An Ottawa small business can buy IT help two ways, as a monthly contract that tries to stop problems before they start or as an hourly bill after something breaks, and published 2026 price guides put a full monthly contract at roughly $100 to $300 CAD per user.
IT services for an Ottawa small business usually come as managed services, a monthly fee per user or per device, or as break-fix work billed when something fails. What the fee covers differs a great deal between providers, so the price alone tells you little. This guide explains both models, what a typical contract includes, how Microsoft 365 and Google Workspace fit in, what to ask about backups, the baseline security steps from the Canadian Centre for Cyber Security, the CyberSecure Canada certification, your PIPEDA duties if customer data leaks, and where Invest Ottawa's advisory centre can help.
Key Highlights
TL;DR: Managed IT services bill a monthly fee per user or per device and give you someone responsible for monitoring, patching and support. Break-fix bills only when something breaks. Whichever you choose, ask who holds the admin accounts, whether backups are tested, and who tells you first if there is a breach. Under PIPEDA you must keep a record of every breach and report the serious ones.
| Quick Facts | Details |
|---|---|
| 📅 Typical price | Published 2026 guides give about $100 to $250 CAD per user per month for fully managed IT in Ontario, and $100 to $300 across Canada. Monitoring-only plans are listed lower |
| 📍 Advice in Ottawa | Invest Ottawa Small Business Centre, 7 Bayview Station Rd, +1 (613) 828-6274, request advisory services on its website |
| 🎟️ Licences | Microsoft 365 Business Basic is $9.50 CAD per user per month and Business Standard is $19.00 CAD, paid yearly, plus tax |
| ⏰ Breach duty | Report breaches with a real risk of significant harm to the Privacy Commissioner, tell the people affected, and keep records of all breaches for two years |
Managed IT Services vs Break-Fix for an Ottawa Small Business
Break-fix is the older model. Something stops working, you call, and you pay for the time or the job. Managed services turn that around: for a monthly fee, a provider takes on preventive work such as monitoring, patching and help desk support, so fewer problems reach you in the first place. One Canadian provider's pricing guide puts the difference simply: monitoring means someone can see the problem, while fully managed means someone is responsible for resolving it and reducing repeat issues.
There is a middle option. The same guide lists monitoring-only plans, which cost less because the provider watches systems and sends alerts but does not own the fix, and remediation is billed separately. That can work if you have a staff member who will act on the alerts, and not if you expect the provider to handle it.
Neither model is wrong for every business. A very small office with a handful of devices and little sensitive data can reasonably stay on break-fix. The trade-off is that nobody is watching updates or backups until something goes wrong. The Canadian Centre for Cyber Security tells smaller organizations to assume incidents will happen and to know in advance who responds and what they are responsible for. If you cannot answer that today, a managed contract is one way to answer it.
What a Monthly IT Contract Covers and How It Is Priced
Providers in Ontario generally quote in one of three ways. Per user charges a flat monthly rate for each employee, covering their devices, accounts and support requests, and it is the easiest to budget and compare. Per device charges for each managed workstation, server or firewall, which can suit shared computers, though providers count devices differently, so a quote that counts only laptops looks cheaper than one that counts servers and network equipment too. Tiered packages bundle services into basic, standard and advanced plans, and one provider's standard tier may include security that another bills separately.
The ranges below come from two 2026 price guides published by managed-IT companies, so treat them as marketing ballpark figures, not quotes. Neither is specific to Ottawa.
- Ontario guide. Most Ontario businesses pay between $100 and $250 per user per month for a fully managed plan. For a typical 20 to 50 person business with help desk, monitoring, patching, backup and baseline security, the guide gives $120 to $220.
- Canada-wide guide. Per-user plans run $100 to $300 per user per month. It lists monitoring-only at $15 to $75 per user, per-device pricing at $10 to $300 per device, and project work such as migrations at $125 to $250 per hour or $10,000 to $100,000 per project.
- Quick arithmetic. Applying the Ontario guide's $120 to $220 range to a 10-person office gives about $1,200 to $2,200 a month before HST. That is arithmetic, not a quote: 10 people is below the guide's 20-to-50-person band.
