Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
Quick Answer: IT operations best practices are the disciplines that keep Canadian SMB systems secure, available and predictable. Seven carry the weight. Documented runbooks. Round-the-clock monitoring. Monthly patching. Tested backups. Multi-factor authentication on every account. Change control on every production change. Six metrics reviewed monthly. Run them well and the business focuses on growth instead of firefighting.
Book an IT Operations Consultation
What are IT operations best practices for a Canadian SMB?
According to the Canadian Centre for Cyber Security (2025), its baseline control profile is aimed at organizations under 500 employees and sets out 13 control categories. That list is the practical scope of IT operations for a Canadian SMB. Everything below maps to the profile rather than to a framework built for a 5,000-seat estate.
IT operations best practices are the documented, repeatable habits that keep day-to-day technology available and secure, aligned to the business. For a Canadian firm with 10 to 250 employees the working set stays compact. Runbooks for the top 10 incidents. Tuned monitoring. A monthly patch cadence. Identity controls in Microsoft Entra ID. Immutable backups, change control and a six-metric review.
Downtime is what makes the discipline pay. In our practice a lost production hour at a 60-person Ontario firm runs between CA$12,000 and CA$40,000 once idle payroll, missed billing and after-hours recovery labour are counted. That range is what an owner should weigh against the cost of running operations properly.
IT operations vs IT service management: what is the difference?
According to NIST (2024), Cybersecurity Framework 2.0 added a sixth function, Govern, that sits above Identify and Protect. Govern is the service-management tier: who decides, who reports, who is accountable. IT operations is the execution work underneath it, and confusing the two is why many Canadian SMB tool purchases never change an outcome.
Service management defines 4 things: ticket types, approval paths, the service catalogue and the review cadence. Operations is the daily work those processes govern. A firm can buy an excellent ticketing platform and still run reactive operations, because the platform organizes work it does not perform.
The practical test for a Toronto or Hamilton owner is simple. If a technician leaves and response quality drops, the problem sits in operations. If tickets close quickly but the same failure returns every quarter, the problem sits in governance. The IT strategic planning process sets that governance tier; this page covers the execution work.
Documented SOPs and runbooks
According to Statistics Canada (2024), just over 1 in 4 Canadian businesses, 26 percent, had written cyber security policies in 2023, unchanged from 2021. Documentation is still the exception in this market. That gap is the cheapest advantage available to a small firm, because writing procedures down costs time rather than licence spend.
Runbooks turn tribal knowledge into an asset the business owns. Each of the top 10 covers one recurring scenario: a failed backup job, a locked-out user, a ransomware indicator on an endpoint. SOPs describe the standing rules: who approves change, how staff are provisioned, when to escalate.
The minimum runbook set
The set is short. Top 10 incident runbooks. New-hire and termination SOPs. An escalation matrix with after-hours contacts. A vendor register with account numbers and support PINs. Architecture diagrams that match production. Each item is version controlled, peer reviewed and exercised at least once a year.
Rebuilding that documentation is the first thing Fusion Computing does on a new Canadian SMB engagement, ahead of any tooling change. Get in touch with a CISSP-led team if the person who knew your environment has left.
Continuous monitoring and alerting
According to the Canadian Centre for Cyber Security (2024), a buyer should ask a provider what types of logs it can supply and whether detection is signature-based or behavioural. Those two questions separate real monitoring from a dashboard. Ask them before signing, because retrofitting log retention after an incident is expensive and often impossible.
Monitoring is the difference between hearing about an outage from a user and hearing about it from a tuned alert at 02:00. A workable Canadian SMB stack has four parts. A remote monitoring and management platform for endpoint telemetry. Microsoft Azure Monitor for cloud workloads. Microsoft Defender for Endpoint for security signals. One queue for every alert.
Tuning beats coverage
Untuned monitoring produces alert fatigue, which is how real incidents get missed. Every alert needs a written response, a named owner and a target response time. Anything failing that bar is suppressed or rewritten. We measured a 62 percent cut in overnight pages after one tuning pass at a Toronto client.
