https://cybercaribou.com/en/blog Cybersecurity guides for Québec businesses en-CA https://cybercaribou.com/en/blog/3-2-1-1-0-backup-rule-ransomware https://cybercaribou.com/en/blog/3-2-1-1-0-backup-rule-ransomware Sat, 24 Oct 2026 12:00:00 GMT Three copies, two media, one offsite, one immutable, zero errors: the 3-2-1-1-0 backup rule explained for small businesses that need to survive ransomware. https://cybercaribou.com/en/blog/bill-c-8-ccspa-suppliers https://cybercaribou.com/en/blog/bill-c-8-ccspa-suppliers Sat, 24 Oct 2026 12:00:00 GMT Bill C-8 is law, and the CCSPA will push cyber security obligations down the supply chain. What telecom, bank and transport suppliers should prepare now. https://cybercaribou.com/en/blog/brand-impersonation-fake-websites https://cybercaribou.com/en/blog/brand-impersonation-fake-websites Sat, 24 Oct 2026 12:00:00 GMT Look-alike domains, cloned websites, fake Facebook pages: how to detect brand impersonation targeting your business and get a fake site taken down. https://cybercaribou.com/en/blog/business-continuity-plan-cyberattack https://cybercaribou.com/en/blog/business-continuity-plan-cyberattack Sat, 24 Oct 2026 12:00:00 GMT Critical processes, RTO and RPO, manual workarounds: a practical business continuity plan template so your small business keeps serving clients after an attack. https://cybercaribou.com/en/blog/business-email-compromise-ceo-fraud https://cybercaribou.com/en/blog/business-email-compromise-ceo-fraud Sat, 24 Oct 2026 12:00:00 GMT Fake CEO, fake supplier, diverted payroll: how business email compromise works, what it costs Canadian small businesses and the simple controls that stop it. https://cybercaribou.com/en/blog/business-iot-cameras-security https://cybercaribou.com/en/blog/business-iot-cameras-security Sat, 24 Oct 2026 12:00:00 GMT Cameras, alarms, thermostats: default passwords, firmware, network segmentation, cloud accounts and vendor remote access. A practical small business guide. https://cybercaribou.com/en/blog/business-travel-cybersecurity https://cybercaribou.com/en/blog/business-travel-cybersecurity Sat, 24 Oct 2026 12:00:00 GMT Public Wi-Fi, border device searches, MFA abroad, lost laptops: the cybersecurity rules to follow before, during and after every business trip. https://cybercaribou.com/en/blog/business-wifi-security https://cybercaribou.com/en/blog/business-wifi-security Sat, 24 Oct 2026 12:00:00 GMT WPA2 or WPA3, Personal or Enterprise mode, guest networks and smart devices: a step-by-step guide to business Wi-Fi security for Canadian small businesses. https://cybercaribou.com/en/blog/clicked-phishing-link-what-to-do https://cybercaribou.com/en/blog/clicked-phishing-link-what-to-do Sat, 24 Oct 2026 12:00:00 GMT Clicked on a phishing link? The steps to take right now, depending on what happened next: a click, a typed password, an opened attachment or bank details. https://cybercaribou.com/en/blog/confidentiality-incident-register-template https://cybercaribou.com/en/blog/confidentiality-incident-register-template Sat, 24 Oct 2026 12:00:00 GMT The confidentiality incident register Québec’s Law 25 requires: the 8 mandatory fields, a copy-ready template, filled-in examples and retention rules. https://cybercaribou.com/en/blog/construction-company-cybersecurity https://cybercaribou.com/en/blog/construction-company-cybersecurity Sat, 24 Oct 2026 12:00:00 GMT Payment redirection, hacked email, job site tablets and bid documents: how a Canadian construction company can stop the fraud that targets it most. https://cybercaribou.com/en/blog/cpcsc-cyber-certification-defence-suppliers https://cybercaribou.com/en/blog/cpcsc-cyber-certification-defence-suppliers Sat, 24 Oct 2026 12:00:00 GMT CPCSC certification explained: the 3 levels, the 13 Level 1 controls and a practical plan for Montréal aerospace suppliers bidding on Canadian defence work. https://cybercaribou.com/en/blog/cyber-insurance-questionnaire-requirements