[{"data":1,"prerenderedAt":567},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"blog-en":45},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",[46,58,68,78,86,95,104,110,119,125,133,142,150,157,164,171,178,186,194,202,210,218,227,236,244,250,257,264,270,277,285,292,300,306,314,319,327,334,340,346,352,361,366,373,380,388,396,403,410,418,424,431,436,443,451,457,463,470,476,482,487,492,498,504,512,518,523,529,536,541,546,553,560],{"path":47,"title":48,"description":49,"category":50,"minutes":27,"date":51,"tags":52},"\u002Fen\u002Fblog\u002Fbill-c-8-ccspa-suppliers","Bill C-8 and the CCSPA: What It Means for Canadian Suppliers","Bill C-8 is law, and the CCSPA will push cyber security obligations down the supply chain. What telecom, bank and transport suppliers should prepare now.","compliance","2026-10-24",[53,54,55,56,57],"bill-c-8","ccspa","suppliers","supply-chain","small-business",{"path":59,"title":60,"description":61,"category":62,"minutes":23,"date":51,"tags":63},"\u002Fen\u002Fblog\u002Fbrand-impersonation-fake-websites","Brand Impersonation: How to Spot and Take Down a Fake Website","Look-alike domains, cloned websites, fake Facebook pages: how to detect brand impersonation targeting your business and get a fake site taken down.","threats",[64,65,66,67],"impersonation","phishing","domains","smb",{"path":69,"title":70,"description":71,"category":72,"minutes":27,"date":51,"tags":73},"\u002Fen\u002Fblog\u002Fbusiness-continuity-plan-cyberattack","Business Continuity Plan After a Cyberattack: A Template","Critical processes, RTO and RPO, manual workarounds: a practical business continuity plan template so your small business keeps serving clients after an attack.","audit",[74,75,76,77],"business continuity","ransomware","small business","planning",{"path":79,"title":80,"description":81,"category":62,"minutes":23,"date":51,"tags":82},"\u002Fen\u002Fblog\u002Fbusiness-email-compromise-ceo-fraud","Business Email Compromise and CEO Fraud: How to Stop It","Fake CEO, fake supplier, diverted payroll: how business email compromise works, what it costs Canadian small businesses and the simple controls that stop it.",[83,84,85,65],"bec","fraud","email",{"path":87,"title":88,"description":89,"category":62,"minutes":23,"date":51,"tags":90},"\u002Fen\u002Fblog\u002Fbusiness-iot-cameras-security","Business IoT Security: Cameras, Alarms and Smart Devices","Cameras, alarms, thermostats: default passwords, firmware, network segmentation, cloud accounts and vendor remote access. A practical small business guide.",[91,92,93,94,76],"iot","security cameras","network","vendors",{"path":96,"title":97,"description":98,"category":62,"minutes":23,"date":51,"tags":99},"\u002Fen\u002Fblog\u002Fbusiness-travel-cybersecurity","Business Travel Cybersecurity: What to Do Before You Leave","Public Wi-Fi, border device searches, MFA abroad, lost laptops: the cybersecurity rules to follow before, during and after every business trip.",[100,101,102,103],"travel","mobile devices","wi-fi","border",{"path":105,"title":106,"description":107,"category":62,"minutes":23,"date":51,"tags":108},"\u002Fen\u002Fblog\u002Fbusiness-wifi-security","Business Wi-Fi Security: WPA3, Guest Networks and 802.1X","WPA2 or WPA3, Personal or Enterprise mode, guest networks and smart devices: a step-by-step guide to business Wi-Fi security for Canadian small businesses.",[102,93,109,67],"wpa3",{"path":111,"title":112,"description":113,"category":50,"minutes":23,"date":51,"tags":114},"\u002Fen\u002Fblog\u002Fcpcsc-cyber-certification-defence-suppliers","CPCSC Certification: A Practical Guide for Defence Suppliers","CPCSC certification explained: the 3 levels, the 13 Level 1 controls and a practical plan for Montréal aerospace suppliers bidding on Canadian defence