IT Infrastructure Security Checklist: Best Practices for SMBs

Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.

Key Takeaways

According to Statistics Canada (2024), 16% of Canadian businesses were impacted by a cyber security incident in 2023, and large firms were the most likely to be hit at 30%. Recovery spending across the country doubled to CA$1.2 billion over two years.

• Infrastructure security protects four layers at once: network, server, identity, and data. Skip one and the other three become a slower path to the same breach.
• Only 26% of Canadian businesses keep a written cyber security policy and 46% monitor their network and business systems (Statistics Canada, 2024).
• CIS Controls v8.1 and the Canadian Centre for Cyber Security baseline give Canadian SMBs a prioritized starting point that maps cleanly to PIPEDA expectations.
• The 8-control checklist below is what Fusion Computing deploys on every managed client onboarding, ahead of any optional tooling.
• Phishing-resistant MFA, hardened servers, immutable backups, and network segmentation are the four moves that prevent most of the incidents our engineers found in Ontario and British Columbia.

What is IT infrastructure security, explained in plain English

Infrastructure security is the practice of protecting the network, servers, identities, and data a Canadian business depends on, using 2 kinds of control: technical and administrative. The goal is to keep systems available, keep information confidential, and keep records accurate when something goes wrong. Everything else in a security program sits on top of it.

For a Canadian SMB the working definition is shorter. Infrastructure security is everything that stops a phishing email, a stolen laptop, or an unpatched server from becoming a reportable breach under PIPEDA. It sits beneath the application layer and beneath end-user training, which is why it is the layer to fund first.

Infrastructure security vs cybersecurity: the difference

Cybersecurity is the broader discipline. It covers application security, end-user awareness, governance, third-party risk, and infrastructure. Infrastructure security is the subset that protects the network, server, identity, and data layers, and it is where the highest-impact controls live for a firm of 10 to 150 people.

The distinction matters at budget time. A Canadian SMB that funds awareness training while running a flat network has bought the cheaper half of the 2. In our experience the reverse ordering, infrastructure first and awareness second, produces fewer incidents in the first year.

The 4 layers of infrastructure security: network, server, identity, data

According to Meyer et al. (2023), a Microsoft study of Azure Active Directory accounts found multi-factor authentication reduced compromise risk by 99.22% across the population and by 98.56% where credentials had already leaked. Identity is the layer with the best return, so MFA is the first move.

Every Canadian infrastructure security program protects the same 4 layers. Network controls keep traffic clean. Server controls keep workloads hardened. Identity controls decide who is allowed in. Data controls protect information regardless of where it lives.

Book a Consultation

Network security: firewall, segmentation, and VPN or ZTNA

According to the Canadian Centre for Cyber Security (2024), ransomware is the top cybercrime threat to Canada’s critical infrastructure, with state-sponsored and AI-assisted activity raising both the pace and the sophistication of intrusions. Segmentation is the control that limits how far any of it travels.

Network security decides where traffic can go before any other control fires, and 2 things do most of the work. A next-generation firewall enforces the Canadian perimeter and inspects encrypted traffic. Segmentation breaks the internal network into zones so a compromised laptop cannot reach a server VLAN unchallenged.

Remote access uses either a traditional VPN or Zero Trust Network Access, which verifies device posture and identity on every request. Microsoft Entra Private Access covers this for Microsoft 365-aligned clients. Older flat networks, where every device can see every other device, remain the single most common finding in our infrastructure audits.

When the perimeter appliance itself is past vendor end-of-life, run the firewall migration plan before touching segmentation. Replacing the device first avoids rebuilding zone policy twice. CIS Controls v8.1 Safeguard 12.2 and the Canadian Centre for Cyber Security baseline both formalize the expectation, so treat segmentation as table stakes.

Server hardening: CIS Benchmarks, patching, and monitoring

Most servers ship with defaults that favour easy setup over security, and hardening reverses those defaults. The CIS Benchmarks are the de facto standard, with prescriptive guides for Windows Server, Ubuntu, Red Hat, and the major cloud platforms. Auditors and cyber insurers both expect server baselines to align with them.

A typical Windows Server 2022 baseline tightens password policy, disables legacy SMBv1, restricts PowerShell, and audits privileged actions. None of it costs licensing money, which is why we run it during onboarding rather than as a project.

