If One Vendor Stops, What Stops With It?

What changed: the conversation is bigger than one computer

In an October 20, 2026 commentary, Insurance Bureau of Canada’s Mahan Azimi describes a more stable Canadian cyber insurance market alongside continuing concerns about severe losses, AI and dependence on common technology providers. IBC highlights the possibility that a disruption at one widely used provider can affect many businesses at once. It also identifies security practices and vendor oversight as relevant to insurers’ assessments.

That is a Canada-wide industry perspective, not a new BC rule or a statement about your policy. This article’s proposed business review below is IAM’s own analysis. It does not establish whether an outage, fraud loss or interruption would be covered.

IAM analysis · an operational exercise

Draw the journey from enquiry to finished job

For a contractor, a useful starting point is the path from a customer finding the company to the invoice being reconciled. Write down the services used at each step: website hosting, enquiry form, business email, appointment calendar, document storage and payment system. A small business may discover that several apparently separate functions depend on one account or provider.

Do this with the people who actually handle the work. Ask them to explain yesterday’s ordinary enquiry without opening a customer file in a public meeting. Where did the message arrive? Who acknowledged it? Where was the site information saved? Which system tells the crew that an appointment changed? The point is to uncover the real workflow, including manual steps that a software inventory can miss.

Record the dependency, not the customer’s private details

A planning sheet needs service names and business responsibilities. It does not need passwords, payment credentials, medical information or copies of live customer documents. Keep security-sensitive recovery instructions in the business’s approved restricted system. Use the public-facing sheet only to describe what the process requires and who owns it.

Make the customer message match what the team can do

The marketing implication is straightforward: avoid promising a response process the business cannot maintain. If the enquiry form is unavailable, an agreed alternate contact route is more useful than a generic error page. Decide who can approve a status notice, what it can truthfully say and when it should be removed. A template should leave room for facts that are still being investigated.

For example, a proposed notice might say that online enquiries are temporarily unavailable and identify a verified business phone number. It should not say that no information was affected unless the responsible team has established that. Likewise, an acknowledgement that a message was received should not imply that a service appointment, repair or insurance arrangement is confirmed.

Keep payment verification separate from a familiar-looking email

The Insurance Council of BC’s August 11 business email compromise advisory warns that messages can impersonate known business contacts. Its advice includes multi-factor authentication and checking unusual requests through another method, such as a known phone number. This is established guidance, not a new announcement today.

In our proposed workflow, record who verifies a requested change and where an approved contact number comes from. Build the pause into the process so it does not rely on one unusually observant employee. A reminder buried in an onboarding document is less useful than a clear decision point at the moment banking details or other sensitive instructions change.

Take a short, specific agenda to your broker

With the dependency sheet prepared, ask your licensed insurance professional how the actual policy treats interruption involving an outside provider, notification obligations, relevant waiting periods, exclusions and any required response arrangements. Ask which documents they need to assess those questions. Do not assume a familiar insurance label answers every scenario.

IBC’s public cyber safety guidance recommends incident planning, checking outsourced services and testing data restoration. Use that resource with the appropriate technical adviser to plan a small rehearsal. Record what worked, what failed and the next correction; do not turn one successful test into a claim that every incident can be handled.

A useful next action is modest: choose one business-critical handoff, name its owner and confirm the fallback in a controlled exercise. These are original operational suggestions, not insurance conditions. Availability, coverage and claims decisions depend on the actual policy and circumstances. IAM supplies marketing and communications analysis; it is not acting as a licensed insurance broker here.

Continue the business review

For separate BC compliance preparation, see our restricted insurance website-readiness guide. For property operations, see the strata winter responsibilities checklist. Each covers a different decision and should not be treated as evidence of cyber coverage.

Sources and editorial scope

1. IBC: Canada’s Cyber Insurance Market Stabilizes as AI-Enabled Risks Grow More Complex — Mahan Azimi, October 20, 2026; industry commentary.
2. Insurance Council of BC: Protecting clients from business email compromise — August 11, 2026; BC professional guidance.
3. IBC: Safeguard your organization from cyber risk — undated public guidance, checked October 27, 2026.

Sources checked October 27. No individual insurer, policy, business incident or price is evaluated. All graphics are original IAM explanatory artwork; no source photography was republished.