Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
Securing AI use: the Cyber Centre’s 10 AI security measures
The Canadian Centre for Cyber Security's new primer sets out 10 AI security measures in three pillars. What each one asks for, and how it fits a PCI…
Read the insight →Consumer-driven banking: the security bar for fintechs and payment providers
Canada's open banking regulations were proposed on 2026-06-27. Who must participate, the four accreditation pathways, the security and breach-reporting requirements, and how RPAA-registered PSPs get a head start.
Read the insight →CPCSC: Canada’s new cyber security certification for defence suppliers
The Canadian Program for Cyber Security Certification started with Level 1 in 2026, and Level 2 certification phases into defence contracts from April 2027. What each level requires…
Read the insight →Phishing and ransomware: the PCI DSS 4.x controls that actually help
Ransomware is the top cybercrime threat to Canadian critical infrastructure and phishing remains a leading way in. Five PCI DSS 4.x requirements that reduce the risk for any…
Read the insight →Most breaches still start with a known weakness: scanning and patching under PCI DSS 4.0.1
Vulnerability exploitation is now the leading way into a breach. Here is how PCI DSS 4.0.1 links risk ranking (6.3.1), patch deadlines (6.3.3) and internal and external scanning…
Read the insight →How a penetration test runs: from scoping to retest
What actually happens during a penetration test, step by step: scoping and authorization, reconnaissance, exploitation, reporting and the retest that PCI DSS requirement 11.4.4 expects.
Read the insight →Sending personal information outside Quebec: assessing cloud and SaaS providers (s. 17)
Hosting client data in Ontario, the US or Europe is allowed under Law 25, but only after a privacy impact assessment and a written agreement. Here is a…
Read the insight →ISO 27001 or SOC 2? Choosing the right proof for Canadian SaaS and service providers
ISO 27001 certifies a management system; SOC 2 reports on controls. How Canadian SaaS and service providers can decide which one customers will actually accept.
Read the insight →SOC 1 vs SOC 2 in Canada: CSAE 3416, CSAE 3000 and what your clients actually need
SOC 1 supports your clients' financial statement audits; SOC 2 addresses security and related criteria. How CSAE 3416 and CSAE 3000 fit, and how to pick.
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.