Step-by-step guide to exporting

Digital readiness and cybersecurity baseline checklist

What this is for

This checklist helps you review whether your digital foundations are strong enough to support exporting. It also helps you identify basic gaps to address early.

It covers core elements, such as IT infrastructure, cybersecurity hygiene, web presence, electronic documentation, and data protection, in a way that non‑technical teams can use.​

When to use it

Use this checklist:

  • when working through Is your business ready? and you want to understand your digital and cybersecurity baseline
  • before committing to e‑commerce, online customer portals, or other digital‑intensive export activities
  • after a cyber incident or “near miss,” as part of a simple internal review and follow‑up

How to use this checklist

  • Review Sections A to E and answer Yes or No for each statement based on your current situation.

  • Count your No answers in each section to identify where gaps are most significant.

  • Complete the Digital readiness snapshot to summarize your status on one page.

  • Select 3 to 8 improvement actions. Integrate them into your broader improvement plan using the Export Readiness Gate and Improvement Plan Template.​

Answer honestly and pragmatically. The goal is to surface risks and priorities, not to “pass a test.”

Section A: Basic IT foundations

Objective: Confirm that your basic hardware, software and IT responsibilities are clear and stable.

Our main business devices (computers, laptops, key tablets) use supported operating systems and receive regular updates.

Our main business devices (computers, laptops, key tablets) use supported operating systems and receive regular updates.

We use licensed and supported versions of key software (for example, office tools, accounting, customer relationship management (CRM) software) rather than outdated or unknown sources.

We use licensed and supported versions of key software (for example, office tools, accounting, customer relationship management (CRM) software) rather than outdated or unknown sources.

We have a clear contact for basic IT support (internal or external) responsible for system upkeep and updates.

We have a clear contact for basic IT support (internal or external) responsible for system upkeep and updates.

We know which devices and systems are used for business purposes, including any staff-owned devices used for work.

We know which devices and systems are used for business purposes, including any staff-owned devices used for work.

Devices are protected with screen locks and passwords.

Devices are protected with screen locks and passwords.

Lost or stolen devices can be remotely wiped.

Lost or stolen devices can be remotely wiped.

Section B: Cybersecurity hygiene

Objective: Check whether simple, widely accepted cybersecurity practices are in place.

All business devices have antivirus or anti-malware protection turned on and updated regularly.

All business devices have antivirus or anti-malware protection turned on and updated regularly.

Operating systems and key applications are set to receive security updates on a regular basis.

Operating systems and key applications are set to receive security updates on a regular basis.

Strong, unique passwords are used for email, banking, cloud services, and other key accounts (not shared across many services).

Strong, unique passwords are used for email, banking, cloud services, and other key accounts (not shared across many services).

Wherever available, multi-factor authentication (MFA) is turned on for important services such as email, online banking, accounting, or collaboration tools.

Wherever available, multi-factor authentication (MFA) is turned on for important services such as email, online banking, accounting, or collaboration tools.

Staff have basic guidance and regular reminders on identifying and handling suspicious emails, links or attachments (for example, not clicking unknown links, checking sender details).

Staff have basic guidance and regular reminders on identifying and handling suspicious emails, links or attachments (for example, not clicking unknown links, checking sender details).

When a staff member leaves the company, we have a simple process to revoke their access and recover business devices or accounts.

When a staff member leaves the company, we have a simple process to revoke their access and recover business devices or accounts.

Our domain has basic email protection set up.

Our domain has basic email protection set up.

We know who to contact (for example, IT support, bank, cyber insurer) in case of a cyber incident.

We know who to contact (for example, IT support, bank, cyber insurer) in case of a cyber incident.

Note – E-commerce and online customer portals: If you sell through your own online store, marketplaces or customer portals, treat e-commerce security as a priority area. This includes using secure payment gateways and enforcing HTTPS on all pages. It also includes keeping your store or platform software updated and limiting access to administrative accounts. Regularly review user roles, plugins, and integrations so that only what you need is enabled.

Section C: Web presence and communication

Objective: Confirm whether your online presence is credible, secure and under your control.

