Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
The EU Cyber Resilience Act: what Canadian exporters must report since 2026-09-11
Selling connected hardware or software into the EU? The Cyber Resilience Act's 24-hour vulnerability reporting duty applies since 2026-09-11, and the main obligations follow on 2027-12-11. Scope, deadlines,…
Read the insight →Phishing and ransomware: the PCI DSS 4.x controls that actually help
Ransomware is the top cybercrime threat to Canadian critical infrastructure and phishing remains a leading way in. Five PCI DSS 4.x requirements that reduce the risk for any…
Read the insight →You can’t lose what you don’t keep: reducing PCI scope by not storing card data
The most effective PCI DSS control is often the data you never hold. How hosted payment pages, tokenization and segmentation shrink your cardholder data environment, and the traps…
Read the insight →Most breaches still start with a known weakness: scanning and patching under PCI DSS 4.0.1
Vulnerability exploitation is now the leading way into a breach. Here is how PCI DSS 4.0.1 links risk ranking (6.3.1), patch deadlines (6.3.3) and internal and external scanning…
Read the insight →Targeted risk analysis under PCI DSS 4.x: what it is and how to write one
PCI DSS 4.x lets organizations set some control frequencies themselves if they justify them in a targeted risk analysis. Here is when you need one and how to…
Read the insight →Unattended payments: PCI and device security risks for parking, fuel, EV charging and kiosks
Fuel pumps, parking stations, EV chargers and kiosks face skimming, tampering and network risks. Here is what PCI PTS and PCI DSS require, and practical steps for operators.
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.