The Security Protections Every Business Needs: From Website to Server Room Door

Why it matters now: attacks are faster, and losses are at a record

Artificial intelligence (AI) has changed cybersecurity in the last two years. Attackers use it to write convincing phishing messages in any language, clone voices, find weak systems and move through a network faster than ever, so the time a business has to react has shrunk from days to minutes.

What this means: protections have to work automatically and around the clock, such as automatic isolation and a team that watches alerts at night, and patches for actively exploited weaknesses have to go on within days, not at the next quarterly maintenance window.

Website: a web application firewall

If you have a website, it is open to the whole internet every minute of the day. A web application firewall (WAF) sits in front of the site and blocks common attacks, such as attempts to break into the login page, inject code or exploit known weaknesses in the website platform, before they reach your server.

• Keep the website platform, themes and plugins updated; recent critical flaws in PHP (the programming language many websites are built on) showed how quickly unpatched sites are targeted.
• Use HTTPS (encrypted web connections) everywhere, a second step at sign-in for every admin account, and daily backups kept away from the web server.
• Licensed images and video only: use pictures and videos you own or have paid for from a proper stock source, and keep the licence records; images copied from the internet can bring copyright claims.
• Check what your site shows the public with our free Website Vulnerability Check.

Computers and servers: EDR with MDR and automatic isolation

Traditional antivirus looks for known bad files. Modern attacks often use no known file at all. Every computer and server needs:

• Endpoint detection and response (EDR): security software that watches how each computer and server behaves and stops activity that looks like an attack, such as files being encrypted by ransomware.
• Managed detection and response (MDR): a team of security analysts who watch those alerts around the clock and act on them, because an alert at 2:00 a.m. that nobody reads protects nobody. When they detect malicious activity on a user's computer or a server, day or night, the MDR team contains it and contacts you right away to tell you what happened and what to do next.
• Automatic isolation: when one or more computers are attacked, the affected devices are automatically cut off from everything except the security team's console, so the attack cannot spread to the rest of the office while the team investigates.

Servers need the same protection as laptops, plus restricted remote access and separate admin accounts.

Network: a firewall, separate networks and monitoring

A basic internet router is not a firewall. A business firewall with active security services inspects traffic for intrusion attempts, malware and dangerous websites, and blocks them. Keep its software and security subscriptions current, allow remote access only through a protected connection with a second step at sign-in, and review its alerts.

Separate networks (VLANs) with firewall rules between them

A flat network, where every computer, phone, printer and camera can reach every other device, lets one infected laptop reach the finance computer and the server. Divide the network into separate virtual local area networks (VLANs) by role, and let the firewall decide what may cross between them:

• Separate VLANs for regular staff, finance, executives, servers, printers, cameras and smart devices, guests, and network management. Where the business is large enough, regular staff should not share a network with finance or executives.
• Firewall policies between every VLAN that block by default and allow only the traffic each group needs, for example staff to the printers and the business application, but not to finance computers, server admin interfaces or the camera system.
• Wired ports assigned by role: network wall ports in reception or meeting rooms should not land on the finance or server network.

Devices and apps that detect and report network activity

• Alerts on new or unknown devices the moment they join any wired or wireless network.
• Attack detection in network traffic: intrusion detection, or network detection and response (NDR), spots scanning, attempts to move from one computer to another, connections to known malicious servers, and traffic that looks like ransomware.
• Traffic flow tracking: which devices talk to which, how much data leaves the network and where it goes, so unusual uploads at night stand out.
• Monitoring of the network equipment itself: configuration changes, failed admin sign-ins, and devices going offline.
• Regular reports on blocked threats, top users of bandwidth and new devices, to a person who actually reads them.

Many network devices or several locations: a SIEM

Once a business has many network devices, several offices or a mix of on-site and cloud systems, nobody can read every device's logs separately. A security information and event management (SIEM) system collects the logs from firewalls, switches, Wi-Fi, servers, computers and cloud accounts at every location into one place, links related events together, and raises an alert when they add up to an attack, such as the same account failing to sign in at two offices and then succeeding from another country. Paired with the MDR team, a SIEM shows the full picture across all sites and keeps the records you need to investigate an incident.

