Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
Securing AI use: the Cyber Centre’s 10 AI security measures
The Canadian Centre for Cyber Security's new primer sets out 10 AI security measures in three pillars. What each one asks for, and how it fits a PCI…
Read the insight →ISO/IEC 27701:2025: privacy certification no longer needs ISO 27001
The 2025 edition of ISO/IEC 27701 is a standalone privacy management system standard. Who benefits, how it maps to Quebec's Law 25, and what organizations certified to the…
Read the insight →Consumer-driven banking: the security bar for fintechs and payment providers
Canada's open banking regulations were proposed on 2026-06-27. Who must participate, the four accreditation pathways, the security and breach-reporting requirements, and how RPAA-registered PSPs get a head start.
Read the insight →ISO/IEC 42001: how to show clients your AI is governed
AI governance questions are landing in security questionnaires. What ISO/IEC 42001 certifies, how it builds on ISO 27001, why accredited certification matters in Canada, and a practical first…
Read the insight →Phishing and ransomware: the PCI DSS 4.x controls that actually help
Ransomware is the top cybercrime threat to Canadian critical infrastructure and phishing remains a leading way in. Five PCI DSS 4.x requirements that reduce the risk for any…
Read the insight →What to record in your Law 25 confidentiality incident register (and how long to keep it)
Every confidentiality incident must be logged under Law 25, reported or not. Here are the eight elements your register needs and the five-year retention rule.
Read the insight →Privacy impact assessments under Law 25: when you need one and what goes in it
Law 25 requires a privacy impact assessment for new information systems, transfers outside Quebec and some research uses. Here is when it applies and what a proportionate PIA…
Read the insight →Sending personal information outside Quebec: assessing cloud and SaaS providers (s. 17)
Hosting client data in Ontario, the US or Europe is allowed under Law 25, but only after a privacy impact assessment and a written agreement. Here is a…
Read the insight →Cookies and tracking under Law 25: privacy by default in practice (ss. 8.1 and 9.1)
Section 8.1 governs tracking and profiling technologies; section 9.1 sets privacy by default but excludes cookie settings. Here is how the two fit together on a real website.
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.