Patching is the second pillar. The Canadian Centre for Cyber Security lists automatic patching of operating systems and applications among the 13 baseline controls it scopes to organisations under 499 employees. We measured patch waves against a published window rather than the calendar, so a deliberate hold stays visible.

Monitoring is the third pillar. Microsoft Defender for Endpoint supplies the behavioural telemetry signature antivirus lacks, turning a strange process tree into an alert before encryption starts. Report patch compliance and detection time as named numbers, the way any defensible IT metrics you should be tracking programme does.

Identity and access: MFA, PAM, and conditional access

Identity is the working perimeter for most Canadian SMBs. The Verizon Data Breach Investigations Report (2026) puts vulnerability exploitation at 31% of breaches and stolen credentials at 13%, so identity controls and patching belong in the same funding conversation.

Phishing-resistant MFA blocks the credential-reuse attacks behind most account takeovers. FIDO2 keys and passkeys are the strongest option, and authenticator apps with number matching are the practical floor. Privileged Access Management puts admin credentials in a vault, rotates them, and records sessions so a compromised admin account cannot be used silently.

Conditional access ties sign-in decisions to device state, location, and risk score. In Microsoft Entra ID that means blocking legacy authentication and requiring compliant devices. For a 50-user firm, that configuration is achievable in two weeks.

Data protection: backup, encryption, and classification

Data protection decides whether a bad day becomes a closed business. Three controls anchor it. Backups must be immutable, tested, and stored off-site in a separate fault domain. An immutable backup platform with hardened repositories meets the 3-2-1-1-0 rule: three copies, two media, one off-site, one immutable, zero errors on test restore.

Encryption protects data at rest and in transit. BitLocker on Windows endpoints, transparent data encryption on SQL Server, and TLS 1.3 on every public service form the baseline. Statistics Canada found 88% of Canadian ransomware victims declined to pay in 2023, which only works when the restore path is proven.

Classification makes the other two controls work. Microsoft Purview labels documents as Public, Internal, Confidential, or Highly Confidential and applies encryption and data loss prevention rules automatically. Without classification, every other data control treats every file the same, so the sensitive 3% gets the same handling as the rest. If you want a second read on your four layers, get in touch.

“We thought we were covered because the backups were green. The first tested restore took 6 hours and failed twice. Fixing that was worth more than every tool we had bought that year.”

IT manager, 45-person engineering firm, Hamilton, Ontario. Anonymized at the client’s request; quote shared with permission.

The 8-control infrastructure security checklist

This is the checklist Fusion Computing applies on every managed client onboarding. Each control maps to one or more CIS v8.1 Safeguards and to the Canadian Centre for Cyber Security baseline, so the evidence trail works for both an auditor and an underwriter without a second pass.

How does this map to PIPEDA, Bill C-8, and CIS v8.1?

Canadian SMBs do not operate in a vacuum. PIPEDA requires safeguards proportionate to the sensitivity of personal information and a documented breach response, reported to the Privacy Commissioner “as soon as feasible” under s.10.1. No 72-hour clock applies to PIPEDA.

Bill C-8 received royal assent on June 15, 2026 and enacts the Critical Cyber Systems Protection Act. Section 17 requires a designated operator to report a cyber security incident within a period set by regulation, capped at 72 hours. The Act comes into force on order of the Governor in Council, so watch for that order before assuming it binds you.

Designation covers operators in finance, telecom, transport, and energy rather than every business. CIS Controls v8.1 and the NIST Cybersecurity Framework 2.0 remain the frameworks cited as evidence of reasonable safeguards.

What a Canadian infrastructure security programme requires each quarter

A programme that only gets attention after an incident is a project rather than a control set. Four recurring tasks keep the 8 Canadian controls honest, and each one produces an artifact you can hand to an underwriter or a privacy commissioner without preparing anything special first.

• One tested restore, documented. Date, system, operator, elapsed time. Twelve rows a year is the evidence trail.
• Patch exception review. Every asset outside the published window, named, with the reason it was held.
• Privileged account recertification. Confirm every admin account still needs the access it has.
• Segmentation spot check. Attempt one cross-zone connection that policy should block, and record the result.

Those 4 take a half-day per quarter across our Canadian client base. Of our clients, the ones that run them consistently are the ones whose insurance renewals get easier rather than harder, because the broker receives evidence instead of assurances.