Wi-Fi: rogue access point detection and dedicated firewall ports

• Rogue network and access point detection: business Wi-Fi systems can detect and alert on fake networks that imitate yours, and on unauthorized access points someone plugs into your office network.
• Wi-Fi on dedicated firewall ports: connect the access points to dedicated firewall ports, or through switches to the firewall, and map each Wi-Fi network name (service set identifier, or SSID) to its own VLAN, so wireless traffic passes through the same firewall rules and inspection as wired traffic. A guest SSID should reach only the internet.
• Current Wi-Fi security: Wi-Fi Protected Access 3 (WPA3) where your devices support it, separate staff and guest networks, and a guest password changed regularly.

Cloud email and files (for example Microsoft 365 or Google Workspace)

• Sign-in rules that block sign-ins from unmanaged devices, unusual countries or risky sessions, on top of the second sign-in step.
• Few administrators: two or three named admin accounts, used only for admin work and protected with the strongest sign-in method available.
• Audit logging turned on and kept, so you can investigate what happened in a mailbox or file library.
• Limits on external sharing of files and calendars, and alerts when mail is forwarded automatically outside the company.
• Admin approval before staff can grant apps access to company email or files; attackers often trick users into approving a malicious app.
• Backups of cloud data: cloud providers keep deleted items only for a limited time, so back up email, files and team sites separately.
• Guest and contractor accounts that expire automatically, and shared mailboxes that cannot be signed in to directly.
• Social media and website accounts owned by the company, with a second sign-in step and more than one named admin, so one person leaving or being hacked cannot lock you out.

Email and DNS security: two layers

Many of today's phishing emails contain no attachment and no bad link, and look exactly like a real message from a client, a supplier or your own manager. That is why email needs two layers of protection:

• Layer 1, filtering and authentication: spam, malware and known-bad link filtering, and email authentication records: Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC), which tell other mail servers which senders are really you. Move DMARC in stages to a policy that blocks fake email sent in your own domain's name. Check yours with our free Email and Domain Security Check.
• Layer 2, artificial intelligence (AI) driven detection: a second layer that learns how your business normally communicates (who writes to whom, how, and about what) and flags messages that do not fit, even when they pass every technical check. It catches phishing that copies a legitimate email, messages from lookalike domains that differ from a real supplier's by one letter, sudden requests to change payment details, and a compromised account sending unusual email. Together, the two layers protect against the full range of email threats, including business email compromise (BEC), where an attacker poses as a supplier or executive to redirect a payment.
• Data loss prevention (DLP) on email: rules that detect credit card numbers, and other sensitive data such as social insurance numbers and health information, in outgoing email and attachments, then block the message, encrypt it, or warn the sender. The Payment Card Industry Data Security Standard (PCI DSS), maintained by the PCI Security Standards Council that the major card brands founded, requires card numbers to be protected with strong encryption whenever they are sent by email or other messaging, so card details should never travel in a plain email.
• A payment-change rule that no technology replaces: any request to change bank details is confirmed by phone, using a number you already have on file.

DNS security: every website visit and many attacks begin with a Domain Name System (DNS) lookup, the internet's address book. Protective DNS filtering checks each lookup against known malicious and newly registered domains and blocks it before a connection is made, for computers in the office and, with the right setup, for laptops away from it. On your own domain, turning on DNS Security Extensions (DNSSEC), which digitally sign your DNS records, and locking the registrar account with a second sign-in step greatly reduce the risk of attackers redirecting your website or email.

Accounts and passwords

• A second step at sign-in (multi-factor authentication) on email, remote access, banking and every cloud service.
• A business password manager for every staff member: passwords, Wi-Fi keys, door and alarm codes, recovery codes and other secrets are stored and shared only through the password manager, never in email, chat or text messages, plain text files or spreadsheets, and never written on paper, sticky notes or under the keyboard. Shared accounts are shared through the manager's secure sharing, access is removed in one step when someone leaves, and the manager creates a unique, strong password for every account, so one leaked password cannot unlock the others.
• Separate admin accounts used only for admin work; daily work happens on standard accounts.

Hardening computers and devices

• No local administrator rights for daily work, so malware a user opens cannot install itself across the computer.
• Approved software only: application control, so only approved programs can run or be installed.
• Office macros from the internet blocked, a common way malware arrives in attachments.
• Removable storage controlled: Universal Serial Bus (USB) storage blocked or limited to encrypted, company-issued drives.
• Default passwords changed on cameras, printers, routers, door controllers and every other device, and unused services turned off.
• A secure standard setup for every new computer and server, so each one starts with the same protections.

