What do Canadian cyber insurers actually require?

Roughly a dozen control areas, and you can evidence almost all of them from records you already hold. Multi-factor authentication, backups, endpoint coverage, patching, training: each sits in a system somewhere with a date attached. The one that catches Canadian firms is incident response testing, and the reason is structural. Canada’s own baseline for small and medium organisations tells you to write an incident response plan and never once tells you to test it. Your carrier asks whether you tested it. Those are two different questions and nobody has reconciled them for you.

What is on the form?

The control areas repeat across carriers even though the wording does not.

Control area	Evidence you already hold	Who produces it
Multi-factor authentication coverage	Configuration and enrolment reports	You
Backups and tested restoration	Backup logs, restore test records	You
Endpoint detection coverage	Deployment reports	You
Patching cadence	Patch management reports	You
Email security and payment verification	Configuration, finance procedure	You
Privileged access management	Access review records	You
Security awareness training	Completion records	You
Written incident response plan	The plan, with a version and date	You
Incident response plan tested	A dated exercise record	You, plus a witness
Business continuity plan tested	Test records	You
Vendor and third-party risk	Contracts, assessments	You
Prior incidents and claims	Your own history	You

Eleven rows you can close from your own filing cabinet. One you cannot, and it is the row most likely to be discovered late because it looks administrative until you try to produce something.

Why does Canada’s own guidance not help here?

Because it stops one step short, and this is the sharpest thing on this page.

The Canadian Centre for Cyber Security publishes a baseline for organisations with fewer than 500 employees, which is most of the Canadian mid-market. Its incident response section says: Organizations should assume that cyber security incidents will occur and have a plan on how to respond and recover from them. This plan should be part of the organization’s plans for disaster recovery and business continuity (Canadian Centre for Cyber Security, Baseline Cyber Security Controls for Small and Medium Organizations V1.2, 2020).

Develop a plan. Write it down. Keep an up-to-date hard copy for when the soft copies are unavailable.

It never asks you to test it. We checked the document twice for the words test, exercise, rehearse and drill in relation to the incident response plan. They are not there. The only validation language in the baseline is about backups.

So a Canadian firm that has done exactly what its national cyber agency recommends has a written plan, a hard copy, and no answer to the question its carrier is about to ask. That gap is not anybody’s fault. It is just unremarked, and it explains a great deal of the confusion we see.

One correction while we are here, because it appears in a lot of secondary write-ups: this baseline is not ITSM.10.089. That number belongs to a different Cyber Centre publication, the Top 10 IT security actions. The baseline carries no ITSM number at all.

What about the regulators?

None of them mandates an exercise either. What they create is consequence.

PIPEDA. You must report a breach of security safeguards to the Privacy Commissioner where it is reasonable to believe it creates a real risk of significant harm to an individual, and the report is made as soon as feasible after the organization determines that the breach has occurred (Personal Information Protection and Electronic Documents Act, subsection 10.1(1), 2018). Note there is no fixed deadline in days, which is commonly misreported. Separately, you must keep a record of every breach for 24 months, reportable or not (Breach of Security Safeguards Regulations, SOR/2018-64, section 6, 2018).

Quebec’s Law 25. After any confidentiality incident you must take reasonable measures to reduce the risk of harm. Where the incident presents a risk that serious injury will be caused, you must notify the Commission d’accès à l’information and every affected individual, with diligence (Loi sur la protection des renseignements personnels dans le secteur privé, P-39.1, article 3.5, 2022). And you must keep a register of confidentiality incidents for at least 5 years, running from when you became aware of the incident rather than from the incident itself (Règlement sur les incidents de confidentialité, chapitre A-2.1, r. 3.1, article 8, 2022).

OSFI’s technology and cyber risk guidance binds federally regulated financial institutions. Banks, federally regulated insurers, trust and loan companies. A provincial credit union answers to its provincial regulator, and a fifty to three hundred person professional services firm sits outside all of it.

The honest connection between all of this and an exercise is not that any law requires one. It is that each of these obligations turns on a decision made under pressure by people who may never have made it before: is this reportable, is there a real risk of significant harm, who signs off, who tells the customer. A plan that has been rehearsed makes those decisions faster. A plan that has not been rehearsed makes them for the first time on the worst day.

What does the market look like?

22 percent of Canadian businesses held cyber risk insurance in 2023, up from 16 percent two years earlier (Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2024).

For context on the underlying risk, about 16 percent of Canadian businesses were impacted by a cyber security incident that year, and recovery spending reached 1.2 billion dollars, roughly double the 2021 figure (Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2024).

Meanwhile only 26 percent of Canadian businesses had written cyber security policies in place, unchanged from 2021 (Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2024).

Read those together. Insurance uptake is climbing fast, documented policy is flat, and a rising share of the market is being asked control questions it has not previously had to answer. That is the actual state of the Canadian mid-market, and it is why the testing line surprises people.

Has the market got harder?

Harder to qualify for, rather than harder to buy.

The visible change over the last few years is not that cover disappeared. It is that the application got longer and the control answers started carrying weight. Multi-factor authentication moved from a good idea to a condition. Backup and restore testing stopped being taken on trust. Incident response testing arrived on forms that previously asked only whether a plan existed, which is exactly the shift this page is about.

The Canadian numbers are consistent with a market absorbing more risk rather than retreating from it. Insurance uptake climbed from 16 to 22 percent of businesses between 2021 and 2023, while the share of businesses actually impacted by an incident fell from 18 to 16 percent (Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2024). More buyers, fewer incidents, and recovery costs that doubled anyway.

For a mid-market buyer the practical effect is narrow and specific. The questions are more detailed than they were, and the answers are more likely to be revisited. That is the whole of it, and it does not justify anybody’s urgency messaging.

What should you do about the twelfth row?

Work the list once, early, before the application arrives. Most firms discover they are in better shape than they assumed on eleven of the controls and have nothing at all on the incident response testing line.

Then decide who the answer is for. If it is only an internal record, run an exercise yourself using one of the published free kits and write it up properly. If an underwriter, an enterprise customer or a claims reviewer will read it, the difference between your account and an outside party’s confirmation is the whole question, and it is the only part of this list you cannot produce alone.