The guides describe much the same package: a help desk, monitoring and patching, backup and recovery, firewall and network management, security tools, adding and removing staff accounts, and periodic planning reviews. Both also warn that some items are billed separately. Ask whether onboarding is a one-time fee or built into the monthly price. Ask about hardware, software licences, office moves, major migrations, on-site visits, after-hours support and incident response too. A lower quote may simply cover less.
Microsoft 365 or Google Workspace: What You Still Need an IT Provider For
Most small businesses in Ottawa pick one of two platforms for email, files and meetings. Microsoft lists Microsoft 365 Business Basic at $9.50 CAD per user per month, paid yearly, plus applicable tax. It includes web and mobile versions of Word, Excel, PowerPoint and Outlook, business email, 1 TB of cloud storage per user and Teams. Business Standard is $19.00 CAD per user per month and adds installed desktop apps, with a monthly-billing option at $22.80 CAD. These plans are for up to 300 users.
Security is where the plans differ. Microsoft says Business Premium adds advanced threat protection against phishing and malware, plus device management. Defender for Business, its endpoint protection product, is sold on its own at $4.10 CAD per user per month and is included in Premium.
Google Workspace sells Business Starter, Standard and Plus, also capped at 300 users, with pooled storage of 30 GB, 2 TB and 5 TB per user. Google lists 2-step verification and Gmail phishing and spam protection on every plan, with endpoint management rising from fundamental to advanced on Plus. Its pricing page displays prices by region, so check the Canadian price at sign-up.
Buying the licence does not finish the job. Somebody has to switch on two-factor authentication, remove a departing employee's access, and keep laptops patched. The Cyber Centre also advises that administrative accounts for cloud services use two-factor authentication and differ from your internal admin accounts. So ask whether the tenant is in your company's name and who holds the admin logins. If you ever change providers, you should not need their permission to get in. The Cyber Centre also suggests asking where an outsourced provider stores your sensitive information and under which legal jurisdiction.
Backups: What to Ask an IT Provider Before You Sign
The Cyber Centre's baseline advice is to back up essential business information regularly to an external, secure location, and to keep clear procedures for restoring it. It says organizations should check that the backup and restore process works as expected, store backups encrypted, and limit access to the people who test or restore them. Long-term copies, such as weekly ones, should be kept offline. Frequent daily copies may stay online. It also suggests storing a copy offsite, either physically or through a cloud service, in case of fire, flood or a local cyber incident.
Turn that into questions for any provider:
- What is covered. Ask whether the plan backs up laptops, the file server, and the cloud mailboxes and documents you keep in Microsoft 365 or Google Workspace, because it is easy to assume they are covered.
- How often and where. Ask how frequently copies run and where they are stored, including which country.
- Who can delete them. Ask whether an attacker who steals an admin login could erase the backups as well.
- When it was last restored. Ask for the date of the last restore test, not just a promise that backups are scheduled. Both pricing guides above treat tested restores as part of a proper package.
A subscription is not a backup plan. Microsoft's own FAQ tells customers to save their data before cancelling, because administrators keep limited access for only 90 days afterwards.
Cybersecurity Basics and CyberSecure Canada for Small Business
The Canadian Centre for Cyber Security publishes a free guide, Baseline Cyber Security Controls for Small and Medium Organizations. It is written for organizations under 500 employees and applies an 80/20 idea: most of the benefit for a fraction of the effort. The current version, 1.2, dates from 2020 and the Cyber Centre says it remains valid. The 13 controls translate into everyday jobs for you or your provider:
- Patching and protection. Turn on automatic updates for software and hardware, replace products that no longer get updates, and run anti-malware that updates and scans automatically.
- Settings and accounts. Change default administrator passwords, and give each person only the access the job needs. Administrator accounts should not be used for email or browsing.
- Two-factor sign-in. Require it wherever possible, and at least for financial accounts, system administrators, cloud administration and senior executives. The guide also says to force a password change only when there is suspicion or evidence of compromise.
- People. Train staff to spot malicious emails and links. Our guides to common scams in Ottawa and fake package delivery texts give you real examples to use.
- Network and email. Use a dedicated firewall, put DMARC on your email domain, filter email in and out, and never connect public Wi-Fi to the business network. If your team works from a shared space instead of its own office, our coworking spaces guide covers the options in Ottawa.
