Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
SOC 1 vs SOC 2 in Canada: CSAE 3416, CSAE 3000 and what your clients actually need
SOC 1 supports your clients' financial statement audits; SOC 2 addresses security and related criteria. How CSAE 3416 and CSAE 3000 fit, and how to pick.
Read the insight →Answering client security questionnaires without starting from zero every time
Security questionnaires eat sales and security time. A practical method to build a reusable answer library, back it with evidence and keep it current.
Read the insight →Reporting a breach to the Privacy Commissioner: the “real risk of significant harm” test explained
Under PIPEDA, a breach must be reported when it creates a real risk of significant harm. Here is how to weigh sensitivity and probability of misuse, and what…
Read the insight →OSFI Guideline B-10: what third-party risk management means for suppliers to Canadian banks and insurers
OSFI's Guideline B-10 has applied since 2024-05-01. What federally regulated banks and insurers now expect from their suppliers, and how vendors can prepare.
Read the insight →Automated decisions and AI: transparency duties under Law 25 (s. 12.1) and what Bill C-36 proposes
Law 25 already requires notice, explanations and human review for fully automated decisions. Bill C-36 proposes similar federal rules. What applies now and how to prepare.
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.