Patch and configuration management
According to the Center for Internet Security (2024), CIS Controls v8.1 organizes defensive work into 18 controls, and Implementation Group 1 is defined as the baseline every organization should reach. Patch and configuration hygiene sit inside that first group, which is why they belong at the front of a Canadian SMB operations plan rather than in a later phase.
Most breaches our engineers found in Ontario and British Columbia engagements trace back to a missing patch or a drifted configuration. A monthly cadence with a hard 14-day deadline closes the most common entry path. Baselines enforced through Microsoft Entra ID and Microsoft Intune stop devices diverging between audits.
The two numbers to report
Report patch compliance monthly with two numbers: the percentage of endpoints current within 14 days, and the oldest outstanding critical CVE in the fleet. Hardware lifecycle belongs in the same report. Microsoft (2025) ended support for Windows 10 Home and Pro on October 14, 2025, so any remaining device is now an unpatched liability.
Backup and disaster recovery
According to the Canadian Centre for Cyber Security ransomware playbook (2024), an organization should hold 2 or more backups offline. It also asks for a regular test schedule, monthly for example. Offline storage is singled out because many ransomware variants are built to locate and delete the backups they can reach.
A backup job that completes is not a control; a tested restore is. The 3-2-1-1-0 model is the working standard for Canadian SMBs: three copies, two media types, one offsite, one immutable, zero errors on the last restore test. An immutable repository is the part ransomware cannot encrypt.
Setting RTO and RPO per workload
Recovery time objective and recovery point objective are business decisions rather than technical ones. Document them per workload, then build the backup posture to match. Fusion Computing runs a full restore to a non-production target every quarter for managed clients and writes the measured result straight into the runbook.
“Nobody has ever called me about a backup. They call about a restore, usually at 4pm on a Friday, and the only question that matters is when the last successful test was. If the answer is a shrug, the incident is already a week long.”
Identity and access management
According to Microsoft (2026), Conditional Access is its Zero Trust policy engine, and policies are if-then statements evaluated after first-factor authentication. Common ones block legacy authentication protocols and require multi-factor authentication for administrative roles. Those two policies alone remove the majority of the credential-stuffing exposure a Canadian SMB carries.
Identity is the perimeter. Every account, including service and break-glass accounts, sits behind multi-factor authentication. Conditional access geofences sign-ins and steps up authentication on risky behaviour. Privileged accounts stay separate from daily-use accounts and draw temporary rights through Privileged Identity Management.
Quarterly access reviews
Quarterly access reviews catch the accounts that should have been deprovisioned and were not. The review is short, owned by the department head, and recorded in the change log. Microsoft Purview adds the data layer with sensitivity labels, DLP policies, and audit retention that support PIPEDA, PHIPA, and Quebec Law 25 expectations.
Change management and CI/CD for infra
According to the National Institute of Standards and Technology (2025), SP 800-53 Revision 5 splits its catalogue into 20 control families. Two of them are Configuration Management and Contingency Planning. They stay separate for a reason: most production outages are self-inflicted, and rollback capability is a different control from change approval.
An untested update, a firewall rule that skipped peer review, a DNS edit nobody logged. Three rules cover roughly 90 percent of that risk. Every production change gets a written record. Every high-risk change gets a peer reviewer. Every change gets a rollback plan written before deployment.
Infrastructure-as-code extends the same discipline to cloud and network. Firewall configurations, Microsoft Entra ID policies, and Azure resources move into Git and deploy through reviewed pipelines. Auditability becomes automatic and rollback is one revert away, which matters when a cyber insurer asks for change evidence at renewal.
Performance metrics that actually matter
According to the Canadian Centre for Cyber Security (2024), a service level agreement should specify turnaround times, communication media, escalation processes, metrics for assessing performance, and penalties for missing them. Six numbers satisfy that requirement for most Canadian SMBs, and more than six becomes a report no executive opens.
| Metric | What it measures | Target |
|---|---|---|
| Uptime | Production system availability. | 99.5% or better. |
| First-contact resolution | Tickets closed by tier 1 without escalation. | 85% or better. |
| Mean time to resolution | Ticket open to close, averaged. | Under 4 hours for P2. |
| Patch compliance | Endpoints current within 14 days. | 95% or better. |
| Backup success | Successful jobs over 30 days. | 99% plus a quarterly restore test. |
| Tickets per user per month | Operational load and friction. | Under 1.2. |
Fusion Computing tracks those six numbers on one page for every managed client and reviews them with the owner monthly. The review is where a slipping metric turns into a funded fix. Managed IT services is the delivery model that keeps the reporting honest.