work.",[115,116,117,118,57],"cpcsc","defence","aerospace","certification",{"path":120,"title":121,"description":122,"category":62,"minutes":23,"date":51,"tags":123},"\u002Fen\u002Fblog\u002Fclicked-phishing-link-what-to-do","Clicked a Phishing Link? What to Do in the Next 15 Minutes","Clicked on a phishing link? The steps to take right now, depending on what happened next: a click, a typed password, an opened attachment or bank details.",[65,124,85,76],"incident response",{"path":126,"title":127,"description":128,"category":50,"minutes":23,"date":51,"tags":129},"\u002Fen\u002Fblog\u002Fconfidentiality-incident-register-template","Confidentiality Incident Register: A Law 25 Template","The confidentiality incident register Québec’s Law 25 requires: the 8 mandatory fields, a copy-ready template, filled-in examples and retention rules.",[130,131,132,50],"law 25","incident register","template",{"path":134,"title":135,"description":136,"category":137,"minutes":23,"date":51,"tags":138},"\u002Fen\u002Fblog\u002Fconstruction-company-cybersecurity","Construction Company Cybersecurity: Payment Fraud and Job Sites","Payment redirection, hacked email, job site tablets and bid documents: how a Canadian construction company can stop the fraud that targets it most.","industries",[139,140,141,67],"construction","payment fraud","spear phishing",{"path":143,"title":144,"description":145,"category":50,"minutes":23,"date":51,"tags":146},"\u002Fen\u002Fblog\u002Fcyber-insurance-questionnaire-requirements","Cyber Insurance Questionnaire: How to Answer It Right","Cyber insurance questionnaire: the controls insurers check (MFA, EDR, backups), the traps that put coverage at risk and the evidence to gather before you sign.",[147,148,149,57],"cyber-insurance","mfa","backups",{"path":151,"title":152,"description":153,"category":50,"minutes":23,"date":51,"tags":154},"\u002Fen\u002Fblog\u002Fcybersecure-canada-certification-smb","CyberSecure Canada Certification: Is It Worth It for an SMB?","CyberSecure Canada certification explained: what the CAN\u002FDGSI 104 standard requires, how the audit works, its limits, and which businesses actually benefit.",[155,118,156,57],"cybersecure-canada","can-dgsi-104",{"path":158,"title":159,"description":160,"category":50,"minutes":23,"date":51,"tags":161},"\u002Fen\u002Fblog\u002Fcyberattack-who-to-notify-canada","Cyberattack: Who to Notify in Canada, and in What Order","Hit by a cyberattack? Who to notify in Canada (insurer, bank, police, CAI, OPC, clients, Cyber Centre), in what order and under which law, step by step.",[124,130,162,163,50],"pipeda","breach notification",{"path":165,"title":166,"description":167,"category":50,"minutes":168,"date":51,"tags":169},"\u002Fen\u002Fblog\u002Fcybersecurity-statistics-quebec-canada","Cybersecurity Statistics for Quebec and Canada (2026)","Cyberattacks on small businesses, costs, privacy incidents reported to the CAI, fraud losses, recovery times: verified, sourced figures for Quebec and Canada.",7,[170,76,130,84,75],"statistics",{"path":172,"title":173,"description":174,"category":137,"minutes":27,"date":51,"tags":175},"\u002Fen\u002Fblog\u002Fcybersecurity-accounting-firms","Cybersecurity for Accounting Firms: Surviving Tax Season","Fake CRA messages, targeted EFILE accounts, tax slips sent by email: what CPA rules require and the security measures an accounting firm should put in place.",[176,177,65,130],"accountants","tax season",{"path":179,"title":180,"description":181,"category":137,"minutes":23,"date":51,"tags":182},"\u002Fen\u002Fblog\u002Fcybersecurity-clinics-healthcare-quebec","Cybersecurity for Healthcare Clinics in Quebec: What to Do First","Quebec's health information act, Law 25, EMRs and ransomware: the legal duties and the priority cybersecurity measures for a private healthcare clinic.",[183,184,185,130],"healthcare","clinics","health