- A written incident response plan. It should say who does what and whom to call, with a paper copy for the day the network is down. The guide also suggests considering cyber insurance that covers response and recovery.
On cost, the guide cites industry analysis that organizations typically spend up to 13% of their IT budget on cyber security and recommends 4 to 7%. ISED's page also points to a free eLearning course, Course 625, Cyber Security for Small and Medium Organizations, through the Cyber Centre's Learning Hub. Check which account type you need first.
CyberSecure Canada is a voluntary certification built on those controls. It started as a federal program, but ISED says it stopped being the program authority on March 31, 2023, and the Standards Council of Canada now accredits the certification bodies. Certification is now against CAN/DGSI 104:2021 Rev 1:2024, from the Digital Governance Standards Institute, which separates Level 1 from Level 2 requirements for areas such as training, backups and incident response. The Standards Council says the certification mark lets customers, partners and suppliers see that a business has met the baseline controls. We found no published price for certification, so ask an accredited certification body for a quote. The Standards Council keeps a searchable directory of accredited organizations. Nothing in the program makes it a legal requirement.
If something does go wrong, the Cyber Centre has a form for organizations to report a cyber incident, and it says to contact local police in an emergency. The RCMP's Report Cybercrime and Fraud website takes reports from businesses too, and the RCMP asks victims to keep reporting to local police as well.
PIPEDA Breach Reporting for Ontario Small Businesses
PIPEDA, the federal Personal Information Protection and Electronic Documents Act, covers private-sector organizations that collect, use or disclose personal information in the course of commercial activity. The Privacy Commissioner's office names Alberta, British Columbia and Quebec as the provinces with their own private-sector laws. Ontario is not among them, so PIPEDA is the main privacy law for most Ottawa businesses. The Commissioner's guidance says plainly that small businesses are included.
Under PIPEDA a breach of security safeguards means the loss of, unauthorized access to, or unauthorized disclosure of personal information. You have three duties:
- Report to the Privacy Commissioner any breach involving personal information under your control that creates a real risk of significant harm, whether it affects one person or a thousand.
- Notify the affected people, directly and as soon as feasible once you have decided the breach meets that test. The notice should say what happened, what information was involved, what you have done, and what they can do, such as changing passwords or watching their accounts. You must also tell any organization that can reduce the harm, such as the police or your payment processor.
- Keep a record of every breach for two years, including the ones you decided did not need reporting. A short note of why you judged the risk was low is part of a good record.
Real risk of significant harm depends on how sensitive the information is and how likely it is to be misused. The Commissioner's office offers an online self-assessment tool and a breach report form. Knowingly breaking the reporting, notification or record-keeping rules is an offence that can lead to fines, although the Commissioner does not prosecute offences or issue fines itself.
This affects how you write an IT contract. The Commissioner says that when you hand personal information to a processor, you remain responsible for breach reporting. It tells organizations to have enough contractual arrangements with the processor to cover those duties. In practice, ask your provider to commit in writing to telling you promptly about any incident touching your data, and to keep logs you can use to judge what was exposed.
Businesses that act as custodians of personal health information in Ontario also fall under the Personal Health Information Protection Act (PHIPA). The Information and Privacy Commissioner of Ontario says custodians must report certain breaches at the first reasonable opportunity, and that stolen information includes a ransomware or other malware attack, unless the data was de-identified or encrypted. This article is general information, not legal advice.
Invest Ottawa Advisory Support and How to Shortlist an IT Provider
Invest Ottawa runs a Small Business Centre. Its programs are delivered as an Ontario Small Business Advisory Centre, funded in partnership with the Government of Ontario. Its advisory services offer information, referrals, mentoring, workshops and business resources to entrepreneurs at all stages. Succession Ontario, a provincial program, describes the OSBAC network as offering free support to Ontario entrepreneurs. Confirm when you book that your request carries no fee. You request advisory services through a form on the Invest Ottawa website, and the page says it will reply within two weeks. Invest Ottawa is at 7 Bayview Station Road, and you can phone +1 (613) 828-6274 or email clientservices@investottawa.ca.
