Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
Reporting a breach to the Privacy Commissioner: the “real risk of significant harm” test explained
Under PIPEDA, a breach must be reported when it creates a real risk of significant harm. Here is how to weigh sensitivity and probability of misuse, and what…
Read the insight →OSFI Guideline B-10: what third-party risk management means for suppliers to Canadian banks and insurers
OSFI's Guideline B-10 has applied since 2024-05-01. What federally regulated banks and insurers now expect from their suppliers, and how vendors can prepare.
Read the insight →Unattended payments: PCI and device security risks for parking, fuel, EV charging and kiosks
Fuel pumps, parking stations, EV chargers and kiosks face skimming, tampering and network risks. Here is what PCI PTS and PCI DSS require, and practical steps for operators.
Read the insight →OSFI Guideline B-13: technology and cyber risk expectations, explained for vendors and fintechs
Guideline B-13 has applied to federally regulated financial institutions since 2024-01-01. What its three domains mean for vendors and fintechs serving them.
Read the insight →The PCI SSC’s 2026 request for comments on PCI DSS: what it signals
The PCI SSC sought stakeholder feedback on PCI DSS v4.0.1 from 2026-06-03 to 2026-07-20. No new version was announced. Here is what the request for comments does and…
Read the insight →PCI DSS v4.0: the payment-page rules now in force
Two PCI DSS v4.0 requirements aimed at skimming scripts became mandatory on 2025-03-31. Here is what they ask and how to meet them.
Read the insight →Bill C-8 is law: what the Critical Cyber Systems Protection Act changes, and when
Bill C-8 received royal assent on 2026-06-15. Why most obligations are not yet in force, what designated operators will owe, and how the law reaches their suppliers.
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.