October is Cyber Security Awareness Month in Canada, run by the Communications Security Establishment and its Canadian Centre for Cyber Security through the Get Cyber Safe program. This year's theme is Your best defence is you, and the month is split into four weekly topics: recognize cyber threats, strengthen your defences, protect your information, and build your cyber security community. Awareness campaigns are easy to ignore. This one is worth borrowing, because the four-week structure happens to be a workable plan for the security work a small business keeps deferring.
Week 1: recognize cyber threats
The federal focus here is phishing, fake messages and AI-assisted scams. The useful small-business version is not a lecture, it is a shared vocabulary. Spend twenty minutes with your team on what a current attack actually looks like: a message that creates urgency, a login page that is almost right, a request to change payment details, a voice on the phone that sounds like someone you know. Agree on the rule that matters more than any detection skill, which is that nobody gets in trouble for pausing to verify. Our phishing training guide has the short version.
Week 2: strengthen your defences
Passwords, password managers and multi-factor authentication. This is the week with the highest return per hour spent. Concretely: get a password manager in place so people stop reusing credentials, turn on multi-factor authentication everywhere it is available and prioritize email first, and move toward passkeys or an authenticator app rather than codes by text. If you only do one week of this month, do this one.
Week 3: protect your information
The federal framing is banking, shopping and government services online. For a business, translate it to: where does your important data live, who can reach it, and would you get it back. That means checking who has access to your financial accounts and your email, confirming you have backups of the things that would end the business if lost, and actually restoring one file to prove the backup works. A backup nobody has tested is a hypothesis.
Week 4: build your cyber security community
The campaign means sharing knowledge and helping others. For an owner-operated business the practical version is reducing the number of things that only live in one person's head. Who do you call at 2am. Where is the list of your systems and who administers them. Does anyone besides you know how to lock an account or reach your IT provider. This is the week to write down the two pages that let someone else act when you cannot.
Why bother with a campaign
Honestly, because arbitrary deadlines work. Security work for a small business is rarely blocked by not knowing what to do, it is blocked by it never being this week's problem. A month with four named weeks and a free set of government materials removes the planning excuse. The materials are genuinely good and genuinely free, with no vendor attached, which is rarer than it should be in this field.
What to actually do
- Pick four dates now and put a 30-minute block in the calendar for each week. Done is better than thorough.
- Start with week 2 if you are behind. Multi-factor authentication on email is still the single highest-value control available to a small business.
- Make one thing permanent per week, not four. A password manager that sticks beats four initiatives that fade.
- Use the free material. Get Cyber Safe publishes posters, social content and explainers you can hand to staff without writing anything yourself.
- Finish with a written list of what you changed. Next October that list is your starting point instead of a blank page.
The takeaway
The theme is right: for a small business the deciding factor usually is the people, not the products. A team that pauses to verify a payment change prevents more loss than most software you could buy this month. Four half-hour sessions and one permanent habit per week is a realistic version of that, and it is considerably more than most businesses will do in October.