Be clear about what this is. The advisors listed on its site have backgrounds in business, finance, marketing and startup coaching, so it is a place to sort out budget and priorities, not an IT help desk. Tech startups and scale-ups are pointed to a separate program.
If you are an established business with 10 to 500 employees that produces tradable goods or services, Ontario also has Senior Business Advisors. The province says they help with understanding regulations and with referrals for things like technology adoption. Ottawa is east of Durham Region, so the eastern address applies: easternregionbas@ontario.ca, or 1-800-361-3223.
When you are ready to shortlist providers, our IT Services directory page lists 135 businesses in Ottawa, drawn from OpenStreetMap data. We have not checked or recommended any of them, so vet each one yourself. Ask each for:
- A written scope and exclusions list, with the number of users and devices counted.
- Response times, and how they are measured and reported.
- Admin access, meaning your company holds the Microsoft 365 or Google Workspace admin accounts.
- Backup proof, including the date of the last restore test.
- A breach clause, with prompt written notice to you if your data is touched.
- Exit terms, including contract length, any onboarding fee, and handover documents if you leave.
FAQ
Q: How much do IT services cost for a small business in Ottawa?
No Ottawa-specific price guide turned up. Two 2026 guides from managed-IT companies give about $100 to $250 CAD per user per month for fully managed IT in Ontario and $100 to $300 across Canada, before HST. Monitoring-only plans cost less. Get written quotes from several providers and compare what each covers.
Q: Is managed IT better than break-fix for a small business?
It depends on your risk. A very small office with few devices and little sensitive data can stay on break-fix, but nobody then watches patches or backups. Managed services put someone in charge of that preventive work for a monthly fee. Compare the monthly cost with what a day of downtime would cost you.
Q: Do I have to report a data breach in Ontario?
Under PIPEDA, most Ontario businesses must report breaches with a real risk of significant harm to the Privacy Commissioner, notify the people affected, and keep a record of every breach for two years. Health care practitioners also have duties to the Information and Privacy Commissioner of Ontario under PHIPA. This is general information, not legal advice.
Q: Is CyberSecure Canada certification required?
No. It is a voluntary certification based on the Cyber Centre's baseline controls. The Standards Council of Canada now accredits the certification bodies, and ISED stopped being the program authority on March 31, 2023. It can show customers you meet the baseline, but the law does not require it. Ask a certification body for a quote.
Q: Where can I get business advice in Ottawa?
Invest Ottawa runs the Small Business Centre, which offers advisory services, mentoring and workshops through Ontario's OSBAC network, described as free support by a provincial program. Submit the request form on its website and expect a reply within about two weeks. It is a business advisory service, not an IT help desk.
Final Thoughts
For most Ottawa small businesses the real choice is not which provider is cheapest but who is responsible when something fails. A managed contract answers that in writing. Break-fix leaves it to the moment of the problem. Either way, the same few items matter: two-factor sign-in, automatic updates, backups someone has restored from, a written incident plan, and a contract that makes your provider tell you quickly if your data is touched.
Start with the Cyber Centre's free baseline guide and a conversation with Invest Ottawa. Then use the questions above to compare providers on our IT Services directory page.
Source: Canadian Centre for Cyber Security, Report a cyber incident
Source: Innovation, Science and Economic Development Canada, CyberSecure Canada
Source: Standards Council of Canada, CyberSecure Canada and Bulletin 2025-14, CAN/DGSI 104:2021 Rev 1:2024
Source: Office of the Privacy Commissioner of Canada, mandatory reporting of breaches of security safeguards
Source: Office of the Privacy Commissioner of Canada, Report a privacy breach at your business
Source: Office of the Privacy Commissioner of Canada, PIPEDA requirements in brief
Source: Information and Privacy Commissioner of Ontario, Report a health privacy breach
Source: RCMP, National Cybercrime and Fraud Reporting System
Source: Microsoft, Microsoft 365 business plans and pricing (Canada) and Microsoft 365 Business Standard
Source: Google Workspace pricing
Source: Invest Ottawa, Small Business Programs, Access Advisory Services and Contact us
Source: Succession Ontario, OSBAC support network
Source: Government of Ontario, Business advisory services for small and medium-sized businesses