information",{"path":187,"title":188,"description":189,"category":137,"minutes":23,"date":51,"tags":190},"\u002Fen\u002Fblog\u002Fcybersecurity-law-firms-notaries","Cybersecurity for Law Firms and Notaries in Quebec","Codes of conduct, record-keeping rules, trust accounts and Law 25: what Quebec's professional orders expect from lawyers and notaries on cybersecurity.",[191,192,193,130],"lawyers","notaries","professional secrecy",{"path":195,"title":196,"description":197,"category":137,"minutes":23,"date":51,"tags":198},"\u002Fen\u002Fblog\u002Fcybersecurity-municipalities-quebec","Cybersecurity for Quebec Municipalities: Access Act and Law 25","Quebec municipalities fall under the Access Act, as modernized by Law 25, not the private-sector law: security duties, incident rules and practical priorities.",[199,200,201,130],"municipalities","public bodies","access act",{"path":203,"title":204,"description":205,"category":137,"minutes":27,"date":51,"tags":206},"\u002Fen\u002Fblog\u002Fcybersecurity-real-estate-mortgage-brokers","Cybersecurity for Real Estate and Mortgage Brokers in Quebec","Wire fraud before closing, ID documents, OACIQ and AMF rules: the cybersecurity measures that matter most for real estate and mortgage brokers in Quebec.",[207,208,209,130],"real estate brokers","mortgage brokers","wire fraud",{"path":211,"title":212,"description":213,"category":137,"minutes":23,"date":51,"tags":214},"\u002Fen\u002Fblog\u002Fcybersecurity-transportation-logistics","Cybersecurity for Trucking and Logistics Companies","Telematics and ELD accounts, dispatch email fraud, fuel cards, connected warehouses: the cyber risks for carriers and logistics firms, and what to do first.",[215,216,84,217],"trucking","logistics","telematics",{"path":219,"title":220,"description":221,"category":137,"minutes":23,"date":51,"tags":222},"\u002Fen\u002Fblog\u002Fcybersecurity-web-marketing-agencies","Cybersecurity for Web and Marketing Agencies: Client Access","Pages, ad accounts, CMS, DNS: how a web or marketing agency protects its clients' access with least privilege, shared vaults and a clean offboarding process.",[223,224,225,226],"agencies","marketing","access management","supply chain",{"path":228,"title":229,"description":230,"category":62,"minutes":23,"date":51,"tags":231},"\u002Fen\u002Fblog\u002Fdeepfake-voice-fraud-business","Deepfake Voice Fraud: How to Protect Your Business","A call from the 'CEO' demanding an urgent wire transfer? Call-backs to known numbers, code words and dual approval: how to stop deepfake voice fraud at work.",[232,84,233,234,235],"deepfake","ai","social engineering","wire transfer",{"path":237,"title":238,"description":239,"category":72,"minutes":23,"date":51,"tags":240},"\u002Fen\u002Fblog\u002Fmicrosoft-365-backup-do-you-need-it","Does Microsoft 365 Back Up Your Data? What Businesses Should Know","Recycle bins of 14 to 93 days, retention, Microsoft 365 Backup: what Microsoft actually protects, and when your business needs a real Microsoft 365 backup.",[241,242,243,67],"microsoft 365","backup","cloud",{"path":245,"title":246,"description":247,"category":72,"minutes":23,"date":51,"tags":248},"\u002Fen\u002Fblog\u002Femployee-offboarding-access-checklist","Employee Offboarding Checklist: Revoking Access Properly","Accounts, sessions, devices, shared passwords and vendor portals: a complete employee offboarding checklist so no access outlives an employee's last day.",[249,225,241,130],"offboarding",{"path":251,"title":252,"description":253,"category":72,"minutes":23,"date":51,"tags":254},"\u002Fen\u002Fblog\u002Fexternal-vs-internal-penetration-test","External vs Internal Penetration Test: Which Comes First?","External vs internal penetration test: what each reveals, typical cost ranges and which to start with for your small business, plus a prep