Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
ISO/IEC 27701:2025: privacy certification no longer needs ISO 27001
The 2025 edition of ISO/IEC 27701 is a standalone privacy management system standard. Who benefits, how it maps to Quebec's Law 25, and what organizations certified to the…
Read the insight →CPCSC: Canada’s new cyber security certification for defence suppliers
The Canadian Program for Cyber Security Certification started with Level 1 in 2026, and Level 2 certification phases into defence contracts from April 2027. What each level requires…
Read the insight →Post-quantum cryptography: why your first step is a cryptographic inventory
NIST's post-quantum standards are final and Canada has a federal migration roadmap to 2035. Why the first step is a cryptographic inventory, and how PCI DSS requirements 4.2.1.1…
Read the insight →Phishing and ransomware: the PCI DSS 4.x controls that actually help
Ransomware is the top cybercrime threat to Canadian critical infrastructure and phishing remains a leading way in. Five PCI DSS 4.x requirements that reduce the risk for any…
Read the insight →The new public-sector reporting model (PSAS, 2026-04-01): what municipalities and school boards must prepare
PSAB's Conceptual Framework and PS 1202 apply for fiscal years beginning on or after 2026-04-01. What changes in public-sector statements and how to prepare.
Read the insight →Unattended payments: PCI and device security risks for parking, fuel, EV charging and kiosks
Fuel pumps, parking stations, EV chargers and kiosks face skimming, tampering and network risks. Here is what PCI PTS and PCI DSS require, and practical steps for operators.
Read the insight →Revised CAS 240 (fraud) and CAS 570 (going concern): what changes for audits from December 2026
Revised CAS 240 and CAS 570 apply to audits of periods beginning on or after 2026-12-15. What changes for auditors, management and audit committees.
Read the insight →Parliament is back: where Bills C-36 and C-8 stand, and what to do this fall
Bill C-36 on privacy is still at first reading; Bill C-8 on cyber security is law but not yet in force. A practical fall checklist for privacy and…
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.