When a cyberattack hits, most small businesses lose the first few hours wondering who to call and what to do. Yet those hours decide how big the bill will be. We have put together, in one kit, the documents we set up for our clients. It is free and ready to adapt.
9 documents, downloadable one by one: editable in Word and Excel, printable as PDF. No sign-up required.
See the kit ↓Why a kit rather than a long report?
A small business does not need a security department to be well prepared. It needs four things:
- clear rules for its employees, since most attacks start with an email or a phone call;
- a plan to get back up and running after an outage, a disaster or ransomware;
- steps to follow when it happens, including Quebec Law 25 obligations;
- evidence to show the insurer, which no longer settles for a ticked questionnaire.
Each document in the kit meets one of these needs. Items [in brackets] are to be replaced with your company’s information.
The documents in the kit
The kit guide: which document to fill in, in what order, and the four-week plan.
Passwords and MFA, email, personal devices, AI, payments, remote work. With a signature page for each employee.
Essential systems, acceptable recovery times (RTO / RPO), backups, restore procedures and a test log.
The six steps of the response, severity levels, the Law 25 section, who to notify and the incident log.
Two pages: what the employee saw, then the assessment and notices sent by the response lead.
Devices, software and their priority, suppliers to call, administrator accounts. Without any passwords.
The columns required by the regulation, the end of retention date calculated for you and an alert when a notice to the CAI is missing.
30 controls insurers check, the evidence to provide for each one and your readiness level.
A one-page poster for workstations: what to do and not do in the first 15 minutes.
One page to print and keep outside the office: internal, suppliers, insurer, bank and authorities.
The four-week plan
No need to do everything at once. A few hours spread over a month are enough.
- Emergency contacts
- Post the First steps
- Open the Law 25 register
- Adapt and sign the policy
- Introduce the incident report form
- Fill in the inventory
- Complete the recovery plan
- Response plan and 30-min exercise
- Insurer checklist
The five protections every insurer checks
Insurers no longer settle for yes-or-no answers. They ask for evidence, and a “no” on any of these points often leads to a denial, a higher premium or a ransomware exclusion.
- 1Multi-factor authentication (MFA) on email, remote access and administrator accounts.
- 2EDR (detection and response) on all computers and servers. A traditional antivirus is no longer enough.
- 3Immutable or offline backups that an attacker cannot erase, tested at least once a year.
- 4A payment procedure: any change of banking details is confirmed by phone. See CEO fraud and payroll fraud.
- 5Employee training, at least once a year.
What Quebec’s Law 25 requires after an incident
Since September 2022, every Quebec business, whatever its size, must:
- take measures to reduce the risk of injury as soon as it has reason to believe an incident involves personal information;
- record every incident in a register, even those without serious consequences, keep it for at least five years and provide it to the Commission d’accès à l’information on request;
- promptly notify the Commission and the persons concerned when the incident presents a risk of serious injury.
Document 3 explains how to assess this risk; workbook 6 serves as the register.
Need help filling in the kit?
We can assess your environment, fill in the inventory and the insurer checklist with you, then put the missing protections in place.
Also read: 12 steps to protect your business in 2026 · Hacked account: 5 steps · Passkeys