A cybersecurity audit checks, in a documented and repeatable way, whether your technology, policies and people actually protect the data you hold. The checklist below covers the nine areas that matter most for a Canadian small business: assets, user access, devices and patching, network, email and Microsoft 365, backups, incident response, vendors and privacy obligations. It also shows how to rank what you find so the riskiest gaps get fixed first. Work through it now, because attackers do not wait for your next scheduled review.
TL;DR
- Start with an inventory of devices, accounts, data and vendors. You cannot audit what you have not listed.
- Test controls instead of assuming them: restore a backup, attempt a login without MFA, run a vulnerability scan, walk through your incident plan.
- Under PIPEDA, breaches posing a real risk of significant harm must be reported and every breach must be recorded. Your audit should confirm you can do both.
- Rank findings by likelihood, impact and cost to fix. Close high-risk, low-cost gaps within weeks.
- Repeat the audit on a regular schedule and after any major change, such as a new cloud platform or an acquisition.
Table of Contents
- What a cybersecurity audit is, and what it is not
- Before you start: scope and preparation
- The checklist
- Canadian and Ontario obligations to build into the audit
- How to run the audit and record findings
- Prioritizing fixes by risk and cost
- How often to repeat it
- Our perspective
- Get the audit done and the gaps closed
- FAQ
- Sources
What a cybersecurity audit is, and what it is not
The Canadian Centre for Cyber Security describes network security auditing as an independent examination of an organization’s IT controls, security systems and risk mitigation policies, used to identify threats and weaknesses and to support regulatory compliance. Two words in that definition deserve attention: independent and examination.
Independent means the person checking should not be the person who built or runs the systems. The Centre’s guidance says auditors should be IT professionals with security and network management backgrounds who are not responsible for managing the systems being audited. In a small business, that usually means an outside specialist, or at minimum someone who did not configure the environment.
Examination means evidence. A policy document that says “all staff use MFA” is a claim. A report from Microsoft 365 showing which accounts have MFA enforced is evidence. Every item on the checklist below should end with proof you can file.
An audit is also different from a penetration test. An audit reviews controls, configurations, policies and records. A penetration test actively tries to break in. Both are useful, and the audit comes first because it tells you what a tester should focus on.
Before you start: scope and preparation
A week of preparation saves days of confusion. Settle these points first:
- Scope. Decide whether you are auditing the whole business or one environment, such as the office network, your Microsoft 365 tenant or a clinic’s patient records system.
- Owner. Name one person accountable for the audit and for tracking fixes afterward.
- Access. Arrange read-only administrative access for the auditor to your identity platform, firewall, endpoint tools and backup console.
- Existing documents. Gather network diagrams, the asset list if one exists, vendor contracts, your incident response plan and past audit or insurance questionnaires.
- Data map. Note where personal information, financial records and client files live, including laptops, shared drives, email and third-party apps.
- Regulatory context. List which rules apply to you: PIPEDA for most commercial activity, Ontario’s PHIPA for health information custodians, PCI-DSS if you take card payments, and sector rules for finance or legal practices.
The checklist
The Centre’s guidance gives best practices for network audits and the areas an audit should evaluate: device inventories, vulnerability scans, patch verification, plus policies on incident handling, disaster recovery, passwords, encryption and backups. The checklist below builds on those and adds the small-business realities we see most often. For a deeper network-only view, see our network security checklist for small business.
1. Assets and data inventory
The Centre recommends keeping a regular inventory of network devices, including hostnames, serial numbers and code versions. Extend that idea to everything you own or rent.
- Every laptop, desktop, phone, tablet, server, printer, router, switch and access point is listed, with an owner and a purchase or lease date.
- Every cloud service and SaaS application is listed, including the ones staff signed up for without asking.
- Personal information is mapped: what you collect, where it is stored, who can see it, how long you keep it.
- Devices that are end of life, no longer receiving vendor updates, are flagged for replacement.
- Former employees’ devices and accounts are accounted for.
2. User accounts and access control
Stolen or guessed credentials remain one of the most common ways in. Check:
- Multi-factor authentication is enforced, not merely available, on email, remote access, the password vault and every administrator account.
- Each person has a unique account. Shared logins are eliminated or tightly justified.
- Access follows job role. Reception staff do not need the finance folder; a contractor does not need access after the project ends.
- Administrator rights are limited to a short named list, and admins use a separate account for daily work.
- Leavers are disabled the same day, and the audit samples the last five departures to prove it.
- Password rules favour length and uniqueness, and a business password manager is in use.
- Dormant accounts, untouched for 90 days or more, are reviewed and removed.
Healthcare teams should pair this section with our explanation of what access controls actually do for healthcare data security.
3. Endpoints, devices and patching
The Canadian Centre for Cyber Security’s guidance for small and medium organizations names four foundational actions: an incident response plan, patching systems, strong user authentication, and backing up and encrypting data. Patching is the one most often postponed.
- Operating systems and applications on every device receive security updates, and the audit shows current patch levels rather than the policy.
