Most Edmonton businesses don’t have a cybersecurity policy. The ones that do often have a document nobody has read since the day it was created. Neither situation actually protects your business.
A cybersecurity policy for Edmonton businesses isn’t a compliance checkbox — it’s the foundation that makes every other security control work. MFA, backups, employee training, VPNs — none of these function consistently without documented policies that tell your team what’s required, what’s prohibited, and what to do when something goes wrong. This post walks through what a cybersecurity policy for an Alberta SMB actually needs to contain, and how to create one that people will actually follow.
Why Edmonton Businesses Need a Written Cybersecurity Policy
The recent ransomware attack on Mount Royal University — where CMD Organization stole 10 terabytes of data and deleted the originals — started with an employee clicking a malicious download from a search result. No technical control stopped it. What might have stopped it was a clear, enforced policy about downloading files from unverified sources, combined with the training to recognize the risk.
A cybersecurity policy matters for several reasons beyond preventing incidents:
Consistency — Without documented requirements, security controls get applied inconsistently. One employee has MFA enabled; another doesn’t. One department backs up files properly; another saves everything locally. Policy creates a baseline everyone is held to.
Legal and compliance protection — Under Alberta’s PIPA, organizations have an obligation to protect personal information with appropriate safeguards. A documented security policy is evidence that you took that obligation seriously — which matters significantly if a breach leads to an OIPC investigation.
Cyber insurance requirements — Most cyber insurers now require documented security policies as a condition of coverage. A business without written policies in place may find claims disputed after an incident.
Onboarding and offboarding — A policy makes it clear what security requirements new employees must meet from day one, and what needs to happen when employees leave — password resets, access revocation, device return.
What a Cybersecurity Policy for Edmonton Businesses Should Cover
A complete cybersecurity policy doesn’t need to be 100 pages. For most Edmonton SMBs, a clear, practical document covering the following areas is sufficient:
Acceptable Use Policy
Defines what employees may and may not do with company systems, devices, and network access. Key elements include:
- Permitted and prohibited uses of company computers and internet access
- Rules around personal device use on company networks (relevant to VLAN configuration we covered in our VLANs guide)
- Prohibition on downloading unapproved software or files from unverified sources
- Rules around accessing company systems from personal devices
Password and Authentication Requirements
Documents your password standards and MFA requirements. This section should reference your password manager deployment and specify:
- Minimum password length and complexity (we covered this in our password management guide)
- Prohibition on password sharing and reuse
- MFA requirement on all business accounts
- Process for reporting suspected credential compromise
Data Classification and Handling
Not all data carries the same risk. A data classification policy defines categories — public, internal, confidential, restricted — and specifies how each category must be handled, stored, transmitted, and disposed of. For businesses handling personal information, health data, or financial records, this section needs to align with your obligations under PIPA or the Health Information Act.
Remote Access and VPN Policy
Defines requirements for employees accessing company systems from outside the office — including mandatory VPN use, device requirements, and prohibited networks (as covered in our VPN setup guide). This section should also address what happens if a remote device is lost or stolen.
Incident Response Policy
Documents what employees should do when they suspect a security incident — who to contact, what not to do, and how the business will respond. As we covered in our incident response guide, having this defined before an incident happens is the difference between a controlled response and a panicked one.
Key elements include:
- How to report a suspected incident (specific contact, not just “call IT”)
- What employees should and should not do while waiting for IT response
- Who is responsible for making decisions during an incident
- How the business will communicate internally and externally
- Notification obligations under PIPA and to cyber insurers
Backup and Recovery Policy
Documents your backup requirements, testing schedule, and recovery procedures. Specifies which systems and data must be backed up, how frequently, where backups are stored, and how often restores are tested. The MRU attack demonstrated exactly why “delete-after-steal” tactics make backup architecture decisions — specifically around immutable, offsite backups — a policy matter, not just a technical one.
Software and Patch Management Policy
Defines requirements for keeping systems updated and patched. Specifies timelines for applying security patches (critical patches within 48 hours is a common standard), who is responsible for patch management, and how end-of-life software is handled. Unpatched systems were a factor in the Alberta government’s $40M cybersecurity remediation effort.
Vendor and Third-Party Access Policy
Documents requirements for vendors, contractors, and third parties who access your systems or data. Specifies what access is permitted, what security controls vendors must have in place, and how third-party access is revoked when an engagement ends. Given that shadow AI and third-party data sharing are increasingly significant risks, this section deserves specific attention.
