most recent copy may already contain compromised data or malware. Your technical team needs to select an appropriate recovery point and address the access issues or vulnerabilities the attacker exploited.
Then restore systems according to the priorities and dependencies in your plan. Work with users to check that orders, records and transactions are consistent. Disaster recovery and business continuity planning help prepare this return to operations, including temporary workarounds.
Meet your obligations under Quebec’s Law 25
Promptly assess whether the attack constitutes a confidentiality incident involving personal information. Your approach to Law 25 compliance should define the responsibilities and procedures needed to reduce risks and prevent similar incidents.
Record every confidentiality incident in your register, even if it does not present a risk of serious injury. When such a risk exists, promptly notify the Commission d’accès à l’information and the affected individuals, following the required measures and notification procedures.
Address these obligations as soon as the incident is discovered, without waiting for full recovery. To avoid common Law 25 compliance mistakes, make sure your team knows who maintains the register, who assesses risks and who coordinates notifications.
Our Law 25 compliance guide and our article on common Law 25 compliance mistakes explain these obligations in more detail.
Communicate with customers and partners
Tell customers and partners what you know, what you’re doing and when they can expect an update. If customer data has been exposed, it’s better for your customers to hear about it from you. Having a message prepared in advance as part of your incident response plan can save hours.
Review the response and make improvements
Within two weeks of returning to normal operations, bring together the same people who took part in the tabletop exercise for a post-incident review. Identify how the attacker got in, what worked and what was missing, then update your plan. If the entry point remains unaddressed, your business could be exposed to another attack through the same weakness.
Assign an owner and a deadline to each improvement. Update the plan, access controls, training and tests. A business cyberattack review should lead to changes you can verify.
Is your SMB ready to respond to a cyberattack?
Use these ten points to evaluate your cyber readiness. Each “no” is a gap to review with your team or IT partner.
-
- An incident response plan is accessible outside the usual network.
- Someone is named the lead to the response to a cyberattack, with a backup person identified.
- Contact details for the IT provider, insurer and legal counsel are up to date.
- At least one backup is kept offline, disconnected from your network so attackers can't reach it.
- An actual restoration has been tested within the past three months.
- Multi-factor authentication is enabled wherever possible, and always for email, remote access, financial and administrator accounts.
- Workstations and servers have monitored EDR protection.
- Cyber insurance deadlines, conditions and procedures are understood.
- A confidentiality incident register is ready to be maintained and updated.
- A tabletop exercise has been held within the past year.
This checklist is a starting point for strengthening your protection against cyberattacks. Beyond the risks discussed in our article “94% of SMBs attacked”, what matters is identifying the measures your business needs. Draw on the best cybersecurity practices for SMBs in 2026 and adjust your testing frequency to reflect your risks and changes to your systems.
How can Genatec help your SMB before, during and after a cyberattack?
Assess your risks, plan your priorities, implement the measures, then monitor and improve them: these are the four steps in Genatec’s approach to SMB cybersecurity. A virtual chief information security officer (vCISO) can also help guide your business cybersecurity decisions.
“When you work in the same environment every day, some risks can go unnoticed. An external IT partner brings a fresh perspective: they question established practices, check dependencies between systems and help identify what could complicate an incident response.”
- Chris Feghali, Security and Compliance Lead, Genatec
Genatec has 83 permanent specialists and offers technical support 24/7/365, with a published average response time of two minutes. Its internal controls were audited by Prescient Security as part of a SOC 2 Type I attestation.
In conclusion
Three things make it easier to respond to a cyberattack: an accessible plan, backups that have been tested through restoration, and clearly assigned responsibilities. For your SMB, this preparation helps you decide what to protect, who to involve and how to resume priority activities. Restoring services also needs to go hand in hand with addressing privacy obligations.
Start by reviewing the checklist with your IT lead to identify gaps. If you need help setting priorities, a Genatec advisor can work through them with you. The goal is to know how to act before you face an emergency.