- Third-party software, browsers, PDF readers and remote access tools are patched, not just Windows.
- Endpoint protection is installed, reporting and alerting on every device, including remote laptops.
- Disk encryption is on for laptops and portable devices.
- Devices lock automatically and can be wiped remotely if lost.
- Personal devices used for work follow a written rule, ideally with managed enrollment.
4. Network and perimeter
- The firewall firmware is current, unused rules are removed and management interfaces are not exposed to the internet.
- Remote access runs through a VPN or zero-trust gateway with MFA, not an open remote desktop port.
- Guest Wi-Fi is separated from the business network, and point-of-sale or medical devices sit on their own segment.
- Default passwords on routers, cameras, printers and other devices have been changed.
- A vulnerability scan of internal and external addresses has been run, results reviewed and critical findings assigned owners.
- Logs from firewalls and key systems are collected and someone actually reviews them or an alerting service does.
5. Email, Microsoft 365 and cloud services
For most small businesses, the email tenant is the front door and the filing cabinet at once.
- SPF, DKIM and DMARC are configured to reduce spoofing of your domain.
- Mail filtering blocks malicious attachments and links, and external-sender warnings are visible.
- Legacy authentication is disabled, and conditional access limits sign-ins by location or device health.
- Mailbox forwarding rules to outside addresses are reviewed, since attackers use them to hide.
- Sharing settings for SharePoint and OneDrive are checked so “anyone with the link” is not the default.
- Admin and sign-in audit logs are enabled and retained.
If you want a specialist to review these settings, our Microsoft 365 optimization service covers exactly this configuration work.
6. Backup and recovery
A backup that has never been restored is a hope, not a control. The Centre’s audit guidance says backup and recovery strategies should be tested. Greece’s national cybersecurity authority describes a useful target in its handbook: the 3-2-1-1-0 model, meaning three copies, on two media types, one offsite, one immutable, and zero errors in restore tests.
- Critical systems and data, including Microsoft 365 mailboxes and files, are covered by backup.
- At least one copy cannot be altered or deleted by a compromised administrator account.
- A real restore has been performed in the last quarter, with the time it took written down.
- Recovery time and recovery point targets are agreed with the business, not guessed.
- Backups are encrypted in transit and at rest.
Our automated cloud backup and data backup and disaster recovery pages describe how we approach this for clients.
7. Incident response and breach readiness
- A written incident response plan exists with named roles, after-hours phone numbers and the first five actions to take.
- The plan has been exercised. The same Greek handbook calls for regular tabletop exercises, with gaps documented and fixed by assigned owners.
- You know who to call: your IT provider, your cyber insurer, legal counsel and, where required, regulators.
- Evidence preservation is considered. Machines are isolated, not wiped, until someone qualified decides.
- A breach log template is ready, which links directly to the privacy duties below.
8. Vendors and suppliers
- Every vendor that touches your data or systems is listed, along with what they can reach.
- Contracts state security expectations, breach notification timing and what happens to your data at termination.
- Vendor access, such as remote support tools, is time-limited, logged and protected by MFA.
- Payment processors and cloud platforms provide current compliance attestations you have actually requested.
9. People and training
- New hires receive security training in their first week, and all staff refresh at least yearly.
- Phishing simulations are run and results tracked over time, not just completion rates.
- Staff know the one-step way to report a suspicious email or lost device without fear of blame.
- Finance staff follow a call-back rule for payment or banking changes.
Topic ideas that produce measurable change are covered in our guide to security awareness training topics.
Canadian and Ontario obligations to build into the audit
Generic checklists, especially American ones, miss the legal layer. Add these checks.
PIPEDA. Organizations subject to PIPEDA must report breaches that pose a real risk of significant harm, notify affected individuals and keep records of all breaches. Records must be kept for at least two years. Audit question: if a laptop with client files vanished today, could you show who decides on risk of harm, who notifies, and where the record goes? Our PIPEDA compliance guide and overview of Canadian data privacy laws go further.
PHIPA in Ontario. Health information custodians should hold a privacy breach protocol covering containment, investigation, notification and remediation, and be ready for possible involvement of the Information and Privacy Commissioner. Ontario’s Commissioner also lists technical safeguards for small health care organizations, including firewalls, anti-virus software, encryption of mobile and portable devices, and regular monitoring of audit logs. The same handbook stresses that safeguarding duties apply to information whether it is oral, paper or digital, so the audit should include printed charts, fax machines and shared whiteboards, not only servers.
HIPAA. HIPAA is a United States law. It matters to a Canadian business mainly when you handle data for American covered entities or serve US patients under contract. If that is you, put it in scope explicitly and have it reviewed by someone who knows both regimes.
PCI-DSS. If you accept card payments, confirm which validation level applies, that card data is not stored on ordinary workstations and that your payment terminals are on a segmented network.
For a compliance-focused review, see our IT compliance and auditing service.
How to run the audit and record findings
- Collect evidence, not answers. For each checklist line, capture a screenshot, export or log. Date it.