Patch everything, always

Attackers scan the internet around the clock for devices and software with known, unpatched weaknesses; once a fix is published, exploits often follow within days. Patching has to cover everything, not only Windows:

• Computers and servers: operating system updates, and every installed application, including browsers, Portable Document Format (PDF) readers, office software and plug-ins.
• Network and building devices: firmware on firewalls, switches, Wi-Fi access points, printers, cameras, door controllers and other connected devices.
• Websites: the platform, themes, plugins and the server software underneath, such as PHP.
• Phones and tablets: operating system and app updates, enforced through device management.
• Speed by risk: weaknesses that are already being exploited get patched first, within days; everything else on a fixed monthly schedule.
• A patch management tool with reports that shows which devices are missing updates, so nothing is forgotten.
• Replace what can no longer be patched: operating systems, devices and apps past their end of support stay vulnerable. Our Windows Support Checker shows where your computers stand.

Backups, encryption and data

• 3-2-1 backups: at least three copies, on two different types of storage, with one copy offline or unchangeable, and restores tested on a schedule.
• Encryption: laptops, phones and backups encrypted, so a lost device does not expose data.
• Mobile device management (MDM) on every mobile device: every company phone and tablet, and any personal device that accesses company data, is enrolled in MDM, which enforces a screen lock, encryption and updates, keeps company apps and data separate, and lets you locate, lock or remotely wipe a lost or stolen device, or remove only the company data from a personal one.
• Company devices stay company devices: phones, tablets and computers that lock themselves to the user's account, such as Apple devices with Activation Lock, can become unusable when an employee leaves if they were set up with that person's personal account. Buy company devices through Apple Business Manager (or Android Enterprise zero-touch enrolment for Android devices) so they enrol in your MDM automatically, sign staff in with a company-owned work account rather than a personal one, and let the MDM manage Activation Lock. When someone leaves, you keep full access, can wipe the device and can hand it to the next person, instead of it staying locked to a former employee.
• Secure file sharing with links that expire and require sign-in, instead of sending sensitive files as email attachments.
• Collect only what you need and keep it only as long as needed; information you never collected cannot be stolen.
• Web filtering and central logging that someone actually reviews.

Remote work, travel and phone systems

• Home networks: staff routers updated, with default passwords changed, and company devices kept separate from family devices where possible.
• Public Wi-Fi and charging: use the company's protected connection on public Wi-Fi, and your own charger instead of public USB charging stations.
• Devices in transit: laptops never left in cars, privacy screens in public places, and lost devices reported the same day so they can be locked and wiped.
• Phone system fraud protection: strong voicemail and admin personal identification numbers (PINs), international and premium-rate calling blocked unless needed, and alerts on unusual call volumes, because attackers break into business phone systems to make costly calls.
• Caller ID can be faked: staff should never trust the number shown and should call back on a number on file before acting on any request.

One platform that works together

If the budget allows, a bundled security platform, where the firewall, network switches, Wi-Fi, endpoint protection and website protection come from one ecosystem and share alerts, protects the whole environment as one system. For example, when the endpoint protection detects an attack on a laptop, the network can block that laptop automatically, on cable or Wi-Fi. Separate products from different vendors can be protected well too; they simply need more work to connect and monitor.

Security awareness training (SAT): every six to twelve months

Technology stops most attacks, but people are the target of the rest. Every staff member, including owners and managers, should complete security awareness training at least once a year, and ideally every six months, with a short session for every new hire before they get access to email and systems. Training should cover both cyber and physical attacks:

• Phishing in every form: email, text messages, phone calls, quick response (QR) codes and messages through collaboration apps.
• Social engineering and manipulation: pretexting, urgency and authority pressure, fake IT support calls, and voice or video impersonation of a manager or client made with AI.
• Business email compromise and payment fraud: fake invoices, changed bank details and gift card requests, and the call-back rule that stops them.
• Physical attacks: tailgating, people posing as couriers, contractors or inspectors, found USB memory drives, and unattended screens and documents.
• Insider risk and sabotage: recognizing and reporting misuse of access, data taken without a business reason, or deliberate damage to systems.
• Fraud and money laundering red flags: unusual payment requests, transactions that do not make sense for the client, and pressure to bypass checks. Businesses covered by Canada's anti-money-laundering law, which reports to the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), must also keep a written, ongoing compliance training program as part of their compliance program.
• Safe handling of information and how to report anything suspicious, quickly and without blame.