Our website or main online profile is reasonably up to date, with accurate contact information and current product or service descriptions.

Our website or main online profile is reasonably up to date, with accurate contact information and current product or service descriptions.

There are no obvious security warnings when visiting our website (for example, browser warnings about insecure or expired certificates).

There are no obvious security warnings when visiting our website (for example, browser warnings about insecure or expired certificates).

We can securely access and update our website, and we know who controls the domain, hosting, and content management credentials.

We can securely access and update our website, and we know who controls the domain, hosting, and content management credentials.

We use professional business email addresses (ideally using our own domain) rather than relying on personal free email accounts.

We use professional business email addresses (ideally using our own domain) rather than relying on personal free email accounts.

International prospects have at least one clear and reliable way to contact us (for example, contact form, email, phone) that is monitored regularly.

International prospects have at least one clear and reliable way to contact us (for example, contact form, email, phone) that is monitored regularly.

Domain registration and renewal are monitored to prevent accidental expiry.

Domain registration and renewal are monitored to prevent accidental expiry.

Section D: Electronic documentation and records

Objective: Check whether electronic documents and records are handled in an organized and secure way.

We can create, send and store key documents electronically (for example, quotes, invoices, contracts, shipping documents).

We can create, send and store key documents electronically (for example, quotes, invoices, contracts, shipping documents).

Important business documents are stored in shared locations (for example, shared drives or cloud folders), not only on individual devices.

Important business documents are stored in shared locations (for example, shared drives or cloud folders), not only on individual devices.

Access to sensitive files (for example, contracts, financial records, HR files) is restricted to people who need it for their role.

Access to sensitive files (for example, contracts, financial records, HR files) is restricted to people who need it for their role.

We have at least one backup method for important business data (for example, cloud backup, external drive) and know how we would restore data.

We have at least one backup method for important business data (for example, cloud backup, external drive) and know how we would restore data.

We have identified key online government and regulatory systems we will need to use (for example, the Canadian Export Declaration system, the Canadian Automated Revenue Management System Client Portal, export and licensing systems for other jurisdictions) and we know who is responsible for each account.

We have identified key online government and regulatory systems we will need to use (for example, the Canadian Export Declaration system, the Canadian Automated Revenue Management System Client Portal, export and licensing systems for other jurisdictions) and we know who is responsible for each account.

We have access to trade-related portals (for example, the Canadian Automated Revenue Management System Client Portal, the Export and Import Controls System, foreign food and drug regulator portals such as the United States Food and Drug Administration or Health Canada systems) which use individual logins, with secure password practices and multifactor authentication.

We have access to trade-related portals (for example, the Canadian Automated Revenue Management System Client Portal, the Export and Import Controls System, foreign food and drug regulator portals such as the United States Food and Drug Administration or Health Canada systems) which use individual logins, with secure password practices and multifactor authentication.

We have access to relevant carrier, marketplace, and e-commerce platform accounts (for example, shipping software, store dashboards, marketplace seller accounts) managed under our security policies, with clear account owners and offboarding steps when staff or contractors leave.

We have access to relevant carrier, marketplace, and e-commerce platform accounts (for example, shipping software, store dashboards, marketplace seller accounts) managed under our security policies, with clear account owners and offboarding steps when staff or contractors leave.

We have a simple practice for naming and versioning important documents so people can find the current version.

We have a simple practice for naming and versioning important documents so people can find the current version.

Section E: Data protection and privacy basics

Objective: Check whether you have basic awareness and safeguards for personal and sensitive data.

Some export markets have stricter privacy and cybersecurity rules (for example, the European Union’s General Data Protection Regulation (GDPR) or data-localization rules in certain jurisdictions). You should review foreign legal and regulatory requirements before entering those markets, especially if you handle customer or employee data across borders.

We have a general understanding of what personal or sensitive data we collect (for example, customer contact details, payment information, employee data).

We have a general understanding of what personal or sensitive data we collect (for example, customer contact details, payment information, employee data).

We take simple precautions to protect personal and sensitive data (for example, device lock, limited sharing of files, avoiding unencrypted public storage).