checklist.",[255,93,256,57],"pentest","active-directory",{"path":258,"title":259,"description":260,"category":62,"minutes":23,"date":51,"tags":261},"\u002Fen\u002Fblog\u002Fgenerative-ai-data-leak-business","Generative AI Data Leaks: A Business Guide to ChatGPT and Copilot","How generative AI data leaks really happen with ChatGPT and Copilot, what Quebec's Law 25 requires, and a usage policy checklist your business can adopt.",[262,263,130,241],"generative ai","data leak",{"path":265,"title":266,"description":267,"category":72,"minutes":27,"date":51,"tags":268},"\u002Fen\u002Fblog\u002Fgoogle-workspace-security-audit","Google Workspace Security Audit: 12 Settings to Check","A Google Workspace security audit checklist for small businesses: super admins, 2-Step Verification, Gmail, Drive sharing and third-party app access.",[269,243,72,57],"google-workspace",{"path":271,"title":272,"description":273,"category":72,"minutes":27,"date":51,"tags":274},"\u002Fen\u002Fblog\u002Fhow-to-choose-cybersecurity-audit-firm-quebec","How to Choose a Cybersecurity Audit Firm in Quebec: 12 Criteria","Written authorization, methodology, sample report, retest, fixed price, independence: 12 vendor-neutral criteria for choosing a cybersecurity audit firm.",[72,275,276,76],"penetration testing","vendor selection",{"path":278,"title":279,"description":280,"category":62,"minutes":23,"date":51,"tags":281},"\u002Fen\u002Fblog\u002Fdeploy-business-password-manager","How to Deploy a Business Password Manager, Step by Step","Selection criteria, shared vaults, a pilot group, the master passphrase and employee offboarding: a practical plan to deploy a business password manager.",[282,283,284,67],"passwords","password manager","authentication",{"path":286,"title":287,"description":288,"category":50,"minutes":23,"date":51,"tags":289},"\u002Fen\u002Fblog\u002Fevaluate-it-provider-security","How to Evaluate Your IT Provider's Security: 12 Questions","Your managed IT provider holds the keys to your business. Here are 12 questions to ask, what a good answer looks like, and what to put in the contract.",[290,291,226,130,67],"it provider","msp",{"path":293,"title":294,"description":295,"category":72,"minutes":23,"date":51,"tags":296},"\u002Fen\u002Fblog\u002Fhow-to-read-penetration-test-report","How to Read a Penetration Test Report (Without Being Technical)","How to read a penetration test report: the executive summary, CVSS severity, attack chains, and how to turn findings into an action plan your team will follow.",[255,297,298,299],"report","cvss","governance",{"path":301,"title":302,"description":303,"category":62,"minutes":23,"date":51,"tags":304},"\u002Fen\u002Fblog\u002Fsecure-business-social-media-accounts","How to Secure Your Business Social Media Accounts","Hijacked Facebook page, an ex-employee still on LinkedIn, an agency with too much access: how to secure your small business's social media accounts.",[305,148,225,67],"social media",{"path":307,"title":308,"description":309,"category":62,"minutes":27,"date":51,"tags":310},"\u002Fen\u002Fblog\u002Fsecure-business-wordpress-site","How to Secure Your Business WordPress Site: The Checklist","Plugin updates, two-factor authentication, a web application firewall, tested backups: a practical checklist to secure your small business WordPress site.",[311,312,313,76],"wordpress","website","patching",{"path":315,"title":316,"description":317,"category":62,"minutes":27,"date":51,"tags":318},"\u002Fen\u002Fblog\u002Fhow-to-spot-phishing-email-examples","How to Spot a Phishing Email: 5 Canadian Examples Decoded","Fake CRA e-Transfers, Canada Post parcel fees, Hydro-Québec refunds: five phishing examples broken down, plus the warning signs to check before you click.",[65,85,84,76],{"path":320,"title":321,"description":322,"category":50,"minutes":23,"date":51,"tags":323},"\u002Fen\u002Fblog\u002Fiso-27001-vs-soc-2-smb","ISO 