Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
Multi-factor authentication for all access into the cardholder data environment: requirement 8.4.2 explained
Since 2025-03-31, PCI DSS requires MFA for all non-console access into the cardholder data environment, not only for administrators. Here is what that means in practice.
Read the insight →Privacy impact assessments under Law 25: when you need one and what goes in it
Law 25 requires a privacy impact assessment for new information systems, transfers outside Quebec and some research uses. Here is when it applies and what a proportionate PIA…
Read the insight →Targeted risk analysis under PCI DSS 4.x: what it is and how to write one
PCI DSS 4.x lets organizations set some control frequencies themselves if they justify them in a targeted risk analysis. Here is when you need one and how to…
Read the insight →Cookies and tracking under Law 25: privacy by default in practice (ss. 8.1 and 9.1)
Section 8.1 governs tracking and profiling technologies; section 9.1 sets privacy by default but excludes cookie settings. Here is how the two fit together on a real website.
Read the insight →Penetration testing vs vulnerability scanning vs ASV scans: what PCI DSS actually requires
Vulnerability scans, ASV scans and penetration tests are different activities with different PCI DSS rules. Here is what requirements 11.3 and 11.4 ask for, and how often.
Read the insight →Segmentation testing: why reducing PCI scope needs proof
Segmentation can shrink PCI DSS scope, but only with proof. Merchants must test it yearly and service providers every six months, plus after changes. Here is what that…
Read the insight →Reporting a breach to the Privacy Commissioner: the “real risk of significant harm” test explained
Under PIPEDA, a breach must be reported when it creates a real risk of significant harm. Here is how to weigh sensitivity and probability of misuse, and what…
Read the insight →Unattended payments: PCI and device security risks for parking, fuel, EV charging and kiosks
Fuel pumps, parking stations, EV chargers and kiosks face skimming, tampering and network risks. Here is what PCI PTS and PCI DSS require, and practical steps for operators.
Read the insight →IFRS 18 arrives in 2027: what changes in your income statement and what to start now
IFRS 18 replaces IAS 1 for periods beginning on or after 2027-01-01. New categories, required subtotals and disclosed performance measures: what CFOs should start now.
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.