Guides
What Canadian cyber insurers ask before covering a small business
Canadian cyber insurance requirements start with MFA, backups and privacy duties. IBC guidance shapes quotes, premiums and claims for small firms.
What to take away
- Canadian cyber insurance requirements usually begin with multi-factor authentication, tested backups and a written privacy policy before an insurer will quote.
- Insurers expect due diligencedocumented controls, staff training and an incident response plan you can actually follow.
- Premiums for small firms are set on revenue, sector, data volume, controls and claims history, not on a flat national rate.
- MFA, offline backups and endpoint detection move the price more than almost any other control.
- After an incident, the claims file is built from your notification records, forensic findings and privacy regulator correspondence.
- Provincial privacy statutes and PIPEDA shape what you must report, which in turn shapes what the insurer asks.
What Canadian cyber insurers ask for before they quote
A Canadian insurer will not price a cyber policy from a one-page form. Expect a questionnaire that runs several pages and asks about revenue, client data, payment systems, remote work and past incidents. The answers feed a scoring model, and the score decides whether you get a quote at all.
Most applications start with the legal entity, province of operation and annual revenue band. A firm in Ontario with $2 million in revenue and 15 staff looks different to an underwriter than a Quebec retailer of the same size with card payments in store.
Sector matters too: health clinics, law offices and accounting firms carry more sensitive data than a landscaping company.
The questionnaire then turns to controls. Insurers ask whether MFA is enforced on email, remote access and administrative accounts. They ask how backups are stored, how often they are tested and whether a copy sits offline. They ask about endpoint protection, patching cadence and who has admin rights.
Most forms score each control instead of asking for a simple yes or no. A typical questionnaire asks whether MFA covers all email, remote access and admin accounts, whether one backup copy is offline or immutable, and whether a restore was tested in the last 12 months.
It also asks whether endpoint detection and response runs on every device, whether a written incident response plan names an owner, and whether every staff member finished annual security training. Insurers often want the restore test date and the device count as evidence.
MFA and tested backups carry the heaviest weight in the score. Two or three weak answers on the weighted items usually push a file below the threshold for a standard quote, and it moves to a specialist market or comes back declined.
You will also be asked about privacy. Under the Personal Information Protection and Electronic Documents Act, a business must protect personal information with safeguards proportionate to its sensitivity. The Office of the Privacy Commissioner of Canada sets out privacy obligations for businesses that shape what insurers ask about data handling.
If you cannot describe how client data is collected, stored and deleted, the quote may come back with exclusions. Expect questions about third parties too. If a managed service provider handles your email or backups, the insurer wants the contract and the provider's security posture.
Finally, insurers ask about your incident history. A prior ransomware event, a payment card breach or a privacy complaint does not automatically disqualify you, but it changes the price and the deductible. Honest disclosure is cheaper than a claim denied for a material misstatement.
Security controls IBC member insurers commonly require of small firms
The Insurance Bureau of Canada publishes cyber insurance material that member insurers draw on when they design questionnaires and policy wordings. IBC does not publish a single dated underwriting standard for cyber, and each insurer sets its own terms.
Ask your broker for the questionnaire your insurer will use. That form, not any national guide, decides what you must show and what the policy will exclude.
Multi-factor authentication is the first. It should cover email, remote access, accounting systems and any account with administrative rights. Insurers treat MFA as a baseline control, not an upgrade, and a missing MFA answer is one of the fastest ways to lose a quote.
Backups are the second. The expectation is at least one copy that is offline or immutable, tested on a schedule, with a documented restore time. A backup that has never been restored is treated as an untested control, and underwriters ask for evidence, not intentions.
Endpoint protection and patching come next. That means managed antivirus or endpoint detection and response on every laptop and server, automatic updates where possible, and a process for critical patches. A small firm with ten laptops still needs this, and the cost is modest compared with a claim.
Access control and staff training round out the list. Least privilege, prompt removal of departed staff accounts, and annual security awareness training with phishing simulation are common requirements. Insurers also look for a written incident response plan and a named person responsible for security.
The Canadian Centre for Occupational Health and Safety explains due diligence as the level of care a reasonable person would take in the circumstances, which is close to the underwriting test insurers apply.
Security controls insurers require
| Control | What insurers look for | Typical evidence |
|---|---|---|
| MFA | All email, remote access and admin accounts | Screenshot of policy settings, user list |
| Backups | Offline or immutable copy, tested restore | Restore log, test date, retention policy |
| Endpoint protection | Managed EDR or antivirus on all devices | Console export, device count |
| Patching | Critical patches applied on a schedule | Patch report, ticket history |
| Access control | Least privilege, prompt offboarding | Role list, offboarding checklist |
| Training | Annual awareness training and phishing tests | Completion records, simulation results |
| Incident response | Written plan, named owner, contact list | Plan document, tabletop notes |
For a practical view of how these controls map to coverage and cost, see our guide to cyber insurance.
How premiums are set for a small Canadian business
There is no single national rate for small business cyber insurance in Canada. Insurers price each risk, and the range for a small firm is wide. A professional services firm with strong controls may pay a few hundred dollars a year for a $250,000 limit.
A retailer with card payments and weak controls may pay several thousand for the same limit.
Typical ranges in the Canadian small business market, rather than quotes from one insurer:
How premiums are set
- $800 to $2,500a yearProfessional services with strong controls, a $1 million limit and revenue under $5 million: about .
- $1,500 to $5,000a yearRetail or hospitality taking card payments, a $1 million limit and moderate controls: about .