https://cybercaribou.com/en/blog/cyber-insurance-questionnaire-requirements Sat, 24 Oct 2026 12:00:00 GMT Cyber insurance questionnaire: the controls insurers check (MFA, EDR, backups), the traps that put coverage at risk and the evidence to gather before you sign. https://cybercaribou.com/en/blog/cyberattack-who-to-notify-canada https://cybercaribou.com/en/blog/cyberattack-who-to-notify-canada Sat, 24 Oct 2026 12:00:00 GMT Hit by a cyberattack? Who to notify in Canada (insurer, bank, police, CAI, OPC, clients, Cyber Centre), in what order and under which law, step by step. https://cybercaribou.com/en/blog/cybersecure-canada-certification-smb https://cybercaribou.com/en/blog/cybersecure-canada-certification-smb Sat, 24 Oct 2026 12:00:00 GMT CyberSecure Canada certification explained: what the CAN/DGSI 104 standard requires, how the audit works, its limits, and which businesses actually benefit. https://cybercaribou.com/en/blog/cybersecurity-accounting-firms https://cybercaribou.com/en/blog/cybersecurity-accounting-firms Sat, 24 Oct 2026 12:00:00 GMT Fake CRA messages, targeted EFILE accounts, tax slips sent by email: what CPA rules require and the security measures an accounting firm should put in place. https://cybercaribou.com/en/blog/cybersecurity-audit-small-business-quebec https://cybercaribou.com/en/blog/cybersecurity-audit-small-business-quebec Sat, 24 Oct 2026 12:00:00 GMT What a cybersecurity audit for a Quebec small business involves: the five steps, a realistic timeline, what drives the cost and how to prepare for it. https://cybercaribou.com/en/blog/cybersecurity-clinics-healthcare-quebec https://cybercaribou.com/en/blog/cybersecurity-clinics-healthcare-quebec Sat, 24 Oct 2026 12:00:00 GMT Quebec's health information act, Law 25, EMRs and ransomware: the legal duties and the priority cybersecurity measures for a private healthcare clinic. https://cybercaribou.com/en/blog/cybersecurity-law-firms-notaries https://cybercaribou.com/en/blog/cybersecurity-law-firms-notaries Sat, 24 Oct 2026 12:00:00 GMT Codes of conduct, record-keeping rules, trust accounts and Law 25: what Quebec's professional orders expect from lawyers and notaries on cybersecurity. https://cybercaribou.com/en/blog/cybersecurity-municipalities-quebec https://cybercaribou.com/en/blog/cybersecurity-municipalities-quebec Sat, 24 Oct 2026 12:00:00 GMT Quebec municipalities fall under the Access Act, as modernized by Law 25, not the private-sector law: security duties, incident rules and practical priorities. https://cybercaribou.com/en/blog/cybersecurity-nonprofits-quebec https://cybercaribou.com/en/blog/cybersecurity-nonprofits-quebec Sat, 24 Oct 2026 12:00:00 GMT Volunteers, shared accounts, online donations and Law 25: the cybersecurity priorities for a Quebec nonprofit, with a checklist built for tight budgets. https://cybercaribou.com/en/blog/cybersecurity-real-estate-mortgage-brokers https://cybercaribou.com/en/blog/cybersecurity-real-estate-mortgage-brokers Sat, 24 Oct 2026 12:00:00 GMT Wire fraud before closing, ID documents, OACIQ and AMF rules: the cybersecurity measures that matter most for real estate and mortgage brokers in Quebec. https://cybercaribou.com/en/blog/cybersecurity-statistics-quebec-canada https://cybercaribou.com/en/blog/cybersecurity-statistics-quebec-canada Sat, 24 Oct 2026 12:00:00 GMT Cyberattacks on small businesses, costs, privacy incidents reported to the CAI, fraud losses, recovery times: verified, sourced figures for Quebec and Canada. https://cybercaribou.com/en/blog/cybersecurity-transportation-logistics https://cybercaribou.com/en/blog/cybersecurity-transportation-logistics Sat, 24 Oct 2026 12:00:00 GMT Telematics and ELD accounts, dispatch email fraud, fuel cards, connected warehouses: the cyber risks for carriers and logistics firms, and what to do first. https://cybercaribou.com/en/blog/cybersecurity-web-marketing-agencies