Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
The PCI SSC’s 2026 request for comments on PCI DSS: what it signals
The PCI SSC sought stakeholder feedback on PCI DSS v4.0.1 from 2026-06-03 to 2026-07-20. No new version was announced. Here is what the request for comments does and…
Read the insight →Quebec’s Law 25: three obligations businesses still miss
Law 25 has been fully in force since 2024. These are the three requirements we most often find missing.
Read the insight →Canada’s Retail Payment Activities Act: what payment service providers must do since 2025-09-08
Since 2025-09-08, the Bank of Canada supervises payment service providers under the RPAA. Here is who is covered and what registration, risk management, incident reporting and safeguarding involve.
Read the insight →Revised CAS 240 (fraud) and CAS 570 (going concern): what changes for audits from December 2026
Revised CAS 240 and CAS 570 apply to audits of periods beginning on or after 2026-12-15. What changes for auditors, management and audit committees.
Read the insight →PCI DSS v4.0: the payment-page rules now in force
Two PCI DSS v4.0 requirements aimed at skimming scripts became mandatory on 2025-03-31. Here is what they ask and how to meet them.
Read the insight →Parliament is back: where Bills C-36 and C-8 stand, and what to do this fall
Bill C-36 on privacy is still at first reading; Bill C-8 on cyber security is law but not yet in force. A practical fall checklist for privacy and…
Read the insight →Bill C-8 is law: what the Critical Cyber Systems Protection Act changes, and when
Bill C-8 received royal assent on 2026-06-15. Why most obligations are not yet in force, what designated operators will owe, and how the law reaches their suppliers.
Read the insight →Bill C-36: what Canada’s proposed privacy reform could mean for you
Bill C-36 would replace PIPEDA with the Protecting Privacy and Consumer Data Act. New rights, a new regulator, penalties up to $10 million or 3% of global revenue,…
Read the insight →Bill C-8: Canada revives its critical infrastructure cyber security law
Bill C-8 brings back the Critical Cyber Systems Protection Act for banks, telecoms, energy and transportation. What designated operators would have to do, and why their suppliers should…
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.