Ransomware Recovery Playbook for Canadian SMBs (Free 9-Page PDF)
No form to fill, no email required.
The five-phase playbook a CISSP-led MSP runs when ransomware lands at 4 PM on a Friday. Each phase sets out what to do, what to avoid and what to record, from the first hour to the final report. The steps follow the CISA #StopRansomware Guide and the Canadian Centre for Cyber Security’s Ransomware playbook.
Covers PIPEDA breach reporting, the file your insurer will ask for, and ten questions to answer before an incident. Built and reviewed by Fusion Computing’s CISSP-led team.
24/7 SOC monitoring
Friday-to-Monday recovery, documented
PIPEDA breach reporting covered
Cyber-insurance carrier liaison
When ransomware lands at 4 PM on a Friday
A Friday-afternoon ransom note on every screen is the worst phone call a Canadian SMB owner ever takes. The difference between Monday-morning recovery and three weeks of downtime is not the tool, the vendor, or luck. It is the playbook the IT partner runs in the first sixty minutes, and the readiness work done in the ninety days before.
This 9-page PDF sets out five phases: Contain, Triage, Restore, Harden and Report. The first three give you what to do, what to avoid and what to record. The last two are lists to work through. Its steps follow two public guides, the CISA #StopRansomware Guide and the Canadian Centre for Cyber Security’s Ransomware playbook.
The regulatory floor for Canadian SMBs handling personal information: Under PIPEDA, organizations must implement reasonable security safeguards and must report breaches of security safeguards to the Office of the Privacy Commissioner and affected individuals where there is a real risk of significant harm. A record of every breach must be kept for 24 months, whether or not it was reported (PIPEDA ss. 10.1 to 10.3 and the Breach of Security Safeguards Regulations, SOR/2018-64). Provincial regimes (Quebec Law 25, Alberta PIPA, British Columbia PIPA) and sectoral regimes (PHIPA, MFIPPA, FIPPA) add additional obligations. Sources: priv.gc.ca, parl.ca, cisecurity.org.
What’s inside the 9-page playbook
Nine pages. Five phases. Ten pre-incident questions. Built for a managing partner, an in-house IT lead, or a board member with cyber oversight to read in twenty minutes and act on the same week.
Pages 1–2, How to use the playbook
- Who the playbook is for and how to use it: read it once, answer the ten questions with your IT provider, then print a copy.
- The five phases in one table, each with its goal and the test for when it is done.
Pages 3 to 7, The five phases
- Contain. Isolate affected systems, disable compromised accounts, call your insurer, capture images and logs.
- Triage. Map what was affected, find what data left and the way in, verify the backups, decide how to recover.
- Restore. Clean rebuild in order: identity, endpoints, data, applications.
- Harden. Ten controls, from MFA and EDR to offline or immutable backups, a password manager and a booked tabletop exercise.
- Report. Privacy notification, police and the Cyber Centre, the insurer’s file, a one-page memo for the owners or board, and the review.
What each phase gives you
- What to do, what to avoid and what to record for Contain, Triage and Restore. Harden and Report are lists to work through.
- Specific procedures: isolate first and capture an image before anything is rebuilt, identity before endpoints, restore into an isolated environment and scan the result.
- The ransom decision, made with counsel and your insurer once triage has told you whether you can restore.
Page 8, The 10 pre-incident questions
- A backup out of reach of production credentials. A recorded restore test. MFA on every account. EDR coverage. One number to call after hours.
- Asset inventory, current cyber insurance, a signed incident response plan, a tabletop exercise, an after-hours contact list.
- Answer them with your IT provider, and give every no an owner and a date.
Phase 4, The hardening checklist
- Ten yes/no controls: MFA, EDR, administrator rights, backups, a password manager, email authentication, a banking-change callback, the incident plan, a tabletop exercise and sign-in restrictions.
- For each control, record its status, its owner, the completion date and the evidence.
- The same record supports your next insurance renewal.
What to avoid in the first three phases
- Contain: paying or negotiating in the first hours, wiping a machine before forensics has released it, guessing outside the business about the cause.
- Triage: reconnecting a restored system before the way in is closed, talking to the attacker without counsel, promising a return date before the scope is known.
- Restore: reusing an image that carries the weakness the attacker used, returning credentials before a machine is rebuilt, bringing internet-facing services back first.
Page 9, Sources and next step
- The three sources: the CISA guide, the Cyber Centre’s Ransomware playbook and the Privacy Commissioner’s breach reporting guidance.
- A note that the playbook is operational guidance and does not replace legal advice, your policy wording or a regulator’s own guidance.
- A direct line to book a 30-minute Ransomware Readiness walk-through.
Why this playbook exists
Canadian SMBs operating between 10 and 150 employees are the sweet spot for ransomware operators. Large enough to have payable balance sheets and cyber-insurance policies. Small enough that a single phished credential reaches a domain administrator in under a minute. Often serviced by IT providers whose incident-response capability is a Saturday morning call to a Microsoft partner portal, not a documented runbook signed by a named director.