- Score each item as in place and tested, in place but untested, partial, or absent.
- Write each finding in one sentence that states the gap and the consequence, for example: “Three former staff accounts remain active, allowing mailbox access.”
- Assign an owner and a due date to every finding. An unowned finding is a finding that returns next year.
- Share results. The Centre advises sharing audit findings and recommendations with relevant stakeholders, which in a small firm means the owners, the office manager and your IT provider.
Prioritizing fixes by risk and cost
Not every gap deserves the same urgency. Rate each finding on three simple scales of one to three: how likely exploitation is, how severe the impact on operations, client data or compliance, and how hard the fix is. Then sort.
| Priority | Typical profile | Examples | Timeframe |
|---|---|---|---|
| Immediate | High likelihood, high impact, low effort | MFA missing on email, former staff accounts active, exposed remote desktop | Days |
| Next | High impact, moderate effort | Untested backups, unpatched servers, no immutable copy | 30 to 60 days |
| Planned | Moderate impact, higher effort | Network segmentation, vendor contract updates, device replacement | One to two quarters |
| Monitor | Low impact | Minor policy wording, low-risk legacy apps | Next review |
One of the primary goals of auditing, according to the Centre, is to rectify issues before they cause downtime or operational impact. The table keeps that goal practical: remove the cheapest, most dangerous exposures first, then fund the larger projects in order.
How often to repeat it
The Centre recommends regular audits rather than a one-time exercise. A sensible rhythm for a small business is a full review annually, a lighter quarterly check of access, patching and backup restores, and an extra review after any significant change: a new office, a cloud migration, a merger, a major vendor swap or a security incident. Regulated practices in healthcare, finance and legal services should lean toward the shorter cycle.
Our perspective
Most small businesses we meet do not fail an audit because they lack tools. They fail because nobody owns the evidence. MFA is licensed but not enforced, backups run nightly but have never been restored, and the incident plan lives in a folder nobody has opened since it was written.
That is why we treat security as the foundation of managed IT, not an add-on. When monitoring, patching, endpoint protection, backup verification and access reviews are handled continuously by the same team that answers your helpdesk, the annual audit stops being a scramble. It becomes a confirmation of what is already measured every week.
Our approach is designed around fast response, with a target of under 30 minutes, and around compliance knowledge for regulated sectors such as healthcare and finance. If your audit turns up more gaps than your team can close, assign them to people whose daily job is closing them.
247techify Team
Get the audit done and the gaps closed
If you would rather not run this alone, we can review your environment against the checklist above and then keep it in shape. Our cybersecurity services include managed detection and response, an AI security readiness assessment and penetration testing, and our penetration testing page explains what a tester will probe once your controls are in place.
For ongoing coverage, business managed IT in the Greater Toronto Area is published at $1,099 to $2,499 CAD per month, depending on the environment. For a single problem, pay-per-ticket support is $79 per ticket, and all plans are listed on our pricing page. Based in the GTA? See managed IT services in Toronto.
FAQ
What is the difference between a cybersecurity audit and an IT health check?
A cybersecurity audit tests security controls and compliance evidence: access, patching, backups, logging and policies. An IT health check is broader and also looks at performance, hardware age, licensing and reliability. Most small businesses benefit from combining both, because downtime and breaches often share the same root causes, such as unpatched or unsupported systems.
How long does a small business audit take?
Preparation and evidence gathering usually take longer than the review itself. For a small office with one network and a Microsoft 365 tenant, expect a few days of active work, then a written report with ranked findings. Larger or regulated environments, or those with several locations, take longer.
Do I need an outside auditor?
The Canadian Centre for Cyber Security says auditors should not be responsible for managing the systems they audit. If your owner or one IT person built everything, an independent specialist gives a more reliable result and also satisfies insurers and clients who ask for third-party evidence.
Does HIPAA apply to my Canadian clinic or firm?
Not automatically. HIPAA is American law, so it generally matters when you act for US healthcare entities or handle US patient data under contract. Ontario custodians are bound by PHIPA, and most other Canadian businesses by PIPEDA or provincial equivalents. If you are unsure which applies, have a compliance specialist confirm it in writing.
What should I fix first after the audit?
Start with gaps that are both easy to exploit and cheap to close: enforce MFA, disable stale accounts, patch internet-facing systems and prove that you can restore a backup. Then move to segmentation, vendor contracts and training.
Sources
- Network security auditing (ITSAP.80.086), Canadian Centre for Cyber Security
- Top measures to enhance cyber security for small and medium organizations, Canadian Centre for Cyber Security
- Cybersecurity Handbook, Greece national cybersecurity authority
- What you need to know about mandatory reporting of breaches, Office of the Privacy Commissioner of Canada
- Responding to a Health Privacy Breach: Guidelines for the Health Sector, Information and Privacy Commissioner of Ontario
- A Privacy Management Handbook for Small Health Care Organizations, Information and Privacy Commissioner of Ontario