Back the training with practice phishing emails through the year, extra coaching for anyone who clicks, and a record of who completed each session; insurers and auditors often ask for it.

Handling calls that fish for staff and executive information

Many attacks start with a friendly phone call. The caller may claim to be a new employee, IT support, a supplier, a courier, a recruiter, an auditor or a client, and ask one person for small pieces of information: who manages accounts payable, the chief financial officer's email address, when the owner is travelling, a direct extension, or which software the office uses. Each answer seems harmless; together they let the attacker write a convincing fake email to the right person at the right time.

• Do not confirm or give out staff names, titles, reporting lines, direct numbers, email addresses, schedules, travel plans, or which systems and suppliers you use, to anyone you cannot verify.
• Take a message instead. A simple script works: "I am not able to share that, but I can take your name, company and number and pass on a message."
• Verify by calling back on a number you already have on file or find independently, never on the number the caller gives you.
• Never transfer an unknown caller straight to an executive or finance, and never let urgency, authority or a friendly tone override the rule.
• Never share passwords, sign-in codes or remote access with a caller, even one who says they are from IT; a real IT provider will not ask for your sign-in code.
• Report every suspicious call with the time, the number shown, what was asked and what was said, and warn colleagues the caller might try next.
• Apply the same rules to email, text messages, social media and visitors at reception, and limit what staff directories and social media profiles reveal about who approves payments.

Practise zero trust

Zero trust means no person, device or connection is trusted automatically because it is inside the office or already signed in. Every access is checked every time:

• Verify every sign-in with a second step, and check that the device is a managed, updated company device before it reaches company data.
• Least privilege: each person gets only the access their role needs, for only as long as they need it; admin rights are granted for a task and then removed.
• Separate and limit: networks divided by role, and sensitive systems such as finance and backups reachable only by the people and devices that need them.
• Assume a breach can happen: monitor continuously and review access regularly, at least every quarter for critical systems.

Separation of duties and mandatory vacations

Fraud, sabotage and serious mistakes are much harder when no single person controls a whole process from start to finish.

• Separation of duties: no single person can both create and approve a payment, add a new supplier and pay it, or make and approve their own system changes.
• Code written with AI: if code for a website or app is written with the help of AI tools, a qualified person always reviews it for security and for the laws that apply wherever the site or app is used, such as privacy, accessibility and consumer protection rules in Canada and in every other country you serve, before it goes live.
• Development teams: if you build software or websites, the people who test, review and audit the code must be separate from the people who wrote it. Every change is reviewed by someone else before it is approved, tested by people who did not write it, and deployed only after an independent approval; auditors never audit their own work.
• Mandatory vacations for critical positions such as finance, payroll, accounts payable and IT administrators: insider fraud often needs constant attention to stay hidden, so it tends to surface when the person is away. Each person takes one continuous block of paid vacation every year, with no remote access to their systems during that time, while a trained colleague performs their duties and reviews their transactions, approvals and access.
• Job rotation where practical, so more than one person understands every critical task.

Employees in BC become entitled to paid annual vacation under the Employment Standards Act after 12 months of employment. The policy asks critical staff to take part of that entitlement as one continuous paid block of at least one week, and does not reduce it.

Background checks for critical positions, done lawfully

People in critical positions, such as IT administrators, finance and payroll staff, and anyone with keys to the server room or authority to move money, can do the most damage if they act against the business. Screening for these roles is reasonable when it is done fairly and within the law:

• Decide the checks by role, not by person. Define in writing which positions are critical and which checks each one requires, and apply the same checks, with the same look-back period, for example the past five years, to every candidate for that role.
• Tell candidates in writing which checks you will do, and get their consent before contacting references or previous employers.
• Criminal record checks through a police service or an RCMP-accredited company, which search the Royal Canadian Mounted Police (RCMP) national repository of criminal records, with the candidate's written consent, usually after a conditional job offer. Employees of organizations covered by BC's Criminal Records Review Act, such as provincially funded or licensed organizations whose staff work with children or vulnerable adults, must complete a check through the provincial Criminal Records Review Program, and some government contracts require federal security screening.
• Time lived outside Canada: if any candidate lived outside Canada during the look-back period, ask for police certificates from those countries, and accept equivalent verifiable references where a country does not issue certificates.
• Credit checks only where they are reasonable for the specific role, such as positions that handle money or banking access, with written notice to the candidate and their consent.
• Reference, employment and credential verification for every critical role.
• Verify documents at the source where possible: with the issuing body or through a reputable screening company; where a country issues certificates only to the individual, review the original and verify it as far as the issuing country allows. Forged documents exist everywhere, and a clean record only shows that nothing was recorded.
• Control access, not people: nobody receives administrator, financial or server room access until the checks for that role are complete. A new hire can start with standard access, with privileged access added step by step.