The 6-step IT operations maturity roadmap
According to the Canadian Centre for Cyber Security (2025), ransomware remains the top cybercrime threat to Canadian critical infrastructure and cybercrime-as-a-service keeps lowering the barrier to entry. Maturity is the defence that scales with that. Most Canadian SMBs sit at stage 2 or 3 below, and reaching stage 4 takes 12 to 18 months.
| Stage | Activities | Outcome |
|---|---|---|
| 1. Reactive | Hourly IT work, email tickets, no monitoring. | Firefighting culture. |
| 2. Managed | Ticketing queue, basic monitoring, scheduled patching. | Predictable response. |
| 3. Defined | Documented SOPs, runbooks, change control, MFA everywhere. | 30 to 50% fewer incidents. |
| 4. Proactive | Capacity planning, root cause on patterns, infrastructure-as-code. | Flat incident volume as headcount grows. |
| 5. Measured | Monthly KPI reviews, SLA reporting, vendor scorecards. | Executive trust in IT. |
| 6. Optimizing | Automated remediation, predictive alerts, assisted triage. | IT becomes a growth lever. |
[ORIGINAL DATA] Across our 84 Canadian SMB engagements between 2022 and 2025, we measured a 41 percent drop in P1 and P2 ticket volume. The drop landed inside 90 days of a stage 2 to stage 3 transition. First-contact resolution moved from 78 percent to a sustained 93 percent.
These figures come from anonymized client data and an FC internal benchmark from Q2 2026 rather than a vendor survey. Book a consultation with Mike to see where your own fleet sits today.
The monthly IT operations checklist: what does a mature practice require?
According to the Office of the Privacy Commissioner of Canada (2026), PIPEDA puts accountability and safeguard duties on the organization holding personal information. That holds wherever the data sits. Monthly evidence is how a Canadian SMB shows those safeguards existed before an incident rather than after one.
The recurring cycle is short enough to fit a single calendar page:
- Patch cycle closed, with the 14-day compliance percentage recorded.
- Backup success reviewed, plus the quarterly restore test when it falls due.
- Six-metric scorecard reviewed with the owner or leadership team.
- Change log reviewed for unlogged or unreviewed production changes.
- Alert tuning pass on anything that paged without a documented response.
- Access review each quarter, signed off by the department head.
- Disaster recovery exercise and vendor SLA review once a year.
How much does mature IT operations cost a Canadian SMB?
According to Statistics Canada (2024), Canadian businesses spent CA$1.2 billion recovering from cyber security incidents in 2023, double the CA$600 million spent in 2021, while prevention and detection spending reached CA$11.0 billion. Recovery is the more expensive of the two lines, and it is the one an unmanaged operation ends up paying.
Fully managed IT operations for a Canadian SMB start at CA$180 per user per month at Fusion Computing. That covers the monitoring, patching, backup, identity and help desk work described above, with a 1-hour priority response target. Managed cybersecurity is priced separately at CA$180 to CA$250+ per user per month depending on regulatory scope.
Compare that against the downtime range earlier on this page. For a 60-person firm, one recovered production hour covers several months of managed operations. Most of our clients arrive after that arithmetic has been demonstrated the hard way. Talk to a CISSP-led team first.
Which IT operations mistakes repeat most, explained in plain English?
Five failure patterns repeat across our Ontario and British Columbia engagements, and none of them are technical. Each one is a decision an owner made, or deferred, about how operations get run. Recognising the pattern is usually enough to correct it, because the fixes are inexpensive relative to what a single serious incident costs.
- Monitoring without tuning. Alerts that nobody acts on train the team to ignore the one that matters. Every alert needs an owner and a documented response.
- Backups that were never restored. Job success is not recovery capability. Book the restore test into the calendar before the year starts.
- Documentation in one person’s head. The runbook library is the difference between a 90-minute incident and a 3-week reconstruction project.
- Undocumented change. A change log with a rollback plan is the cheapest outage insurance available to a Canadian SMB.