27001 vs SOC 2: Which One Should Your SMB Choose?","ISO 27001 vs SOC 2: certification versus attestation report, the real effort for an SMB, what buyers in Canada, the U.S. and Europe expect, and where to start.",[324,325,118,326,57],"iso-27001","soc-2","saas",{"path":328,"title":329,"description":330,"category":72,"minutes":23,"date":51,"tags":331},"\u002Fen\u002Fblog\u002Fincident-response-plan-template-small-business","Incident Response Plan Template for Small Businesses","An incident response plan template for small businesses: roles, response phases, a call tree and privacy obligations under Law 25 and PIPEDA, ready to use.",[332,75,333,57],"incident-response","privacy",{"path":335,"title":336,"description":337,"category":50,"minutes":23,"date":51,"tags":338},"\u002Fen\u002Fblog\u002Finformation-security-policy-template-small-business","Information Security Policy Template for Small Business","A 12-section information security policy template you can adapt, who should sign it, how it ties into Quebec's Law 25 and PIPEDA, and the mistakes to avoid.",[339,299,130,67],"security policy",{"path":341,"title":342,"description":343,"category":50,"minutes":23,"date":51,"tags":344},"\u002Fen\u002Fblog\u002Freport-confidentiality-incident-cai-law-25","Law 25 Breach Notification: Reporting an Incident to the CAI","When and how to report a confidentiality incident to Québec’s CAI under Law 25, minus the 72-hour myth: harm assessment, notice content and next steps.",[130,345,124,50],"cai",{"path":347,"title":348,"description":349,"category":50,"minutes":27,"date":51,"tags":350},"\u002Fen\u002Fblog\u002Flaw-25-privacy-policy-template","Law 25 Privacy Policy: Required Content and a Template","Quebec Law 25 privacy policy: who must publish one, what it must contain under ss. 8, 8.1 and 8.2, a template outline to adapt, and the mistakes to avoid.",[130,351,50,312],"privacy policy",{"path":353,"title":354,"description":355,"category":137,"minutes":23,"date":51,"tags":356},"\u002Fen\u002Fblog\u002Fmanufacturing-ot-cybersecurity","Manufacturing OT Cybersecurity: A Practical IEC 62443 Plan","Purdue model, IEC 62443 zones and conduits, integrator remote access: a realistic manufacturing OT cybersecurity plan for small and mid-sized plants.",[357,358,359,360],"manufacturing","ot","iec 62443","industrial control systems",{"path":362,"title":363,"description":364,"category":72,"minutes":23,"date":51,"tags":365},"\u002Fen\u002Fblog\u002Fmicrosoft-365-security-audit","Microsoft 365 Security Audit: 15 Settings to Check","A Microsoft 365 security audit checklist: 15 settings to verify (MFA, admin roles, forwarding, external sharing, audit logs) to stop phishing and payment fraud.",[241,72,85,243],{"path":367,"title":368,"description":369,"category":62,"minutes":23,"date":51,"tags":370},"\u002Fen\u002Fblog\u002Fmicrosoft-copilot-oversharing-security","Microsoft Copilot Oversharing: What to Fix Before You Deploy","Copilot respects your permissions, even overly broad ones. SharePoint reports, Restricted Content Discovery, sensitivity labels, Law 25: 8 steps before rollout.",[371,241,372,130,262],"copilot","sharepoint",{"path":374,"title":375,"description":376,"category":50,"minutes":23,"date":51,"tags":377},"\u002Fen\u002Fblog\u002Fnist-csf-2-small-business","NIST CSF 2.0 for Small Business: The Six Functions Explained","NIST CSF 2.0 explained for Canadian small businesses: the six functions including Govern, the NIST quick-start guide and how to build a target profile.",[378,299,379,76],"nist csf","security framework",{"path":381,"title":382,"description":383,"category":137,"minutes":23,"date":51,"tags":384},"\u002Fen\u002Fblog\u002Fcybersecurity-nonprofits-quebec","Nonprofit Cybersecurity in Quebec: Small Budgets, Real Risks","Volunteers, shared accounts, online donations and Law 