We take simple precautions to protect personal and sensitive data (for example, device lock, limited sharing of files, avoiding unencrypted public storage).

We are aware of Canadian privacy obligations.

We are aware of Canadian privacy obligations.

We understand that privacy and data-protection requirements can differ by country and are prepared to research them as we expand.

We understand that privacy and data-protection requirements can differ by country and are prepared to research them as we expand.

If we lost access to customer or business data due to an incident, we have a basic idea of who would be affected and how we would respond.

If we lost access to customer or business data due to an incident, we have a basic idea of who would be affected and how we would respond.

Digital readiness snapshot

Objective: Summarize your position on one page to support decisions and planning.

After completing the checklist, count your Yes and No answers for each section.

Section A: Basic IT foundations

Section B: Cybersecurity hygiene

Section C: Web presence and communication

Section D: Electronic documentation and records

Section E: Data protection and privacy basics

Complete the short summary below. You can copy this section into your own document.

1. One-sentence overview

Example: Our IT and web presence are generally stable, but cybersecurity practices and backups need strengthening before expanding digital export activities.

2. Main strengths (3 to 5 bullets)

For example:

  • Up-to-date devices and supported software.
  • Professional website and business email addresses.
  • Basic document storage and access controls in place.

3. Main gaps and risks (3 to 8 bullets)

For example:

  • Multi-factor authentication not enabled on key accounts.
  • No clear process to remove access when staff leave.
  • Data backups exist but have not been tested for restoration.
  • Limited staff awareness of phishing or social-engineering risks.

4. Priority areas for action (up to 3)

For example, “Strengthen account security and backups”.

  • Priority area 1
  • Priority area 2
  • Priority area 3

Attach this snapshot to your export readiness work and improvement plan using the Export Readiness Gate and Improvement Plan Template.

Turning findings into improvement actions

Objective: Select a small number of practical, time‑bound actions to strengthen your digital baseline.

Create a simple table with columns such as:

  • Priority area
  • Action
  • Owner
  • Target date
  • Status and notes

Example actions

  1. Priority area: Cybersecurity hygiene
    • Action: Turn on multi‑factor authentication (MFA) for email, online banking, and key cloud services where available.
    • Owner:
    • Target date:
  2. Priority area: Backups and recovery
    • Action: Set up a simple, regular backup for important business data and test data restoration.
    • Owner:
    • Target date:
  3. Priority area: Staff awareness
    • Action: Share 1 to 2 pages of practical tips on spotting phishing and handling suspicious emails; review during a short team meeting.
    • Owner:
    • Target date:
  4. Priority area: Access and off‑boarding
    • Action: Create a short checklist for removing access and recovering devices when staff or contractors leave.
    • Owner:
    • Target date:

Keep the list manageable (for example, 3 to 8 actions over 6 to 12 months) so progress is realistic. Integrate these actions into your broader improvement rhythm using the Export Readiness Gate and Improvement Plan Template.

Trade security programs and trusted trader status

If your company relies heavily on cross‑border movement of goods, you should also consider how your digital and physical security practices align with trusted trader programs such as the Partners in Protection (PIP) program in Canada and the United States Customs‑Trade Partnership Against Terrorism (CTPAT) program. Strong access controls, secure handling of customs and shipment data, and clear roles for managing online customs and carrier portals can support participation in these programs. These measures can also help facilitate smoother, lower‑risk border clearance for your shipments.

Developing a cybersecurity policy

Even a short, practical cybersecurity policy can make expectations clear for staff and partners. At minimum, it should describe:
  • which devices and accounts may be used for work, and how passwords and multifactor authentication are handled
  • how staff should deal with suspicious emails, links and attachments, and how to report incidents
  • rules for installing software, using cloud services and storing business documents and customer data
  • how access is granted and removed when people join, change roles, or leave
  • where backups are kept, who is responsible for them, and how often they are tested
  • who leads the response if a cyber incident occurs, and which external contacts (for example, IT support, bank, insurer, key partners) must be notified

You can start with a 1 to 2 page policy in plain language and update it as your digital activities and export markets grow.

Additional Information

Date published:

Hi! I'm Eva. Select the icon to start a chat with me.