Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
ISO/IEC 27701:2025: privacy certification no longer needs ISO 27001
The 2025 edition of ISO/IEC 27701 is a standalone privacy management system standard. Who benefits, how it maps to Quebec's Law 25, and what organizations certified to the…
Read the insight →AI in the payment environment: what the PCI SSC’s new AI guidance means for your scope
The PCI SSC published Security Considerations for AI Systems on 2026-09-15. AI is scoped like any other technology. Where chatbots, agents and shadow AI pull systems into PCI…
Read the insight →Phishing and ransomware: the PCI DSS 4.x controls that actually help
Ransomware is the top cybercrime threat to Canadian critical infrastructure and phishing remains a leading way in. Five PCI DSS 4.x requirements that reduce the risk for any…
Read the insight →You can’t lose what you don’t keep: reducing PCI scope by not storing card data
The most effective PCI DSS control is often the data you never hold. How hosted payment pages, tokenization and segmentation shrink your cardholder data environment, and the traps…
Read the insight →Which PCI self-assessment questionnaire applies to you? A plain guide for small merchants
A plain-language guide to choosing the right PCI DSS Self-Assessment Questionnaire, including the 2025 changes to SAQ A for e-commerce merchants using embedded payment forms.
Read the insight →What to record in your Law 25 confidentiality incident register (and how long to keep it)
Every confidentiality incident must be logged under Law 25, reported or not. Here are the eight elements your register needs and the five-year retention rule.
Read the insight →Multi-factor authentication for all access into the cardholder data environment: requirement 8.4.2 explained
Since 2025-03-31, PCI DSS requires MFA for all non-console access into the cardholder data environment, not only for administrators. Here is what that means in practice.
Read the insight →Privacy impact assessments under Law 25: when you need one and what goes in it
Law 25 requires a privacy impact assessment for new information systems, transfers outside Quebec and some research uses. Here is when it applies and what a proportionate PIA…
Read the insight →Sending personal information outside Quebec: assessing cloud and SaaS providers (s. 17)
Hosting client data in Ontario, the US or Europe is allowed under Law 25, but only after a privacy impact assessment and a written agreement. Here is a…
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.