- $3,000 to $10,000a yearClinics and firms holding health records, a $1 million to $2 million limit: about .
- $5,000 to $15,000Weak controls, an untested backup or a prior incident
- $6,000 to $20,000a yearA $5 million limit, common where data volumes are large
These are market ranges. They move with the insurer, the province and the year. The only firm number is the quote you receive in writing.
Worked example. An Ontario accounting firm with $1.5 million in revenue, 12 staff and client tax data asks for a $1 million limit and a $2,500 deductible. It runs MFA on every account, keeps an immutable backup tested twice a year, uses endpoint detection on each laptop and has a written incident response plan.
Typical quotes land between $1,200 and $2,400 a year. Let MFA lapse on the admin accounts and leave the backup untested for 18 months, and the same firm sees $3,500 to $6,000, or no quote at all. The example is illustrative, not an actual quote.
The main rating factors are revenue, sector, the volume and sensitivity of data, the controls in place, and claims history. Revenue sets the maximum loss the insurer is exposed to. Sector sets the likelihood: healthcare, finance, legal and retail with card payments are higher risk than trades or hospitality.
Controls move the price more than any other factor a small firm can change. The next section covers what each credit is worth.
Deductibles and limits are the other lever. A higher deductible lowers the premium but raises your out-of-pocket cost after an incident. A lower limit lowers the premium but may not cover a forensic investigation, legal fees, notification costs and business interruption together. Size the limit to the worst realistic year, not the average one.
Province matters at the margins. Quebec's Law 25 and British Columbia's and Alberta's private sector privacy statutes create notification and consent duties that can increase the cost of an incident. Insurers price that exposure into the policy for firms operating in those provinces.
A broker who writes cyber for small firms will usually get better terms than a direct online portal, because the broker can present your controls to several insurers.
Budgeting for cyber insurance is part of a wider financial risk plan, and the federal government's money and finances portal is a reasonable starting point for the broader picture.
For a cross-border comparison of what owners budget, see our breakdown of cyber insurance cost.
Which controls earn a credit and what the credit is worth
These three controls do most of the work in an underwriting decision. Get them right and the quote improves. Get them wrong and the quote may not arrive.
MFA earns the largest credit. In the Canadian small business market the typical reduction is 10 to 20 percent off the premium when MFA covers email, remote access and every admin account. Cover email alone and the credit is smaller, often 5 percent.
Tested, offline backups earn a similar credit, and they change the deductible as much as the price. Insurers often quote a $1,000 deductible when they see a restore test from the last 12 months, and $5,000 or a ransomware sublimit when they do not.
Endpoint detection and response carries a smaller credit, typically about 5 percent, and it is often the condition for ransomware cover at all.
The choice between a managed provider and an internal part-timer affects both price and evidence. Our comparison of MSP vs in-house IT security sets out the cost and control trade-offs for Canadian firms.
The claims process after an incident: documents and timelines
A cyber claim is not like a car claim. It starts with a phone call to the insurer's hotline, often within hours, and the insurer will usually appoint a forensics firm and a breach coach. Your job is to preserve evidence and follow the plan.
Report to your insurer as soon as you confirm the incident. Most Canadian cyber policies require prompt notice, often within days, and late notice is one of the few grounds an insurer uses to reduce a claim.
Privacy reporting runs on a separate clock. Under PIPEDA you must notify the Office of the Privacy Commissioner and the affected people as soon as feasible once you decide a breach creates a real risk of significant harm. You must also record every breach, reportable or not, and keep the record for 24 months.
The insurer's investigation and the privacy regulator's investigation can run in parallel. The Office of the Privacy Commissioner of Canada investigates breaches and complaints, and its findings often become part of the claims file. A firm that cooperated early and documented its controls tends to fare better on both tracks.
For the operational side of handling an event, our incident response guide covers roles, escalation and communication.
Where provincial privacy duties meet the insurance file
Three provinces run their own private sector privacy statutes: British Columbia, Alberta and Quebec. In the rest of Canada, PIPEDA covers customer and employee data. The differences that matter to an insurer are the notification clock and the regulator you answer to.
Alberta requires notice to the Office of the Information and Privacy Commissioner and to affected people without unreasonable delay. British Columbia requires notice to affected people without unreasonable delay, and has no general duty to report to its commissioner.
Quebec's Law 25 requires notice to the Commission d'accès à l'information (CAI) promptly, and firms there must keep a register of confidentiality incidents. It also sets a higher bar on consent and transparency than the other two provinces.
The Office of the Privacy Commissioner of Canada maintains a plain-language overview of privacy laws in Canada that explains which statute applies where. Insurers use the same map. A firm operating in several provinces may face more than one notification duty after a single incident, and the policy needs to cover all of them.
On the insurance file, that map has two consequences. Your notification procedure must name the right regulator and the right deadline for each province you serve, and those deadlines become the timeline the adjuster measures. A firm selling into Quebec and Alberta after one incident may need limits sized for two notification streams and two sets of legal costs.
Health information adds another layer. Ontario, Alberta and Quebec have health privacy statutes with their own regulators, and a clinic or physiotherapy practice should expect questions about them. The insurer will want to know who you notify and how quickly.
Manitoba, Saskatchewan, New Brunswick, Nova Scotia and Newfoundland and Labrador also have health privacy statutes with their own oversight bodies.
A small firm that treats privacy compliance as paperwork tends to have a harder claim. A firm that can show a data map, a retention schedule and a notification procedure is easier to insure and easier to defend.