https://cybercaribou.com/en/blog/cybersecurity-web-marketing-agencies Sat, 24 Oct 2026 12:00:00 GMT Pages, ad accounts, CMS, DNS: how a web or marketing agency protects its clients' access with least privilege, shared vaults and a clean offboarding process. https://cybercaribou.com/en/blog/deepfake-voice-fraud-business https://cybercaribou.com/en/blog/deepfake-voice-fraud-business Sat, 24 Oct 2026 12:00:00 GMT A call from the 'CEO' demanding an urgent wire transfer? Call-backs to known numbers, code words and dual approval: how to stop deepfake voice fraud at work. https://cybercaribou.com/en/blog/deploy-business-password-manager https://cybercaribou.com/en/blog/deploy-business-password-manager Sat, 24 Oct 2026 12:00:00 GMT Selection criteria, shared vaults, a pilot group, the master passphrase and employee offboarding: a practical plan to deploy a business password manager. https://cybercaribou.com/en/blog/employee-offboarding-access-checklist https://cybercaribou.com/en/blog/employee-offboarding-access-checklist Sat, 24 Oct 2026 12:00:00 GMT Accounts, sessions, devices, shared passwords and vendor portals: a complete employee offboarding checklist so no access outlives an employee's last day. https://cybercaribou.com/en/blog/evaluate-it-provider-security https://cybercaribou.com/en/blog/evaluate-it-provider-security Sat, 24 Oct 2026 12:00:00 GMT Your managed IT provider holds the keys to your business. Here are 12 questions to ask, what a good answer looks like, and what to put in the contract. https://cybercaribou.com/en/blog/external-vs-internal-penetration-test https://cybercaribou.com/en/blog/external-vs-internal-penetration-test Sat, 24 Oct 2026 12:00:00 GMT External vs internal penetration test: what each reveals, typical cost ranges and which to start with for your small business, plus a prep checklist. https://cybercaribou.com/en/blog/generative-ai-data-leak-business https://cybercaribou.com/en/blog/generative-ai-data-leak-business Sat, 24 Oct 2026 12:00:00 GMT How generative AI data leaks really happen with ChatGPT and Copilot, what Quebec's Law 25 requires, and a usage policy checklist your business can adopt. https://cybercaribou.com/en/blog/google-workspace-security-audit https://cybercaribou.com/en/blog/google-workspace-security-audit Sat, 24 Oct 2026 12:00:00 GMT A Google Workspace security audit checklist for small businesses: super admins, 2-Step Verification, Gmail, Drive sharing and third-party app access. https://cybercaribou.com/en/blog/how-to-choose-cybersecurity-audit-firm-quebec https://cybercaribou.com/en/blog/how-to-choose-cybersecurity-audit-firm-quebec Sat, 24 Oct 2026 12:00:00 GMT Written authorization, methodology, sample report, retest, fixed price, independence: 12 vendor-neutral criteria for choosing a cybersecurity audit firm. https://cybercaribou.com/en/blog/how-to-read-penetration-test-report https://cybercaribou.com/en/blog/how-to-read-penetration-test-report Sat, 24 Oct 2026 12:00:00 GMT How to read a penetration test report: the executive summary, CVSS severity, attack chains, and how to turn findings into an action plan your team will follow. https://cybercaribou.com/en/blog/how-to-spot-phishing-email-examples https://cybercaribou.com/en/blog/how-to-spot-phishing-email-examples Sat, 24 Oct 2026 12:00:00 GMT Fake CRA e-Transfers, Canada Post parcel fees, Hydro-Québec refunds: five phishing examples broken down, plus the warning signs to check before you click. https://cybercaribou.com/en/blog/incident-response-plan-template-small-business https://cybercaribou.com/en/blog/incident-response-plan-template-small-business Sat, 24 Oct 2026 12:00:00 GMT An incident response plan template for small businesses: roles, response phases, a call tree and privacy obligations under Law 25 and PIPEDA, ready to use. https://cybercaribou.com/en/blog/information-security-policy-template-small-business