Cybersecurity for Canadian SMBs : The Three Decisions to Make This Week

Cybersecurity for Canadian SMBs: who decides what when the alert goes off?

Short answer: three roles need to be named before an incident happens, not during. Who calls the cyber hotline, who has the authority to isolate a system, who authorizes bringing it back online. These three decisions can be made in a week, without a dedicated security team, and they change how long the disruption lasts more than any tool ever will.

On July 29, 2026, IBM released the Canadian edition of its annual Cost of a Data Breach report. The average cost of a data breach now reaches CA$7.11 million, the highest figure ever measured in the country. That number rolls up detection, notification, lost business and recovery. What it doesn't tell you is how long the organization took to react once the alert was known. In our experience, that delay almost always comes down to the same thing: nobody had decided in advance who does what.

An SMB leader doesn't need a 40 page plan. They need three names, written down somewhere, that everyone knows.

Decision 1: who calls the cyber hotline

The first hour of an incident is often lost to internal checks before a call ever leaves the company. An employee spots something odd, flags it to their manager, who mentions it to the IT director, who goes looking for a number. Meanwhile, the attacker keeps moving.

The decision to make this week: name one person, and only one, who has the authority to trigger the call to the emergency line at the first doubt, without waiting for technical confirmation. It's not necessarily the owner or CEO. It's often the IT director or the office manager, depending on who's reachable outside business hours.

Groupe ITCS builds this step into its offering for insurers through a response plan backed by a 24/7 emergency line, with intake in under two hours (source: public website groupitcs.ca, Solutions pour assureurs offering). That turnaround time only matters if someone at your company knows they're allowed to dial that number without waiting for sign off from three people first.

Decision 2: who has the authority to isolate a system

Isolating a compromised workstation or server often cuts off access to a tool someone is actively using. That's exactly why the decision gets stuck: nobody wants to be the one responsible for shutting down billing or email on a Tuesday afternoon.

This week, name who has the right to pull the plug on a system without asking permission, even if it causes an immediate operational headache. The alternative costs more: ransomware that spreads while everyone waits for a committee to agree rarely ends better than a system isolated out of caution and reassessed an hour later.

Decision 3: who authorizes bringing a system back online

This is the decision most often forgotten, and yet the costliest one to get wrong. Bringing a system back online too fast, before confirming the attacker no longer has access, reopens the door you just closed. Bringing it back too slowly keeps the business down longer than it needs to be.

This decision shouldn't fall to the same person who isolated the system. It calls for confirmation, ideally backed by a forensic investigation establishing that the root cause has been addressed. That's the role post-incident analysis plays in a well run case: it documents the timeline, the evidence and the corrective measures, all things the insurer and adjuster will ask for anyway to process the claim.

Cybersecurity for Canadian SMBs: the real cost of indecision

What makes these three decisions urgent isn't how sophisticated attacks have become. It's how long an organization takes to react when nobody decided in advance. A leader who waits for a management meeting to figure out who calls whom adds hours, sometimes days, to an incident already measured in hundreds of thousands of dollars.

Groupe ITCS has worked for more than ten years with insurers, brokers and breach coaches across Canada (source: public website groupitcs.ca, Entreprise page). What these cases show, without exception, is that the companies that come out ahead aren't the ones with the most tools. They're the ones where three people already knew, before the incident, what they were allowed to do.

Consequence and next step

If these three names don't exist yet in your company, the risk isn't theoretical: it will be the next phishing email or the next suspicious login session that exposes it, at the worst possible moment. Settling the first decision, the hotline one, takes a twenty minute conversation. The other two follow naturally once the chain of command is clear.

As part of its solutions for insurers, Groupe ITCS offers a short conversation to review with you who should own that call in your organization and how to tie it into a structured response plan. It's the simplest of the three decisions, and often the one that saves the most time.

Sources