Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
Securing AI use: the Cyber Centre’s 10 AI security measures
The Canadian Centre for Cyber Security's new primer sets out 10 AI security measures in three pillars. What each one asks for, and how it fits a PCI…
Read the insight →ISO/IEC 27701:2025: privacy certification no longer needs ISO 27001
The 2025 edition of ISO/IEC 27701 is a standalone privacy management system standard. Who benefits, how it maps to Quebec's Law 25, and what organizations certified to the…
Read the insight →The EU Cyber Resilience Act: what Canadian exporters must report since 2026-09-11
Selling connected hardware or software into the EU? The Cyber Resilience Act's 24-hour vulnerability reporting duty applies since 2026-09-11, and the main obligations follow on 2027-12-11. Scope, deadlines,…
Read the insight →CPCSC: Canada’s new cyber security certification for defence suppliers
The Canadian Program for Cyber Security Certification started with Level 1 in 2026, and Level 2 certification phases into defence contracts from April 2027. What each level requires…
Read the insight →ISO/IEC 42001: how to show clients your AI is governed
AI governance questions are landing in security questionnaires. What ISO/IEC 42001 certifies, how it builds on ISO 27001, why accredited certification matters in Canada, and a practical first…
Read the insight →PCI DSS v4.0.1: what the limited revision changed and what it did not
PCI DSS v4.0.1 clarified wording but added no new requirements. Here is what changed, what stayed the same, and what Canadian organizations should update now.
Read the insight →What to record in your Law 25 confidentiality incident register (and how long to keep it)
Every confidentiality incident must be logged under Law 25, reported or not. Here are the eight elements your register needs and the five-year retention rule.
Read the insight →The ISO 27001:2013 transition is over: what certified organizations should do now
The deadline to move to ISO/IEC 27001:2022 passed on 2025-10-31. Here is what that means for your certificate, your customers and your next surveillance audit.
Read the insight →Multi-factor authentication for all access into the cardholder data environment: requirement 8.4.2 explained
Since 2025-03-31, PCI DSS requires MFA for all non-console access into the cardholder data environment, not only for administrators. Here is what that means in practice.
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.