Talk to Fusion

Fusion Computing has installed every control above for Canadian firms from 15 to 250 users since 2012. Talk to our team and we will scope your gaps against the eight controls in one call.

Frequently asked questions

These are the questions Canadian owners and IT managers ask most often when scoping an infrastructure security programme, drawn from onboarding conversations across our client base. Every answer carries a number so you can compare it against what your current provider tells you.

What is the difference between IT infrastructure security and cybersecurity?

Cybersecurity is the broader discipline covering application security, end-user awareness, governance, and infrastructure. Infrastructure security is the subset protecting the network, server, identity, and data layers. Most SMB cybersecurity programmes are infrastructure-heavy, because that is where the 8 highest-impact controls live.

How much does an infrastructure security programme cost for a Canadian SMB?

Fusion Computing prices cybersecurity services at CA$130 to CA$180 per user per month, and managed IT services start at CA$180 per user per month, typically around CA$230. A 50-user firm should scope from those per-user bands. Ask any provider whether licensing, 24/7 response, and reporting are included before comparing rates.

What are the CIS Benchmarks and do we need them?

The CIS Benchmarks are prescriptive hardening guides for operating systems, cloud services, and applications, maintained by the Center for Internet Security. Yes, you need them. Auditors and cyber insurers expect server baselines to align with CIS, and CIS Controls v8.1 defines 18 controls and 153 safeguards across 3 implementation groups.

Does PIPEDA require multi-factor authentication?

PIPEDA names no specific controls. It requires safeguards appropriate to the sensitivity of the information, and breach reporting “as soon as feasible” under s.10.1 rather than on a 72-hour clock. The Office of the Privacy Commissioner and most cyber insurers now treat MFA as a baseline expectation.

How is Bill C-8 different from Bill C-26?

Bill C-26 was the earlier attempt and died on the Order Paper. Bill C-8 received royal assent on June 15, 2026 and enacts the Critical Cyber Systems Protection Act, requiring a cyber security programme and incident reporting within a regulated period capped at 72 hours. It binds designated operators in 4 sectors, and comes into force on order of the Governor in Council.

What is ZTNA and should we replace our VPN with it?

Zero Trust Network Access verifies user identity and device posture on every request, rather than granting broad network access after 1 VPN login. For Microsoft 365 firms, Entra Private Access is a practical replacement. Most clients move within 12 to 18 months once they pilot it on a single application.

How often should we test our backups?

Quarterly at minimum, with 1 full-scenario disaster recovery test a year. Record the date, the system, the operator, and the elapsed time each time. Untested backups remain the most common failure mode in ransomware recovery, and Statistics Canada found 88% of impacted Canadian businesses declined to pay a ransom in 2023.

Do we need a SIEM if we have EDR?

For Canadian SMBs under 100 users, managed EDR with a managed security operations centre usually covers detection. A SIEM becomes worthwhile when compliance requires correlated logs across non-endpoint systems, or once the firm passes roughly 150 users and 3 or more sites.

What is the single highest-impact control to deploy first?

Phishing-resistant MFA on every account, with no exceptions for service accounts. A Microsoft study of Azure Active Directory accounts measured a 99.22% reduction in compromise risk, and 98.56% where credentials had already leaked. Pair it with conditional access in Microsoft Entra ID to block legacy authentication on day one.

Which control do Canadian SMBs skip most often?

Network segmentation. It has no licence cost and no dashboard, so it loses budget arguments to tools that do. Across our Canadian client environments, a flat internal network is the finding we raise most often at onboarding, and it is the one that turns a contained incident into a full recovery.

Related Resources

These 6 companion posts go deeper on individual controls above. Start with the firewall and MFA pieces if your network is still flat.

• Cybersecurity services for Canadian businesses.
• Server management best practices.
• Types of firewalls and how to choose.
• Benefits of multi-factor authentication.
• Best practices for disaster recovery.
• IT metrics you should be tracking.

Sources

Every figure above traces to 1 of these 5 primary sources, all Canadian or peer-reviewed.

• Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2023 data (released October 21, 2024).
• Center for Internet Security: CIS Controls v8.1 and CIS Benchmarks.
• Canadian Centre for Cyber Security: Baseline Cyber Security Controls for Small and Medium Organizations.
• NIST Cybersecurity Framework 2.0.
• Meyer et al., How effective is multifactor authentication at deterring cyberattacks? (arXiv 2305.00945).