01 — Access & Identity

Multi-factor authentication (MFA) is enabled on all admin, email, and cloud accounts.
A password manager is used across the organization — no shared passwords written on sticky notes or in spreadsheets.
User accounts follow least-privilege: employees only have access to the systems and data their role requires.
Offboarding process exists: when an employee leaves, their accounts are disabled within 24 hours.
Admin/privileged accounts are separate from day-to-day user accounts.

02 — Email Security

SPF, DKIM, and DMARC DNS records are configured and enforced for your domain.
Email filtering or anti-phishing protection is enabled (e.g., Microsoft Defender, Google Workspace Safe Browsing).
Staff know how to identify phishing emails and have a clear process for reporting suspicious messages.
External email warnings are shown to recipients when email originates outside the organization.

All business devices (laptops, desktops, phones) run up-to-date operating systems with automatic updates enabled.
Endpoint protection (antivirus/EDR) is installed and actively managed on all devices.
Full-disk encryption is enabled on all laptops and mobile devices (BitLocker, FileVault, or equivalent).
A mobile device management (MDM) policy exists for company-owned and BYOD devices accessing business data.

Critical data is backed up automatically on a regular schedule (at least daily for business-critical systems).
Backups are stored offsite or in a separate cloud environment — not just on the same machine or same account.
Backup restoration has been tested within the last 6 months — you know the backup actually works.
Sensitive customer or financial data is classified and access is limited to those who need it.
A data retention and deletion policy exists — you know what data you keep and for how long.

Your business Wi-Fi uses WPA3 or WPA2 encryption — no open networks or default router passwords.
Guest Wi-Fi is on a separate VLAN or network, isolated from internal business systems.
Remote workers use a VPN or zero-trust network access (ZTNA) solution when connecting to business systems.
Network firewall is in place and default allow-all inbound rules have been reviewed and tightened.

A written acceptable use policy (AUP) exists and employees have acknowledged it.
New hires receive security awareness training as part of onboarding.
Security awareness training or phishing simulation is conducted at least annually for all staff.
Third-party vendors and software tools have been reviewed — you know what data they access and under what terms.

An incident response plan exists: staff know who to contact and what to do if a breach or ransomware event occurs.
You know your regulatory obligations for breach notification (e.g., PIPEDA, GDPR, provincial privacy laws).
Cyber insurance coverage has been reviewed and reflects your current risk profile.
A tabletop exercise or basic incident drill has been conducted in the last 12 months.