Cyber security for small business
Cyber security for small business in Canada
The controls that stop the common attacks, set up properly, monitored 24/7 and reported monthly, for companies with 5 to 100 staff.
Attackers target small businesses because they expect less protection. Canada Create™ changes that math with a fixed-scope program priced for owners and built for the questionnaires your customers and insurer send.
Get your small business security proposal
Tell us how many people and devices you have and what data you handle. Written proposal within one business day.
By submitting, you agree that Canada Create™ may contact you about your request. No spam, ever.
What the small business program gives you
The common attacks stopped
Password reuse, invoice fraud, phishing, ransomware and lost devices handled by design.
Someone watching 24/7*
Analysts who contain threats and a number you can call.
Insurance and customer ready
Policies, evidence and questionnaire answers your insurer and larger customers require.
A price an owner can approve
Per user per month, quoted in writing, no surprises.
What is included in cyber security for small business
Nine controls that cover how small businesses actually get breached.
- Security baseline assessmentAccounts, devices, email, website, backups and vendors reviewed in plain language.
- Identity and accessMFA everywhere, password manager, limited admin rights and clean offboarding.
- Email protectionMicrosoft 365 or Google Workspace hardened, DMARC enforced, report button installed.
- Device protectionEndpoint detection and response, encryption, patching, remote lock and wipe.
- Backups that restoreOff-site, immutable and tested for files, email and website.
- Website securityHardening, firewall, updates and monitoring for the site that brings in customers.
- Staff trainingQuarterly awareness training and phishing simulation.
- Monitoring and response24/7* analyst monitoring with containment and a monthly report.
Small business cyber security pricing
Per user per month with a one-time onboarding fee, confirmed in writing.
Essentials
Quoted in writing, per user per month
Companies with 5 to 100 staff that need the core controls, monitoring and insurance-ready documentation
- Baseline assessment and quick wins
- MFA, email and device protection
- Tested backups
- 24/7 monitoring and response
- Quarterly training and monthly report
Regulated small business
By proposal
Clinics, law and accounting firms, brokerages and retailers with PHIPA, PIPEDA or PCI DSS obligations
- Everything in Essentials
- Website security program
- Framework-specific policies and records
- Vendor and questionnaire support
- Annual risk assessment
Managed hosting with security is available for $30/month + tax, paid annually ($360 + HST in Ontario).
Small business, real protection
Stop being the easy target
Cyber security for small business, sized and priced for owners
Small businesses are attacked more than large ones for a simple reason: they have money, they have customer data, and they usually have less protection. Ransomware crews, invoice fraudsters and account hijackers do not care that you have 15 employees. Canada Create™ cyber security for small business gives companies with 5 to 100 staff the controls that stop the common attacks, set up properly, monitored continuously and reported monthly, at a price an owner can approve without a board meeting.
What the small business program includes
Security baseline assessment
A short review of your accounts, devices, email, website, backups and vendors, with a plain-language report of what is exposed and what we will fix first. Most owners learn something uncomfortable in the first hour.
Identity and access
Multi-factor authentication on every account that matters, a password manager for the team, admin rights limited to the people who need them, and a clean offboarding process so former staff and contractors lose access the day they leave.
Email protection
Microsoft 365 or Google Workspace configured to block impersonation, phishing and malicious attachments, DMARC set up so criminals cannot send as your domain, and a report button so staff can flag suspicious messages in one click.
Device protection
Endpoint detection and response on every laptop and desktop, encryption, automatic patching and the ability to lock or wipe a lost device.
Backups that actually restore
Off-site, versioned, immutable backups of your files, email and website, with restores tested on a schedule, so ransomware becomes an inconvenience instead of a catastrophe.
Website security
Hardening, firewall, updates and monitoring for the site that brings in your customers, through our website security services and secure managed hosting.
Staff training
Short quarterly security awareness training and phishing simulation, because your people are the most attacked surface you have.
Monitoring and response
24/7 monitoring by analysts who investigate and contain threats, with a number you can call when something looks wrong. Read more about how managed security services work.
Policies, insurance and questionnaires
The short policy set, incident plan and evidence you need to renew cyber insurance, answer a larger customer’s security questionnaire and satisfy PIPEDA obligations.