25: the cybersecurity priorities for a Quebec nonprofit, with a checklist built for tight budgets.",[385,386,387,130],"nonprofits","volunteers","online donations",{"path":389,"title":390,"description":391,"category":50,"minutes":27,"date":51,"tags":392},"\u002Fen\u002Fblog\u002Fpci-dss-4-small-business","PCI DSS 4.0.1 for Small Businesses That Accept Cards","PCI DSS 4.0.1 for Canadian small businesses: which SAQ to fill out, what became mandatory on March 31, 2025, and how to shrink your compliance scope.",[393,394,395,50],"pci dss","payments","retail",{"path":397,"title":398,"description":399,"category":62,"minutes":23,"date":51,"tags":400},"\u002Fen\u002Fblog\u002Fpasskeys-for-business","Passkeys for Business: A Practical Deployment Guide","Microsoft 365 or Google Workspace: how to roll out passkeys in your small business step by step, from pilot group to recovery, without locking anyone out.",[401,148,241,402,65],"passkeys","google workspace",{"path":404,"title":405,"description":406,"category":62,"minutes":23,"date":51,"tags":407},"\u002Fen\u002Fblog\u002Fpatch-management-policy-small-business","Patch Management Policy for Small Businesses: SLAs That Work","Patch deadlines by severity, how to prioritize exploited flaws, handling exceptions and tracking results: a practical patch management policy for SMBs.",[313,408,67,409],"vulnerabilities","updates",{"path":411,"title":412,"description":413,"category":72,"minutes":23,"date":51,"tags":414},"\u002Fen\u002Fblog\u002Fpenetration-test-authorization-letter","Penetration Test Authorization Letter: What It Must Include","Criminal Code, scope, dates, permitted techniques, emergency contacts, data, cloud rules: what a penetration test authorization letter must include in Canada.",[275,415,416,417],"authorization","criminal code","rules of engagement",{"path":419,"title":420,"description":421,"category":72,"minutes":23,"date":51,"tags":422},"\u002Fen\u002Fblog\u002Fpenetration-testing-cost-quebec","Penetration Testing Cost in Canada: A Plain-English Guide","What a penetration test is, the main types, indicative Canadian price ranges and the red flags to watch for when comparing pentest quotes for your business.",[255,423,76],"pricing",{"path":425,"title":426,"description":427,"category":72,"minutes":23,"date":51,"tags":428},"\u002Fen\u002Fblog\u002Fphishing-simulation-employees","Phishing Simulation for Employees: Train Without Trapping","Phishing simulation for employees: plan a campaign, pick realistic scenarios, track the report rate and train staff without shaming them. A practical SMB guide.",[65,429,430,57],"awareness","employees",{"path":432,"title":433,"description":434,"category":62,"minutes":23,"date":51,"tags":435},"\u002Fen\u002Fblog\u002Fmulti-factor-authentication-choosing-mfa","Phishing-Resistant MFA: Why SMS Codes Are No Longer Enough","Text codes, push prompts, FIDO2 keys or passkeys? Compare multi-factor authentication methods and choose phishing-resistant MFA that attackers can't relay.",[148,284,65,401],{"path":437,"title":438,"description":439,"category":50,"minutes":23,"date":51,"tags":440},"\u002Fen\u002Fblog\u002Fprivacy-impact-assessment-pia-quebec-security","Privacy Impact Assessment in Québec: Adding the Security Lens","Privacy impact assessments under Québec’s Law 25: when a PIA is mandatory, how to build security into it and how to score risks, with an SMB example.",[130,441,442,243],"pia","risk management",{"path":444,"title":445,"description":446,"category":62,"minutes":23,"date":51,"tags":447},"\u002Fen\u002Fblog\u002Fqr-code-phishing-quishing","QR Code Phishing (Quishing): How to Spot It and Stay Safe","Fake QR codes on parking machines, emails that say 'scan to reactivate your MFA': how to recognize quishing and protect your small business and your staff.",[65,448,449,450,148],"qr