Blog
Compliance
Law 25, the CAI, cyber insurance, CPCSC, C-8, ISO 27001, PCI DSS: what these obligations concretely require from a small business, on the security side. Always validate with your legal counsel.
Bill C-8 and the CCSPA: What It Means for Canadian Suppliers
Bill C-8 is law, and the CCSPA will push cyber security obligations down the supply chain. What telecom, bank and transport suppliers should prepare now.
6 min read
CPCSC Certification: A Practical Guide for Defence Suppliers
CPCSC certification explained: the 3 levels, the 13 Level 1 controls and a practical plan for Montréal aerospace suppliers bidding on Canadian defence work.
5 min read
Confidentiality Incident Register: A Law 25 Template
The confidentiality incident register Québec’s Law 25 requires: the 8 mandatory fields, a copy-ready template, filled-in examples and retention rules.
5 min read
Cyber Insurance Questionnaire: How to Answer It Right
Cyber insurance questionnaire: the controls insurers check (MFA, EDR, backups), the traps that put coverage at risk and the evidence to gather before you sign.
5 min read
CyberSecure Canada Certification: Is It Worth It for an SMB?
CyberSecure Canada certification explained: what the CAN/DGSI 104 standard requires, how the audit works, its limits, and which businesses actually benefit.
5 min read
Cyberattack: Who to Notify in Canada, and in What Order
Hit by a cyberattack? Who to notify in Canada (insurer, bank, police, CAI, OPC, clients, Cyber Centre), in what order and under which law, step by step.
5 min read
Cybersecurity Statistics for Quebec and Canada (2026)
Cyberattacks on small businesses, costs, privacy incidents reported to the CAI, fraud losses, recovery times: verified, sourced figures for Quebec and Canada.
7 min read
How to Evaluate Your IT Provider's Security: 12 Questions
Your managed IT provider holds the keys to your business. Here are 12 questions to ask, what a good answer looks like, and what to put in the contract.
5 min read
ISO 27001 vs SOC 2: Which One Should Your SMB Choose?
ISO 27001 vs SOC 2: certification versus attestation report, the real effort for an SMB, what buyers in Canada, the U.S. and Europe expect, and where to start.
5 min read
Information Security Policy Template for Small Business
A 12-section information security policy template you can adapt, who should sign it, how it ties into Quebec's Law 25 and PIPEDA, and the mistakes to avoid.
5 min read
Law 25 Breach Notification: Reporting an Incident to the CAI
When and how to report a confidentiality incident to Québec’s CAI under Law 25, minus the 72-hour myth: harm assessment, notice content and next steps.
5 min read
Law 25 Privacy Policy: Required Content and a Template
Quebec Law 25 privacy policy: who must publish one, what it must contain under ss. 8, 8.1 and 8.2, a template outline to adapt, and the mistakes to avoid.
6 min read
NIST CSF 2.0 for Small Business: The Six Functions Explained
NIST CSF 2.0 explained for Canadian small businesses: the six functions including Govern, the NIST quick-start guide and how to build a target profile.
5 min read
PCI DSS 4.0.1 for Small Businesses That Accept Cards
PCI DSS 4.0.1 for Canadian small businesses: which SAQ to fill out, what became mandatory on March 31, 2025, and how to shrink your compliance scope.
6 min read
Privacy Impact Assessment in Québec: Adding the Security Lens
Privacy impact assessments under Québec’s Law 25: when a PIA is mandatory, how to build security into it and how to score risks, with an SMB example.
5 min read
Quebec Law 25 Compliance Checklist: The Cybersecurity Side
A practical Quebec Law 25 compliance checklist for SMBs: governance, access control, technical safeguards, incident handling and vendors, mapped to the Act.
6 min read
Quebec Law 25 Fines and Penalties: How the CAI Enforces It
Quebec Law 25 fines: up to $10M in administrative penalties and $25M in penal fines. How the CAI sets amounts, its other powers and how to reduce your risk.
6 min read
Quebec Law 25 and Cookies: What Your Website Must Do
Quebec Law 25 cookie rules explained: what section 8.1 and the CAI require, which cookies must be off by default, and how to set up a fair consent banner.
6 min read
Quebec Law 25 for Small Business: Where to Start (30-Day Plan)
Quebec Law 25 for small business: a 30-day plan to name your privacy officer, prepare for incidents, fix your website and adopt your governance policies.
5 min read
Québec Privacy Officer Under Law 25: The Security Role
The privacy officer role under Québec’s Law 25, from a security angle: default holder, written delegation, security duties, a quarterly dashboard and template.
5 min read