Why small businesses get breached
The pattern is consistent. An employee reuses a password that leaked from another site. A fake invoice from a “supplier” changes the banking details and accounts payable sends the transfer. A plugin on the website goes unpatched for months and the site starts redirecting customers to scams. A laptop is lost with no encryption. A former contractor still has access to the shared drive. None of these require a sophisticated attacker, and all of them are stopped by controls that cost far less than one incident. The program above is built around exactly these failures.
Built for regulated small businesses too
A dental or physiotherapy clinic under PHIPA, a small law or accounting firm with client confidentiality obligations, a mortgage brokerage with regulator expectations, or a retailer handling payment cards under PCI DSS has the same obligations as a larger organization on a smaller budget. The program is adapted to the records you handle and produces the documentation those frameworks and your insurer ask for. Where a full compliance program is needed, we build it on top.
Small business cyber security pricing
The program is priced per user per month with a one-time onboarding fee, and every quote is confirmed in writing before you start. Tell us how many people and devices you have, which email platform you use and whether you handle health, financial or payment data, and you will have a written proposal within one business day.
Protect your business
Get a proposal in one business day, or call +1 (800) 808-9235 any time. Part of our cyber security services for Canadian businesses.
Talk to a strategist
Ready when you are!
Get a proposal in one business day.
Tell us your goals, budget and timeline. You get a plan, a price and a named strategist, with no long-term contract.
How the small business program runs
Protected within a month, reported every month.
- Baseline assessment Week 1
What is exposed and what we fix first, in a report you can read in ten minutes.
- Quick wins Week 1 to 2
MFA, admin cleanup, email hardening and DMARC.
- Devices, backups and website Week 2 to 4
Endpoint protection deployed, backups configured and tested, site hardened.
- Training and policies Week 3 to 4
First training session, phishing baseline and the policy set for insurance and customers.
- Ongoing monitoring Monthly
24/7 monitoring, quarterly training, monthly report and an annual review.
What clients say on Google
Reviews pulled live from our Google Business Profile.
Free review, no obligation
Not sure where to start? Send us what you have.
Share your current site, campaign or brief. A strategist reviews it and replies within one business day with a written recommendation and a fixed quote.
Why small businesses choose Canada Create™
Built for your size
A fixed scope for 5 to 100 staff, not an enterprise program cut down.
BBB Accredited, A+
An A+ rating with the Better Business Bureau and zero complaints.
Website and security together
We have built and hosted small business websites since 2008.
Quoted in writing
Per user per month, confirmed before you start. Proposal in one business day.
Plain language
Reports written for owners, not for security engineers.
24/7* support
Call +1 (800) 808-9235 any time, day or night.
Small business cyber security questions
Do small businesses really need cyber security?
Yes. Small businesses are targeted more often than large ones because attackers expect weaker protection, and a single ransomware or invoice fraud incident can cost more than years of prevention.
How much does cyber security cost for a small business in Canada?
Our program is priced per user per month with a one-time onboarding fee, confirmed in writing before you start. You will have a proposal within one business day.
What are the most common attacks on small businesses?
Phishing and account takeover, invoice and payment fraud, ransomware, hacked websites and lost or stolen devices. The program is built around stopping exactly these.
We have an IT company. Is this different?
Yes. IT keeps systems running; security keeps them from being compromised. We work alongside your IT provider and coordinate fixes with them.
What is the first thing we should do?
Turn on multi-factor authentication everywhere and check your backups actually restore. Those two steps stop a large share of incidents. The baseline assessment covers the rest.
Will this satisfy our cyber insurance?
Insurers typically require MFA, endpoint detection, backups and training. The program includes all of them and produces the evidence for the application.
A big customer sent us a security questionnaire. Can you help?
Yes. We answer it accurately, fix the gaps and build an evidence library so the next one takes hours.
Does this cover our website?
Yes. Website hardening, firewall, updates and monitoring are included, and secure managed hosting is available for $30/month + tax, paid annually.
What happens if we get hacked anyway?
Analysts contain it, we investigate and recover from tested backups, and we guide you through any notification obligations under PIPEDA or provincial law.
Can a clinic or law firm use this program?
Yes. The regulated small business option adds the policies, records and website program that PHIPA, client confidentiality rules and PCI DSS require.
One fake invoice can cost more than a year of protection
Small businesses are targeted because they are expected to be easy. Find out what is exposed before someone else does.