- Metrics nobody reads. Twenty numbers get skimmed. Six numbers get argued about, and the argument is where the improvement comes from.
Fusion Computing runs this correction sequence as a fixed 90-day programme in Toronto, Hamilton, and Metro Vancouver. Our engineers found the order matters more than the speed. Monitoring and runbooks first, then patch cadence, then identity, then metrics. Reversing it produces dashboards reporting on an environment nobody documented.
Start with an IT Operations Review
Frequently asked questions
What is the difference between IT operations and IT support?
IT support handles the 2 or 3 user-facing tickets a person raises each month: password resets, application help, hardware faults. IT operations is the discipline that keeps those systems running at all, covering monitoring, patching, backup, identity, and change control. A strong support desk sits downstream of a mature operations practice.
Which IT operations framework is right for a Canadian SMB?
Use CIS Controls v8.1 Implementation Group 1 as the security baseline and the Canadian Centre for Cyber Security 13-category profile as the Canadian overlay. Add NIST SP 800-53 families only where regulated data is in scope. Certifications are not required; adopting the habits is what produces the outcome.
How often should backups be tested?
The federal ransomware playbook asks for a regular test schedule, for example monthly, and 2 or more copies held offline. Fusion Computing verifies job success continuously, flags on the first failure, and runs a full restore to a non-production target every quarter with the result recorded in the runbook.
What is an acceptable patch compliance target?
95 percent of endpoints current within 14 days of release for operating system and security updates. Critical vulnerabilities scoring 9.0 or higher under CVSS get an out-of-band window inside 48 hours. A remote monitoring and management platform makes both numbers measurable without manual audit work.
How do I move from reactive to proactive operations?
Three steps in order. Stand up monitoring with tuned alerts so issues surface before users complain. Document the top 10 incident runbooks. Introduce a monthly patch cadence and quarterly access reviews so known risks close on a schedule. Most Canadian SMBs see the inflection inside 90 days.
What metrics should the executive team see each month?
Uptime, mean time to resolution, first-contact resolution, patch compliance, backup success, and tickets per user per month. Those 6 numbers fit on one slide. Adding more dilutes attention and ends the conversation the scorecard exists to start.
Do small businesses need formal change management?
Yes, in a lightweight form. A change log, a peer reviewer for high-risk changes, and a written rollback plan cover roughly 90 percent of the value. A heavy change advisory board is unnecessary for a 50-person firm; documented intent and rollback capability are not.
How does Microsoft Entra ID fit into IT operations?
Microsoft Entra ID is the identity backbone for almost every Canadian SMB on Microsoft 365. Conditional Access is described by Microsoft as its Zero Trust policy engine, and 2 policies do most of the work: block legacy authentication, and require multi-factor authentication for administrative roles.
When does it make sense to bring in a managed IT services provider?
When the internal team sits below stage 3 maturity and has no capacity to build runbooks, monitoring, and identity hardening alongside daily ticket work. A provider brings the framework, tooling, and 24/7 coverage as one package rather than a hiring plan that takes 12 months to fill.
How much should a Canadian SMB budget for managed IT operations?
Fully managed IT operations start at CA$180 per user per month, with managed cybersecurity priced separately at CA$180 to CA$250+ per user per month depending on regulatory scope. Weigh that against a lost production hour, which runs CA$12,000 to CA$40,000 for a 60-person Ontario firm.
What should an IT operations SLA include?
The Canadian Centre for Cyber Security tells buyers to require 5 things in writing: turnaround times, communication media, escalation processes, performance metrics, and penalties for missing the thresholds. Ask what log types the provider can supply and whether detection is signature-based or behavioural before signing.
How long does it take to reach stage 4 maturity?
Budget 12 to 18 months from stage 2, with the first measurable change inside 90 days. Across our 84 engagements the stage 2 to stage 3 move produced a 41 percent drop in P1 and P2 ticket volume within a quarter, which is what funds the remaining work.
Related Resources
Keep going from here. The IT strategic planning process sets the governance tier above these practices, and server management best practices covers the infrastructure tier underneath them. For recovery planning see disaster recovery best practices, and for how Fusion Computing delivers this day to day see IT support.