https://cybercaribou.com/en/blog/information-security-policy-template-small-business Sat, 24 Oct 2026 12:00:00 GMT A 12-section information security policy template you can adapt, who should sign it, how it ties into Quebec's Law 25 and PIPEDA, and the mistakes to avoid. https://cybercaribou.com/en/blog/iso-27001-vs-soc-2-smb https://cybercaribou.com/en/blog/iso-27001-vs-soc-2-smb Sat, 24 Oct 2026 12:00:00 GMT ISO 27001 vs SOC 2: certification versus attestation report, the real effort for an SMB, what buyers in Canada, the U.S. and Europe expect, and where to start. https://cybercaribou.com/en/blog/law-25-privacy-policy-template https://cybercaribou.com/en/blog/law-25-privacy-policy-template Sat, 24 Oct 2026 12:00:00 GMT Quebec Law 25 privacy policy: who must publish one, what it must contain under ss. 8, 8.1 and 8.2, a template outline to adapt, and the mistakes to avoid. https://cybercaribou.com/en/blog/manufacturing-ot-cybersecurity https://cybercaribou.com/en/blog/manufacturing-ot-cybersecurity Sat, 24 Oct 2026 12:00:00 GMT Purdue model, IEC 62443 zones and conduits, integrator remote access: a realistic manufacturing OT cybersecurity plan for small and mid-sized plants. https://cybercaribou.com/en/blog/microsoft-365-backup-do-you-need-it https://cybercaribou.com/en/blog/microsoft-365-backup-do-you-need-it Sat, 24 Oct 2026 12:00:00 GMT Recycle bins of 14 to 93 days, retention, Microsoft 365 Backup: what Microsoft actually protects, and when your business needs a real Microsoft 365 backup. https://cybercaribou.com/en/blog/microsoft-365-security-audit https://cybercaribou.com/en/blog/microsoft-365-security-audit Sat, 24 Oct 2026 12:00:00 GMT A Microsoft 365 security audit checklist: 15 settings to verify (MFA, admin roles, forwarding, external sharing, audit logs) to stop phishing and payment fraud. https://cybercaribou.com/en/blog/microsoft-copilot-oversharing-security https://cybercaribou.com/en/blog/microsoft-copilot-oversharing-security Sat, 24 Oct 2026 12:00:00 GMT Copilot respects your permissions, even overly broad ones. SharePoint reports, Restricted Content Discovery, sensitivity labels, Law 25: 8 steps before rollout. https://cybercaribou.com/en/blog/multi-factor-authentication-choosing-mfa https://cybercaribou.com/en/blog/multi-factor-authentication-choosing-mfa Sat, 24 Oct 2026 12:00:00 GMT Text codes, push prompts, FIDO2 keys or passkeys? Compare multi-factor authentication methods and choose phishing-resistant MFA that attackers can't relay. https://cybercaribou.com/en/blog/nist-csf-2-small-business https://cybercaribou.com/en/blog/nist-csf-2-small-business Sat, 24 Oct 2026 12:00:00 GMT NIST CSF 2.0 explained for Canadian small businesses: the six functions including Govern, the NIST quick-start guide and how to build a target profile. https://cybercaribou.com/en/blog/passkeys-for-business https://cybercaribou.com/en/blog/passkeys-for-business Sat, 24 Oct 2026 12:00:00 GMT Microsoft 365 or Google Workspace: how to roll out passkeys in your small business step by step, from pilot group to recovery, without locking anyone out. https://cybercaribou.com/en/blog/patch-management-policy-small-business https://cybercaribou.com/en/blog/patch-management-policy-small-business Sat, 24 Oct 2026 12:00:00 GMT Patch deadlines by severity, how to prioritize exploited flaws, handling exceptions and tracking results: a practical patch management policy for SMBs. https://cybercaribou.com/en/blog/pci-dss-4-small-business https://cybercaribou.com/en/blog/pci-dss-4-small-business Sat, 24 Oct 2026 12:00:00 GMT PCI DSS 4.0.1 for Canadian small businesses: which SAQ to fill out, what became mandatory on March 31, 2025, and how to shrink your compliance scope. https://cybercaribou.com/en/blog/penetration-test-authorization-letter https://cybercaribou.com/en/blog/penetration-test-authorization-letter Sat, 24 Oct 2026 12:00:00 GMT Criminal Code, scope, dates, permitted