Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
Segmentation testing: why reducing PCI scope needs proof
Segmentation can shrink PCI DSS scope, but only with proof. Merchants must test it yearly and service providers every six months, plus after changes. Here is what that…
Read the insight →OSFI Guideline B-10: what third-party risk management means for suppliers to Canadian banks and insurers
OSFI's Guideline B-10 has applied since 2024-05-01. What federally regulated banks and insurers now expect from their suppliers, and how vendors can prepare.
Read the insight →OSFI Guideline B-13: technology and cyber risk expectations, explained for vendors and fintechs
Guideline B-13 has applied to federally regulated financial institutions since 2024-01-01. What its three domains mean for vendors and fintechs serving them.
Read the insight →IFRS 18 arrives in 2027: what changes in your income statement and what to start now
IFRS 18 replaces IAS 1 for periods beginning on or after 2027-01-01. New categories, required subtotals and disclosed performance measures: what CFOs should start now.
Read the insight →Canada’s EU adequacy status and why PIPEDA reform matters to exporters
Canada's EU adequacy status lets European data flow to Canadian businesses with fewer hurdles. It covers PIPEDA only, and federal reform under Bill C-36 is back. What exporters…
Read the insight →The PCI SSC’s 2026 request for comments on PCI DSS: what it signals
The PCI SSC sought stakeholder feedback on PCI DSS v4.0.1 from 2026-06-03 to 2026-07-20. No new version was announced. Here is what the request for comments does and…
Read the insight →Canada’s Retail Payment Activities Act: what payment service providers must do since 2025-09-08
Since 2025-09-08, the Bank of Canada supervises payment service providers under the RPAA. Here is who is covered and what registration, risk management, incident reporting and safeguarding involve.
Read the insight →PCI DSS v4.0: the payment-page rules now in force
Two PCI DSS v4.0 requirements aimed at skimming scripts became mandatory on 2025-03-31. Here is what they ask and how to meet them.
Read the insight →Parliament is back: where Bills C-36 and C-8 stand, and what to do this fall
Bill C-36 on privacy is still at first reading; Bill C-8 on cyber security is law but not yet in force. A practical fall checklist for privacy and…
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.