Employee Offboarding Policy
One of the most consistently overlooked security processes. Documents exactly what must happen when an employee leaves — account disabling, password rotation for shared accounts, device return, access revocation from all systems including cloud services and Microsoft 365. A departing employee whose access is never properly revoked represents a persistent and easily preventable risk.
How to Write a Cybersecurity Policy That Actually Gets Used
The most common failure mode for business security policies is creating a document so long, legalistic, or abstract that nobody reads it. Here’s how to avoid that:
Write for your actual employees, not a compliance auditor. Plain language that a non-technical staff member can understand and act on is more valuable than technically precise language that nobody reads. If your receptionist can’t understand your acceptable use policy, it isn’t doing its job.
Keep it short enough to be readable. A 5-page policy that employees actually read beats a 50-page policy nobody opens. Cover what matters, skip the filler.
Make requirements specific and actionable. “Employees should use strong passwords” is not a policy. “All business accounts must use passwords of at least 16 characters stored in the company password manager, with MFA enabled” is a policy.
Include a sign-off requirement. Employees should acknowledge in writing that they’ve read and understood the policy as part of onboarding and whenever the policy is updated. This creates a record that the policy was communicated.
Review it annually. The threat environment changes. Your business changes. A policy written in 2022 may not reflect current risks or current practices. Annual review keeps it relevant.
Make it accessible. Store the current version somewhere every employee can find it — a SharePoint page, a shared drive, an onboarding document. A policy nobody can locate is effectively no policy.
Cybersecurity Policy Template for Edmonton SMBs
Here’s a simple structure for a one-document cybersecurity policy that covers the essential elements for most Edmonton small and medium businesses:
Section 1: Purpose and Scope — Who this policy applies to and why it exists.
Section 2: Acceptable Use — What employees may and may not do with company systems.
Section 3: Password and Authentication Requirements — Password standards, MFA requirements, password manager use.
Section 4: Data Handling — How different types of business and personal data must be handled, stored, and disposed of.
Section 5: Remote Access — VPN requirements, device standards for remote work, prohibited networks.
Section 6: Incident Reporting — How to report a suspected security incident and who is responsible for response.
Section 7: Backup and Recovery — What gets backed up, how often, and how recovery is tested.
Section 8: Software and Updates — Patching requirements and prohibited software installation.
Section 9: Vendor Access — Requirements for third parties who access company systems.
Section 10: Employee Offboarding — Access revocation checklist and process.
Acknowledgment section — Employee signature confirming they’ve read and understood the policy.
Frequently Asked Questions
Does a small Edmonton business really need a written cybersecurity policy? Yes. A policy doesn’t need to be complex — even a simple, clear one-page document covering the basics is significantly better than no documentation at all. For businesses handling personal information under PIPA, documented policies are part of demonstrating appropriate safeguards.
How long should a cybersecurity policy be? For most Edmonton SMBs, 5-10 pages covering the essential sections is appropriate. Longer isn’t better — a policy that gets read and followed matters more than a comprehensive document nobody uses.
Who should write our cybersecurity policy? Your managed IT provider should be closely involved, as they understand your specific technical environment and current security controls. A lawyer familiar with Alberta privacy law is worth involving for the data handling and incident response sections, particularly if your business handles regulated data.
How often should we update our cybersecurity policy? At minimum annually, and any time a significant change happens — new technology adopted, new employees hired in large numbers, a security incident, or a change in the type of data you handle.
What happens if an employee violates the cybersecurity policy? Your policy should specify consequences, which typically range from additional training for unintentional violations to disciplinary action for deliberate policy breaches. Consistent enforcement is what gives a policy teeth.
GuidePost Can Help
GuidePost Technologies helps Edmonton and Sherwood Park businesses develop, implement, and maintain cybersecurity policies — including acceptable use policies, incident response procedures, and the technical controls that make policies enforceable. This is part of our cybersecurity services for Alberta businesses.
Explore our Cybersecurity Services →
Call us at 780-851-5000 to book a free cybersecurity assessment. We’ll review your current security posture and help identify the policies your business needs most.
GuidePost Technologies — Managed IT Services, Cybersecurity, Cloud Computing, and Network Support for Edmonton and Alberta Businesses.