techniques, emergency contacts, data, cloud rules: what a penetration test authorization letter must include in Canada. https://cybercaribou.com/en/blog/penetration-testing-cost-quebec https://cybercaribou.com/en/blog/penetration-testing-cost-quebec Sat, 24 Oct 2026 12:00:00 GMT What a penetration test is, the main types, indicative Canadian price ranges and the red flags to watch for when comparing pentest quotes for your business. https://cybercaribou.com/en/blog/phishing-simulation-employees https://cybercaribou.com/en/blog/phishing-simulation-employees Sat, 24 Oct 2026 12:00:00 GMT Phishing simulation for employees: plan a campaign, pick realistic scenarios, track the report rate and train staff without shaming them. A practical SMB guide. https://cybercaribou.com/en/blog/privacy-impact-assessment-pia-quebec-security https://cybercaribou.com/en/blog/privacy-impact-assessment-pia-quebec-security Sat, 24 Oct 2026 12:00:00 GMT Privacy impact assessments under Québec’s Law 25: when a PIA is mandatory, how to build security into it and how to score risks, with an SMB example. https://cybercaribou.com/en/blog/privacy-officer-quebec-security-role https://cybercaribou.com/en/blog/privacy-officer-quebec-security-role Sat, 24 Oct 2026 12:00:00 GMT The privacy officer role under Québec’s Law 25, from a security angle: default holder, written delegation, security duties, a quarterly dashboard and template. https://cybercaribou.com/en/blog/qr-code-phishing-quishing https://cybercaribou.com/en/blog/qr-code-phishing-quishing Sat, 24 Oct 2026 12:00:00 GMT Fake QR codes on parking machines, emails that say 'scan to reactivate your MFA': how to recognize quishing and protect your small business and your staff. https://cybercaribou.com/en/blog/quebec-law-25-cookies-consent-website https://cybercaribou.com/en/blog/quebec-law-25-cookies-consent-website Sat, 24 Oct 2026 12:00:00 GMT Quebec Law 25 cookie rules explained: what section 8.1 and the CAI require, which cookies must be off by default, and how to set up a fair consent banner. https://cybercaribou.com/en/blog/quebec-law-25-cybersecurity-checklist https://cybercaribou.com/en/blog/quebec-law-25-cybersecurity-checklist Sat, 24 Oct 2026 12:00:00 GMT A practical Quebec Law 25 compliance checklist for SMBs: governance, access control, technical safeguards, incident handling and vendors, mapped to the Act. https://cybercaribou.com/en/blog/quebec-law-25-fines-penalties https://cybercaribou.com/en/blog/quebec-law-25-fines-penalties Sat, 24 Oct 2026 12:00:00 GMT Quebec Law 25 fines: up to $10M in administrative penalties and $25M in penal fines. How the CAI sets amounts, its other powers and how to reduce your risk. https://cybercaribou.com/en/blog/quebec-law-25-small-business-where-to-start https://cybercaribou.com/en/blog/quebec-law-25-small-business-where-to-start Sat, 24 Oct 2026 12:00:00 GMT Quebec Law 25 for small business: a 30-day plan to name your privacy officer, prepare for incidents, fix your website and adopt your governance policies. https://cybercaribou.com/en/blog/ransomware-first-24-hours https://cybercaribou.com/en/blog/ransomware-first-24-hours Sat, 24 Oct 2026 12:00:00 GMT Hit by ransomware? What to do in the first 24 hours: isolate, call your insurer, preserve evidence and notify the right people, in the right order. https://cybercaribou.com/en/blog/ransomware-small-business-attack-anatomy https://cybercaribou.com/en/blog/ransomware-small-business-attack-anatomy Sat, 24 Oct 2026 12:00:00 GMT From a forgotten VPN account to Friday-night encryption: how a ransomware attack on a small business really unfolds, and where to stop it at each stage. https://cybercaribou.com/en/blog/remote-work-security-business https://cybercaribou.com/en/blog/remote-work-security-business Sat, 24 Oct 2026 12:00:00 GMT Devices, remote access, home Wi-Fi, fraud and Quebec's Law 25: the concrete steps that keep remote work