code","quishing","security awareness",{"path":452,"title":453,"description":454,"category":50,"minutes":27,"date":51,"tags":455},"\u002Fen\u002Fblog\u002Fquebec-law-25-cybersecurity-checklist","Quebec Law 25 Compliance Checklist: The Cybersecurity Side","A practical Quebec Law 25 compliance checklist for SMBs: governance, access control, technical safeguards, incident handling and vendors, mapped to the Act.",[130,50,456,67],"checklist",{"path":458,"title":459,"description":460,"category":50,"minutes":27,"date":51,"tags":461},"\u002Fen\u002Fblog\u002Fquebec-law-25-fines-penalties","Quebec Law 25 Fines and Penalties: How the CAI Enforces It","Quebec Law 25 fines: up to $10M in administrative penalties and $25M in penal fines. How the CAI sets amounts, its other powers and how to reduce your risk.",[130,345,462,50],"penalties",{"path":464,"title":465,"description":466,"category":50,"minutes":27,"date":51,"tags":467},"\u002Fen\u002Fblog\u002Fquebec-law-25-cookies-consent-website","Quebec Law 25 and Cookies: What Your Website Must Do","Quebec Law 25 cookie rules explained: what section 8.1 and the CAI require, which cookies must be off by default, and how to set up a fair consent banner.",[130,468,469,312],"cookies","consent",{"path":471,"title":472,"description":473,"category":50,"minutes":23,"date":51,"tags":474},"\u002Fen\u002Fblog\u002Fquebec-law-25-small-business-where-to-start","Quebec Law 25 for Small Business: Where to Start (30-Day Plan)","Quebec Law 25 for small business: a 30-day plan to name your privacy officer, prepare for incidents, fix your website and adopt your governance policies.",[130,67,50,475],"action plan",{"path":477,"title":478,"description":479,"category":50,"minutes":23,"date":51,"tags":480},"\u002Fen\u002Fblog\u002Fprivacy-officer-quebec-security-role","Québec Privacy Officer Under Law 25: The Security Role","The privacy officer role under Québec’s Law 25, from a security angle: default holder, written delegation, security duties, a quarterly dashboard and template.",[130,299,481,67],"privacy officer",{"path":483,"title":484,"description":485,"category":62,"minutes":27,"date":51,"tags":486},"\u002Fen\u002Fblog\u002Fransomware-small-business-attack-anatomy","Ransomware Attack on a Small Business: Anatomy, Step by Step","From a forgotten VPN account to Friday-night encryption: how a ransomware attack on a small business really unfolds, and where to stop it at each stage.",[75,76,124,149],{"path":488,"title":489,"description":490,"category":62,"minutes":23,"date":51,"tags":491},"\u002Fen\u002Fblog\u002Fransomware-first-24-hours","Ransomware: What to Do in the First 24 Hours, Hour by Hour","Hit by ransomware? What to do in the first 24 hours: isolate, call your insurer, preserve evidence and notify the right people, in the right order.",[75,124,130,76],{"path":493,"title":494,"description":495,"category":62,"minutes":23,"date":51,"tags":496},"\u002Fen\u002Fblog\u002Fremote-work-security-business","Remote Work Security for Businesses: A Practical Guide","Devices, remote access, home Wi-Fi, fraud and Quebec's Law 25: the concrete steps that keep remote work security tight in a hybrid small business.",[497,67,284,130],"remote work",{"path":499,"title":500,"description":501,"category":137,"minutes":27,"date":51,"tags":502},"\u002Fen\u002Fblog\u002Fretail-ecommerce-cybersecurity","Retail and E-commerce Cybersecurity: Securing Store and Site","Payment terminals, online stores, PCI DSS 4.0.1, gift card fraud and customer data: a practical retail cybersecurity plan for Canadian small businesses.",[395,503,393,394,67],"e-commerce",{"path":505,"title":506,"description":507,"category":62,"minutes":23,"date":51,"tags":508},"\u002Fen\u002Fblog\u002Fspf-dkim-dmarc-explained","SPF, DKIM and DMARC Explained for Small Businesses","SPF, DKIM and DMARC explained in plain English, with