Cybersecurity 2025: The 10 Essential Controls for SMEs in Quebec
A list of priority, concrete, and affordable actions to reduce 80% of risks, meet insurers’ requirements, and comply with Law 25.
Attacks targeting SMEs are on the rise, and insurer requirements are tightening. Here are 10 essential, pragmatic and quickly applicable controls to strengthen your security posture in Quebec.
1) MFA Everywhere
Enable multi-factor authentication for email, VPN, CRM/ERP, remote access and administrator accounts. Favor authentication apps over SMS.
2) Patch Management
Automate Windows/macOS, browser and third-party application updates. Establish a monthly patching schedule with compliance reports.
3) 3-2-1 Backups and Testing
3-2-1 rule: 3 copies, 2 media types, 1 offline/immutable. Test restoration quarterly, not just backup success. Document RPO/RTO.
4) Modern EDR/Antivirus
Deploy an EDR solution with behavioral detection and automated response. Monitor servers, workstations and managed mobile devices.
5) Identity and Access Management
Principle of least privilege, separation of admin accounts, quarterly access reviews. Quickly disable accounts upon departure (automated offboarding).
6) Microsoft 365/Google Workspace Security
Enable baseline protection: MFA, sharing policies, DLP, Safe Links/Attachments, audit and logs. Configure legal archiving according to your obligations.
7) Awareness and Phishing Simulations
Short and regular training sessions, in French, followed by simulated phishing campaigns. Measure click rates and reward reporting.
8) Incident Response Plan
Draft a simple plan: who to contact, how to isolate, who decides, communication procedures. Conduct an annual table-top exercise.
9) Logging and Monitoring
Centralize critical logs (authentication, M365/Google, firewall, EDR) and define alerts. Outsource to a SOC service if you don't have an internal team.
10) Third-Party Management and Cyber Insurance
Inventory suppliers and external access. Assess their security controls. Prepare documentation required by insurers (MFA, backups, EDR, IRP).
Bill 25 Compliance
Inventory of personal information, retention policies, consent mechanisms, incident register and designation of a responsible person. Ensure your security practices support these obligations; for legal aspects, consult an advisor.
90-Day Roadmap
0-30 days: MFA, verified backups, patching, inactive account deactivation, anti-phishing training.
31-60 days: EDR, M365/Google hardening, incident plan, initial logging alerts.
61-90 days: access review, restoration testing, table-top exercise, insurer documentation.
Smart Budgeting
Aim for MSP-managed solutions to smooth costs: per user/workstation package including EDR, cloud backups, awareness and monitoring. Avoid stacking redundant tools.
Simple Metrics to Track
Patch compliance rate (>90%), restoration success, MFA enabled (>98% of accounts), average deactivation time upon departure (<4 h), simulation click rate (<5%).
By rigorously applying these baseline controls, you significantly reduce risks, meet insurer expectations and protect your clients' trust.