security tight in a hybrid small business. https://cybercaribou.com/en/blog/report-confidentiality-incident-cai-law-25 https://cybercaribou.com/en/blog/report-confidentiality-incident-cai-law-25 Sat, 24 Oct 2026 12:00:00 GMT When and how to report a confidentiality incident to Québec’s CAI under Law 25, minus the 72-hour myth: harm assessment, notice content and next steps. https://cybercaribou.com/en/blog/retail-ecommerce-cybersecurity https://cybercaribou.com/en/blog/retail-ecommerce-cybersecurity Sat, 24 Oct 2026 12:00:00 GMT Payment terminals, online stores, PCI DSS 4.0.1, gift card fraud and customer data: a practical retail cybersecurity plan for Canadian small businesses. https://cybercaribou.com/en/blog/secure-business-social-media-accounts https://cybercaribou.com/en/blog/secure-business-social-media-accounts Sat, 24 Oct 2026 12:00:00 GMT Hijacked Facebook page, an ex-employee still on LinkedIn, an agency with too much access: how to secure your small business's social media accounts. https://cybercaribou.com/en/blog/secure-business-wordpress-site https://cybercaribou.com/en/blog/secure-business-wordpress-site Sat, 24 Oct 2026 12:00:00 GMT Plugin updates, two-factor authentication, a web application firewall, tested backups: a practical checklist to secure your small business WordPress site. https://cybercaribou.com/en/blog/security-audit-vs-pentest-vs-vulnerability-scan https://cybercaribou.com/en/blog/security-audit-vs-pentest-vs-vulnerability-scan Sat, 24 Oct 2026 12:00:00 GMT Security audit, penetration test or vulnerability scan? The real differences, what each one delivers and the order that makes sense for a growing business. https://cybercaribou.com/en/blog/small-business-cybersecurity-budget https://cybercaribou.com/en/blog/small-business-cybersecurity-budget Sat, 24 Oct 2026 12:00:00 GMT How much should a small business spend on cybersecurity? A tiered method to build a realistic budget, prioritize spending and get buy-in from leadership. https://cybercaribou.com/en/blog/spf-dkim-dmarc-explained https://cybercaribou.com/en/blog/spf-dkim-dmarc-explained Sat, 24 Oct 2026 12:00:00 GMT SPF, DKIM and DMARC explained in plain English, with real DNS record examples, the Gmail, Yahoo and Outlook sender rules, and a rollout plan for your domain. https://cybercaribou.com/en/blog/tabletop-exercise-small-business https://cybercaribou.com/en/blog/tabletop-exercise-small-business Sat, 24 Oct 2026 12:00:00 GMT A ready-to-run ransomware tabletop exercise for your small business: roles, a two-hour agenda, timed injects, questions to ask and the after-action report. https://cybercaribou.com/en/blog/vendor-banking-change-fraud https://cybercaribou.com/en/blog/vendor-banking-change-fraud Sat, 24 Oct 2026 12:00:00 GMT A supplier emails new banking details? What to do if the payment already went out, how vendor banking change fraud works and the simple process that stops it. https://cybercaribou.com/en/blog/web-application-penetration-test-owasp-top-10 https://cybercaribou.com/en/blog/web-application-penetration-test-owasp-top-10 Sat, 24 Oct 2026 12:00:00 GMT Web application penetration testing explained: the OWASP Top 10 2025 in plain English, how a test runs and how to prepare your customer portal or online store. https://cybercaribou.com/en/blog/windows-10-end-of-support-business https://cybercaribou.com/en/blog/windows-10-end-of-support-business Sat, 24 Oct 2026 12:00:00 GMT Windows 10 support ended on October 14, 2025. Extended Security Updates, real costs and the move to Windows 11: a practical 2026 plan for small businesses. https://cybercaribou.com/en/blog/zero-trust-small-business-explained https://cybercaribou.com/en/blog/zero-trust-small-business-explained Sat, 24 Oct 2026 12:00:00 GMT What zero trust really means for a small business: the NIST and Cyber Centre principles in plain English, plus a five-step roadmap you can start this quarter.