A-Z Insurance | Sources checked October 29, 2026 | For Ontario businesses
If your booking system and business email stopped working, could your team find the response plan without using either? A short discussion exercise can expose unanswered questions before a real interruption.
Start with a discussion, not a shutdown
The Canadian Centre for Cyber Security describes tabletop testing as a team discussion of a simulated disruption, used to clarify roles and reveal weaknesses in a plan. Its emergency-preparedness guide was first released in January 2026; this is established guidance, not a new October 29 insurance requirement. [1]
Our suggested exercise below is a planning aid, not a security certification or an insurer-mandated test. Use a fictional scenario and discuss decisions only. Do not disconnect working systems, send test claims or expose real client records.
Try this scenario with your team
Hypothetical exercise—not an actual customer incident: the business opens on Monday, but staff cannot access bookings or email. The cause is unknown. The usual manager is unavailable.
- Who receives the first report, and who is the backup decision-maker? Where can staff find their contact details without business email?
- Which essential activity must continue first? Discuss a safe temporary way to handle it and what information staff should not copy into personal accounts.
- Who contacts the IT provider, and what information would that person record about the disruption?
- Who checks the policy’s incident-reporting instructions and contacts the designated insurer response service? Who keeps a record of the instructions received?
The Cyber Centre recommends alternate contact methods, backup contacts and a defined communications process. Use the discussion to check whether your actual contact list meets those needs. [2]
Separate discussion from proof of recovery
A team saying “we have backups” does not demonstrate that its systems can be restored. Ask the IT lead to explain what a separate recovery test would verify and how it would avoid disrupting customers. The Cyber Centre advises using a test environment; a walkthrough does not enact the recovery steps, whereas a cutover test can interrupt business. [3]
Put the insurance response into the rehearsal
An insurer’s support arrangements can matter alongside the coverage limit. For example, Intact’s Canadian privacy-breach overview describes access to specialist support as part of that coverage. This illustrates why your team should locate the services in its own policy; it does not establish that your business has that product or that every outage is insured. [4]
Ask your broker to identify the notification route, any consent requirements for hiring specialists, and the relevant limits, deductibles and conditions. These are questions for your specific contract, not a statement that all policies impose the same rules. Do not wait for a scheduled exercise to report a real suspected incident under your policy’s instructions.
Finish with an action list
Write down each unanswered question, one responsible person and a target completion date. Resolve the gaps and repeat the discussion after important changes. Bring the insurance questions to A-Z Insurance; start with a general enquiry and arrange a secure channel before sharing policy or technical documents.
General information only, not legal or cyber-security advice. An exercise does not guarantee prevention, recovery, eligibility, a discount or claim payment. Actual coverage depends on the issued policy and endorsements.
Related services
Public sources
- Cyber Centre: Emergency preparedness planning (ITSM.10.014) (First release/effective: January 2026)
- Cyber Centre: Incident response plan (ITSAP.40.003) (Modified: 2026-01-16)
- Cyber Centre: IT recovery plan (ITSAP.40.004) (Modified: 2026-01-16)
- Intact: Business assistance services, Privacy Breach section (No separate publication date displayed)