Security Guide
Cybersecurity Incident Response Checklist for Toronto SMBs
What to do in the first hour after you suspect a breach, ransomware event, or compromised account, before things get worse.
Book a Toronto consultationCybersecurity Incident Response Checklist for Toronto SMBs
A first-hour checklist for Toronto small and mid-sized businesses responding to a suspected cybersecurity incident, from containment to notification.
First-Hour Checklist
- Isolate, don't shut down
- Preserve evidence
- Contain account access
- Notify your IT/security provider immediately
- Assess notification obligations
- Don't pay or negotiate on your own
What to do in the first hour after you suspect a breach, ransomware event, or compromised account, before things get worse.
Why the first hour matters
Most of the damage in a cybersecurity incident happens in the gap between detection and containment. A clear, rehearsed first-hour checklist, even a simple one, meaningfully limits how far an incident spreads and how much it costs to recover from.
First-hour checklist
1. Isolate, don't shut down
Disconnect the affected device from the network (unplug Ethernet, disable Wi-Fi) rather than powering it off, you may need what's in memory later, and shutting down can trigger destructive processes in some ransomware.
2. Preserve evidence
Note the time you noticed the issue, what you observed, and don't delete files, logs, or emails related to the incident, they matter for investigation and any regulatory notification.
3. Contain account access
If a user account is compromised, force a password reset, revoke active sessions, and check for unauthorized mail rules, forwarding, or MFA changes.
4. Notify your IT/security provider immediately
Don't wait to "confirm" it's serious first, early notification to whoever handles your security monitoring gives them the best chance to contain the incident before it spreads.
5. Assess notification obligations
If personal information may have been exposed, PIPEDA (and PHIPA for health data) may require notifying affected individuals and, in some cases, the Privacy Commissioner. This is a legal question worth involving counsel on, SecureIT Solutions can advise on the technical side but not provide legal advice.
6. Don't pay or negotiate on your own
If ransomware is involved, decisions about payment carry legal, financial, and operational implications. Get expert guidance before doing anything, including engaging with attackers.
Prepare before you need it
The businesses that recover fastest are the ones with a written incident response plan, tested backups, and a security partner already in place, not the ones improvising after the fact.
24/7 SOC monitoring
Our cybersecurity division, The Cyber Arm, provides Toronto-based SOC monitoring and incident response for businesses that need coverage before, during, and after an incident.