Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
Which PCI self-assessment questionnaire applies to you? A plain guide for small merchants
A plain-language guide to choosing the right PCI DSS Self-Assessment Questionnaire, including the 2025 changes to SAQ A for e-commerce merchants using embedded payment forms.
Read the insight →The ISO 27001:2013 transition is over: what certified organizations should do now
The deadline to move to ISO/IEC 27001:2022 passed on 2025-10-31. Here is what that means for your certificate, your customers and your next surveillance audit.
Read the insight →Multi-factor authentication for all access into the cardholder data environment: requirement 8.4.2 explained
Since 2025-03-31, PCI DSS requires MFA for all non-console access into the cardholder data environment, not only for administrators. Here is what that means in practice.
Read the insight →ISO 27001 or SOC 2? Choosing the right proof for Canadian SaaS and service providers
ISO 27001 certifies a management system; SOC 2 reports on controls. How Canadian SaaS and service providers can decide which one customers will actually accept.
Read the insight →Targeted risk analysis under PCI DSS 4.x: what it is and how to write one
PCI DSS 4.x lets organizations set some control frequencies themselves if they justify them in a targeted risk analysis. Here is when you need one and how to…
Read the insight →SOC 1 vs SOC 2 in Canada: CSAE 3416, CSAE 3000 and what your clients actually need
SOC 1 supports your clients' financial statement audits; SOC 2 addresses security and related criteria. How CSAE 3416 and CSAE 3000 fit, and how to pick.
Read the insight →Penetration testing vs vulnerability scanning vs ASV scans: what PCI DSS actually requires
Vulnerability scans, ASV scans and penetration tests are different activities with different PCI DSS rules. Here is what requirements 11.3 and 11.4 ask for, and how often.
Read the insight →Answering client security questionnaires without starting from zero every time
Security questionnaires eat sales and security time. A practical method to build a reusable answer library, back it with evidence and keep it current.
Read the insight →Segmentation testing: why reducing PCI scope needs proof
Segmentation can shrink PCI DSS scope, but only with proof. Merchants must test it yearly and service providers every six months, plus after changes. Here is what that…
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.