Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
Consumer-driven banking: the security bar for fintechs and payment providers
Canada's open banking regulations were proposed on 2026-06-27. Who must participate, the four accreditation pathways, the security and breach-reporting requirements, and how RPAA-registered PSPs get a head start.
Read the insight →Post-quantum cryptography: why your first step is a cryptographic inventory
NIST's post-quantum standards are final and Canada has a federal migration roadmap to 2035. Why the first step is a cryptographic inventory, and how PCI DSS requirements 4.2.1.1…
Read the insight →ISO/IEC 42001: how to show clients your AI is governed
AI governance questions are landing in security questionnaires. What ISO/IEC 42001 certifies, how it builds on ISO 27001, why accredited certification matters in Canada, and a practical first…
Read the insight →Phishing and ransomware: the PCI DSS 4.x controls that actually help
Ransomware is the top cybercrime threat to Canadian critical infrastructure and phishing remains a leading way in. Five PCI DSS 4.x requirements that reduce the risk for any…
Read the insight →Most breaches still start with a known weakness: scanning and patching under PCI DSS 4.0.1
Vulnerability exploitation is now the leading way into a breach. Here is how PCI DSS 4.0.1 links risk ranking (6.3.1), patch deadlines (6.3.3) and internal and external scanning…
Read the insight →How a penetration test runs: from scoping to retest
What actually happens during a penetration test, step by step: scoping and authorization, reconnaissance, exploitation, reporting and the retest that PCI DSS requirement 11.4.4 expects.
Read the insight →PCI DSS v4.0.1: what the limited revision changed and what it did not
PCI DSS v4.0.1 clarified wording but added no new requirements. Here is what changed, what stayed the same, and what Canadian organizations should update now.
Read the insight →What to record in your Law 25 confidentiality incident register (and how long to keep it)
Every confidentiality incident must be logged under Law 25, reported or not. Here are the eight elements your register needs and the five-year retention rule.
Read the insight →The ISO 27001:2013 transition is over: what certified organizations should do now
The deadline to move to ISO/IEC 27001:2022 passed on 2025-10-31. Here is what that means for your certificate, your customers and your next surveillance audit.
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.