Most important, rely on controls that work no matter who someone is: least privilege, separation of duties, dual approval for payments and admin changes, monitoring of privileged actions and mandatory vacations, so that no single person can move money or take over systems alone, whatever their background.

The policies behind the protections

Technology and locks only work when everyone follows the same rules. A business of around 20 to 100 people should have written, approved policies, confirmed by staff and reviewed at least once a year. Some can be combined into one document; what matters is that each topic is covered.

Retention: keep what you need, for as long as you must, and no longer

A retention policy lists each type of record (financial, payroll, client files, contracts, email, video recordings, logs and backups), how long it is kept, who owns it, and how it is destroyed. Some periods are set by law:

• The Canada Revenue Agency generally requires business records to be kept for six years from the end of the tax year they relate to.
• In BC, the Personal Information Protection Act requires personal information used to make a decision about a person to be kept for at least one year after the decision, so the person can ask to see it, and otherwise only as long as it is needed.
• Organizations covered by the federal Personal Information Protection and Electronic Documents Act (PIPEDA) must keep a record of every breach of security safeguards for 24 months.

Keeping personal information no longer than needed reduces both storage costs and the damage of a breach. Your accountant and lawyer can confirm the periods that apply to your industry; regulated professions often have longer ones.

Testing and reviews

• Vulnerability scans of the network and website on a schedule, at least every quarter.
• A penetration test once a year or after major changes: an authorized, independent security specialist tries to break in the way an attacker would, and reports what to fix.
• Tabletop exercises: walk the team through a realistic incident, such as ransomware on a Monday morning, to test the incident response plan.
• A yearly security review of every layer in this guide with your IT provider, with a written list of what to improve.

Incidents, reporting and insurance

• A written incident response plan: who to call, who decides, how to reach staff if email is down. Test it once a year.
• Supplier and contractor access limited to what they need, and removed the day the work ends.
• Report cyber incidents and fraud to your local police, to the Canadian Anti-Fraud Centre and to the Canadian Centre for Cyber Security. Report privacy breaches to the privacy commissioner where the law requires it, and tell your cyber insurer right away, as most policies require prompt notice.
• Free government guidance: the Canadian Centre for Cyber Security publishes baseline security controls for small and medium organizations, and the federal CyberSecure Canada program offers a certification that shows clients and partners you meet a recognized baseline.
• Cyber insurance sized to your real exposure; see Cyber Insurance for BC Businesses.

Many breaches start with someone walking in, or with paper and old devices leaving the building the wrong way.

Doors, access and anti-tailgating

• Access control: door fobs or cards instead of shared keys, so access can be removed instantly and every entry is logged.
• Biometrics such as fingerprint readers are used by some businesses with high-security areas. Biometric data is sensitive personal information, so assess whether a less intrusive option such as a fob would do, offer staff an alternative where possible, and get privacy advice before you install it.
• Anti-tailgating for critical environments: high-tech companies, data centres and other critical sites often use a mantrap (a security vestibule): a small space between two interlocking doors, where the second door opens only after the first has closed and the person has been verified, so nobody can follow an authorized person in. Security turnstiles and tailgating alarms on access-controlled doors do a similar job at lower cost. Interlocking doors must meet fire and building code requirements for emergency exit, so plan them with your building owner and a qualified installer.
• A monitored alarm system for after-hours entry, and keys and fobs collected on the day someone leaves.

Cameras

• Security cameras at entrances, reception and sensitive areas.
• Follow BC privacy guidance: the Office of the Information and Privacy Commissioner for BC expects businesses to consider less intrusive options first, post clear notice that cameras are in use, and keep cameras out of places where people expect privacy.
• Record video only, not audio, point cameras at entrances and assets rather than at employees' workstations, tell staff in writing why the cameras are there, and keep recordings only for a short, defined period unless an incident requires longer.
• Access to recordings limited to named people and logged.

Visitors

• Every visitor signs in and out on an individual slip or a digital log that other visitors cannot see, giving only their name, company, host and times; keep the log for a set, short period.
• Every visitor receives a visible visitor badge and is escorted at all times while in the office. Collect the badge on the way out.