real DNS record examples, the Gmail, Yahoo and Outlook sender rules, and a rollout plan for your domain.",[509,85,510,511],"dmarc","dns","spoofing",{"path":513,"title":514,"description":515,"category":72,"minutes":23,"date":51,"tags":516},"\u002Fen\u002Fblog\u002Fsecurity-audit-vs-pentest-vs-vulnerability-scan","Security Audit vs Pentest vs Vulnerability Scan: Which One?","Security audit, penetration test or vulnerability scan? The real differences, what each one delivers and the order that makes sense for a growing business.",[72,255,517,76],"vulnerability scan",{"path":519,"title":520,"description":521,"category":72,"minutes":27,"date":51,"tags":522},"\u002Fen\u002Fblog\u002Fcybersecurity-audit-small-business-quebec","Small Business Cybersecurity Audit: Steps, Timeline and Cost","What a cybersecurity audit for a Quebec small business involves: the five steps, a realistic timeline, what drives the cost and how to prepare for it.",[72,76,299],{"path":524,"title":525,"description":526,"category":72,"minutes":23,"date":51,"tags":527},"\u002Fen\u002Fblog\u002Fsmall-business-cybersecurity-budget","Small Business Cybersecurity Budget: What to Fund First","How much should a small business spend on cybersecurity? A tiered method to build a realistic budget, prioritize spending and get buy-in from leadership.",[528,76,299,77],"budget",{"path":530,"title":531,"description":532,"category":72,"minutes":27,"date":51,"tags":533},"\u002Fen\u002Fblog\u002Ftabletop-exercise-small-business","Tabletop Exercise for Small Business: A Ready-to-Run Script","A ready-to-run ransomware tabletop exercise for your small business: roles, a two-hour agenda, timed injects, questions to ask and the after-action report.",[534,124,75,535,76],"tabletop exercise","crisis management",{"path":537,"title":538,"description":539,"category":62,"minutes":23,"date":51,"tags":540},"\u002Fen\u002Fblog\u002F3-2-1-1-0-backup-rule-ransomware","The 3-2-1-1-0 Backup Rule: Backups That Survive Ransomware","Three copies, two media, one offsite, one immutable, zero errors: the 3-2-1-1-0 backup rule explained for small businesses that need to survive ransomware.",[149,75,74,76],{"path":542,"title":543,"description":544,"category":62,"minutes":23,"date":51,"tags":545},"\u002Fen\u002Fblog\u002Fvendor-banking-change-fraud","Vendor Banking Change Fraud: How It Works and How to Stop It","A supplier emails new banking details? What to do if the payment already went out, how vendor banking change fraud works and the simple process that stops it.",[84,235,85,76],{"path":547,"title":548,"description":549,"category":72,"minutes":23,"date":51,"tags":550},"\u002Fen\u002Fblog\u002Fweb-application-penetration-test-owasp-top-10","Web Application Penetration Test and the OWASP Top 10 (2025)","Web application penetration testing explained: the OWASP Top 10 2025 in plain English, how a test runs and how to prepare your customer portal or online store.",[255,551,552,76],"owasp","web application",{"path":554,"title":555,"description":556,"category":62,"minutes":23,"date":51,"tags":557},"\u002Fen\u002Fblog\u002Fwindows-10-end-of-support-business","Windows 10 End of Support: What Businesses Should Do in 2026","Windows 10 support ended on October 14, 2025. Extended Security Updates, real costs and the move to Windows 11: a practical 2026 plan for small businesses.",[558,313,559,67],"windows","end of life",{"path":561,"title":562,"description":563,"category":62,"minutes":23,"date":51,"tags":564},"\u002Fen\u002Fblog\u002Fzero-trust-small-business-explained","Zero Trust for Small Business, Explained Without the Jargon","What zero trust really means for a small business: the NIST and Cyber Centre principles in plain English, plus a five-step roadmap you can start this quarter.",[565,67,284,566,497],"zero trust","conditional access",1792970120749]