Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
How a penetration test runs: from scoping to retest
What actually happens during a penetration test, step by step: scoping and authorization, reconnaissance, exploitation, reporting and the retest that PCI DSS requirement 11.4.4 expects.
Read the insight →The ISO 27001:2013 transition is over: what certified organizations should do now
The deadline to move to ISO/IEC 27001:2022 passed on 2025-10-31. Here is what that means for your certificate, your customers and your next surveillance audit.
Read the insight →Privacy impact assessments under Law 25: when you need one and what goes in it
Law 25 requires a privacy impact assessment for new information systems, transfers outside Quebec and some research uses. Here is when it applies and what a proportionate PIA…
Read the insight →Sending personal information outside Quebec: assessing cloud and SaaS providers (s. 17)
Hosting client data in Ontario, the US or Europe is allowed under Law 25, but only after a privacy impact assessment and a written agreement. Here is a…
Read the insight →ISO 27001 or SOC 2? Choosing the right proof for Canadian SaaS and service providers
ISO 27001 certifies a management system; SOC 2 reports on controls. How Canadian SaaS and service providers can decide which one customers will actually accept.
Read the insight →Penetration testing vs vulnerability scanning vs ASV scans: what PCI DSS actually requires
Vulnerability scans, ASV scans and penetration tests are different activities with different PCI DSS rules. Here is what requirements 11.3 and 11.4 ask for, and how often.
Read the insight →Answering client security questionnaires without starting from zero every time
Security questionnaires eat sales and security time. A practical method to build a reusable answer library, back it with evidence and keep it current.
Read the insight →OSFI Guideline B-10: what third-party risk management means for suppliers to Canadian banks and insurers
OSFI's Guideline B-10 has applied since 2024-05-01. What federally regulated banks and insurers now expect from their suppliers, and how vendors can prepare.
Read the insight →OSFI Guideline B-13: technology and cyber risk expectations, explained for vendors and fintechs
Guideline B-13 has applied to federally regulated financial institutions since 2024-01-01. What its three domains mean for vendors and fintechs serving them.
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.