Paper, printers and clean desks

• Shredders: a cross-cut or micro-cut shredder for anything with personal or business information. Under the DIN 66399 standard (from DIN, the German Institute for Standardization, and widely used for shredder security levels), security level P-4 (cross-cut) or higher is commonly recommended for business documents, and P-5 or higher for highly sensitive records such as medical or financial files. Use locked shredding bins rather than open recycling boxes.
• Printers: secure print release, so documents print only when the person is at the printer, and a wiped or destroyed drive when a printer or copier leaves the office.
• Clean desks and privacy screens where the public can see screens, and a locked area for mail and deliveries.
• Garbage and recycling rooms: locked, lit and covered by a camera, with confidential paper never going into regular garbage or recycling.

Retiring devices: wiping data before recycling

A computer, server, firewall, printer or phone that leaves your office can carry client files, saved passwords, network settings and encryption keys. Every device should follow the same written process, whether it is reused, donated, returned at the end of a lease or recycled:

1. Keep an asset register of every device with its serial number, user, location and the kind of information it holds.
2. Decide the outcome by sensitivity. Devices that held health, financial or other highly sensitive information, and every executive's device, should be physically destroyed or wiped with the strongest method.
3. Save what you must keep before the device is wiped.
4. Remove the device from every system: device management, the company directory, manufacturer and cloud account locks (such as activation locks on phones and tablets), certificates, licences, and stored virtual private network (VPN) or Wi-Fi profiles.
5. Wipe it with the right method for the media:
   • Hard disk drives: overwrite with verified wiping software, or degauss or physically destroy.
   • Solid-state drives, USB flash drives and memory cards: simple overwriting is not reliable on flash storage. Use the manufacturer's secure erase or a cryptographic erase on a drive that was encrypted, or physically destroy it.
   • Phones and tablets: confirm encryption was on, sign out of all accounts, remove the subscriber identity module (SIM) and memory cards, then perform a full factory reset.
   • Servers and storage: wipe every drive in the array individually, plus any management controller settings and stored credentials.
   • Firewalls, switches and Wi-Fi equipment: back up and then erase configurations, saved passwords, VPN keys, certificates and logs, and reset to factory defaults.
   • Printers and copiers: wipe or remove the internal storage, address books and scan-to-email settings.
6. Verify and record the device, serial number, method, date and the person who did it.
7. Keep a chain of custody: locked storage until pickup, and a signature for each device by serial number.
8. Use a reputable recycler, ideally with on-site or witnessed destruction, and get a certificate of destruction that lists the serial numbers.

The Government of Canada's guidance IT Media Sanitization (ITSP.40.006) describes sanitization methods for each type of storage in detail.

Large offices and parking areas

• Even lighting with no dark gaps across parking stalls, walkways and entrances. There is no single correct spacing: it depends on pole height and fixture type, so have a lighting designer lay it out for even coverage rather than brightness alone.
• Cameras with motion detection covering the parking area, entrances and the building perimeter.
• Smart detection: modern camera systems can use AI to tell people and vehicles apart, read licence plates where lawful, and alert on activity inside defined zones (geofencing) after hours, which cuts false alarms.
• Video stored securely, access to recordings limited and logged, and a retention period set in a written policy.

The server room

• A locked door with fob access that is logged, limited to the people who need it.
• A camera inside the room facing the door, so every entry and who came in is recorded.
• Locked server racks and network cabinets.
• An uninterruptible power supply (UPS) and surge protection, temperature and water sensors that send alerts, and fire protection suitable for electronic equipment.
• No storage, cleaning supplies or personal items in the room.

The checklist

The IT Security Checklist helps you see where you stand today.

Sources: Canadian Anti-Fraud Centre, Top 10 frauds in 2025; Canadian Centre for Cyber Security, National Cyber Threat Assessment 2025-2026; industry threat reports linked under each chart; Office of the Information and Privacy Commissioner for British Columbia, Guidelines for Overt Video Surveillance in the Private Sector; BC Employment Standards: vacation; BC Criminal Records Review Program; RCMP, criminal records; Canadian Centre for Cyber Security, IT Media Sanitization (ITSP.40.006) and resources for small and medium organizations; DIN 66399 security levels as summarized by a shredder manufacturer's reference page; National Academies, parking lot lighting uniformity guidance. This article is general information, not legal advice.