The technical procedures in this playbook are not exotic. The Phase 4 hardening list gives ten controls, and the record you keep for them supports your next insurance renewal. The steps follow the CISA #StopRansomware Guide and the Cyber Centre’s Ransomware playbook. The PIPEDA section follows the Privacy Commissioner’s breach reporting guidance.
What this playbook adds is the operational sequencing, the order in which a CISSP-led MSP runs the steps when the call comes in on a real Friday, with a real CEO, a real cyber-insurance carrier on the bridge, and real payroll running on Monday.
Who should download this
For CEOs and managing partners of 10–150-employee Canadian SMBs
You are the person who takes the 4:47-PM Friday call. The playbook is what you hand to your IT lead to confirm they can run, and what you read into the board minutes when the cyber-oversight director asks.
For in-house IT leads at Canadian SMBs
You probably already know most of the technical procedures. The playbook puts the phases, what to record in each and the ten readiness questions in a single file you can print.
For board members with cyber oversight responsibility
The ten pre-incident questions on page 8 are the diligence questions for the next risk-committee meeting. The Phase 5 memo on page 7, with its five headings, is the format the board minutes should reflect when an incident happens.
For finance and privacy officers
The PIPEDA notification section and the insurer’s file list on page 7 are the pieces the privacy officer and the CFO will be asked about within thirty days of any incident.
Related Fusion case studies
These Fusion pages cover ransomware recovery and readiness in more depth.
- Friday-to-Monday ransomware recovery, 45-employee industrial supplier →
EDR-isolated containment within 3 minutes, immutable backup restore, Monday-morning production, zero ransom paid. - Cyber crisis to recovery success, Canadian marketing agency →
How a documented recovery, a clean Phase 5 report, and a client-communication template converted an incident into a client-trust asset. - Securing growth in cannabis retail, regulated multi-province retailer →
Readiness work that satisfied provincial regulators, payment processors, and the company’s board cyber oversight before any incident ever occurred. - Ransomware playbook for an FHO clinic under Ontario PHIPA →
Health-sector parallel, the PHIPA notification path and the IPC reporting trigger applied to a primary-care clinic environment.
Frequently asked questions
Is this a substitute for an incident-response retainer or legal counsel?
No. The playbook is the operational pattern a CISSP-led MSP runs. It is not legal advice, not a cyber-insurance policy interpretation, and not a regulatory determination under PIPEDA, Quebec Law 25, PHIPA, or sector-specific regimes. During an active incident, you want panel counsel, your cyber-insurance carrier’s incident hotline, and a CISSP-led IR team on the bridge together. The playbook is what the IR team runs once the bridge is up.
Does this only apply to Fusion clients?
No. The playbook is freely usable as a self-audit framework, a board memo template, and an IT-provider diligence question set. The ten pre-incident questions on page 8 are the diligence questions you should ask your current IT provider whether they are Fusion or not. If they cannot answer all ten with a documented control, an owner, and a date, the gap is the work plan, with whatever provider you choose.
How does this map to CIS Controls, NIST CSF, and ISO 27001?
The playbook follows two public guides, the CISA #StopRansomware Guide and the Canadian Centre for Cyber Security’s Ransomware playbook, and makes no framework mapping of its own. Its Phase 4 list gives ten hardening controls. ISO 27001 is a broader information-security management system framework typically suited to larger organizations, and the playbook does not constitute an ISO-27001-aligned ISMS on its own.
Does apply to my Canadian SMB?
, the framework that includes the , passed third reading in the House of Commons on 2026-03-26. It applies to designated operators in federally regulated critical sectors (banking, telecommunications, energy pipelines, federally regulated transportation, the federal nuclear sector). It is not a general SMB obligation. For most Canadian SMBs in the 10–150-employee band, the operative regimes are PIPEDA, provincial private-sector privacy laws, and any sector-specific obligations (PHIPA, MFIPPA, FIPPA). The playbook is written for that majority case. Federally-regulated critical-sector operators should treat the playbook as a baseline and layer the CCSPA-specific obligations on top.
What does Fusion charge to run this for our business?
Fusion’s Cybersecurity Assessment is a fixed-fee, two-week engagement that answers the ten pre-incident questions with documented evidence and produces a ninety-day remediation roadmap. The ongoing managed-cybersecurity engagement, CISSP-led on-call, 24/7 SOC, EDR everywhere, immutable backups with quarterly restore tests, written runbook, annual tabletop, is a per-user monthly subscription that scales with headcount. Pricing is discussed during the 30-minute walk-through. Book the walk-through here and we will send the PDF playbook and a high-level pricing range after the call.
What happens after I download? Will I be cold-called?
No. After the 30-minute walk-through, we send the PDF and a short follow-up email with the most relevant Fusion resources for your sector and size. If you ask for a pricing range or a scoping conversation, we provide it. If you don’t, the next email comes a month later with the most relevant new content we’ve published. You can unsubscribe at any time. Fusion does not buy or sell contact data and does not run high-frequency sales sequences.
Get the 9-page PDF playbook
Book a 30-minute Ransomware Readiness walk-through with Fusion’s CISSP-led team. We send the PDF playbook after the call along with a quick benchmark of your current posture against the ten pre-incident questions on page 8. No cold calls. No spam. No contract conversation unless you ask for one.
Updated
