[{"data":1,"prerenderedAt":1094},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"services-en":45},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",[46,303,464,621,768,941],{"id":47,"title":48,"body":49,"deliverables":251,"description":258,"extension":259,"faq":260,"icon":273,"idealFor":274,"meta":279,"navTitle":6,"navigation":280,"order":7,"path":5,"price":281,"process":282,"rawbody":298,"seo":299,"stem":300,"tagline":301,"translationKey":273,"__hash__":302},"services_en\u002Fen\u002Fservices\u002Fcybersecurity-audit.md","Cybersecurity Audit for SMBs in Montréal and Québec",{"type":50,"value":51,"toc":244},"minimark",[52,56,59,64,140,143,152,156,159,188,196,200,203,206,225,229,241],[53,54,55],"p",{},"You know cybersecurity matters, but you are not sure where your business actually stands. Do your backups really work? Does the employee who left last fall still have access to anything? Would your insurer take your answers at face value? A cybersecurity audit answers these questions with facts instead of guesswork.",[53,57,58],{},"Our team looks at both the organization (who decides, who is accountable, what rules exist) and the technology (configurations, accounts, devices, network). The result is a clear picture of what is working, what needs fixing, and in what order.",[60,61,63],"h2",{"id":62},"what-we-review","What we review",[65,66,67,80],"table",{},[68,69,70],"thead",{},[71,72,73,77],"tr",{},[74,75,76],"th",{},"Area",[74,78,79],{},"What we look at",[81,82,83,92,100,108,116,124,132],"tbody",{},[71,84,85,89],{},[86,87,88],"td",{},"Governance",[86,90,91],{},"Roles and responsibilities, existing policies, asset inventory, oversight of IT vendors",[71,93,94,97],{},[86,95,96],{},"Accounts and access",[86,98,99],{},"Multi-factor authentication, admin accounts, employee offboarding, shared passwords",[71,101,102,105],{},[86,103,104],{},"Email security",[86,106,107],{},"SPF, DKIM and DMARC, anti-phishing filtering, suspicious forwarding rules",[71,109,110,113],{},[86,111,112],{},"Backups",[86,114,115],{},"Actual coverage, offline or immutable copy, real restore tests",[71,117,118,121],{},[86,119,120],{},"Endpoints",[86,122,123],{},"Patching, antivirus or EDR, disk encryption, personal devices",[71,125,126,129],{},[86,127,128],{},"Network perimeter",[86,130,131],{},"Firewall, remote access (VPN), internet-facing services, guest Wi-Fi",[71,133,134,137],{},[86,135,136],{},"Law 25",[86,138,139],{},"Safeguards for personal information, incident register, incident procedure",[53,141,142],{},"Each area is assessed against recognized best practices, such as the baseline controls recommended by the Canadian Centre for Cyber Security, then scaled to the real size of your business. We won't recommend an enterprise-grade solution for a 15-person office in Laval.",[53,144,145,146,151],{},"For a closer look at how an engagement unfolds, read our guide to ",[147,148,150],"a",{"href":149},"\u002Fen\u002Fblog\u002Fcybersecurity-audit-small-business-quebec","cybersecurity audits for small businesses",".",[60,153,155],{"id":154},"the-report-you-receive","The report you receive",[53,157,158],{},"A good report is one that actually gets read. Ours is written in plain English (or French, if your team prefers) and speaks to leadership first.",[160,161,162,170,176,182],"ul",{},[163,164,165,169],"li",{},[166,167,168],"strong",{},"An executive summary",": your overall risk level and your top three to five priorities, in business terms.",[163,171,172,175],{},[166,173,174],{},"Ranked findings",": for each one, the concrete risk (\"a fraudster could pose as your accounts payable team\"), the evidence we observed and the recommended fix.",[163,177,178,181],{},[166,179,180],{},"A roadmap",": quick wins for this month, medium-term projects, and items to plan for in next year's budget.",[163,183,184,187],{},[166,185,186],{},"A technical appendix",": the details your IT provider needs to get to work.",[189,190,193],"callout",{"title":191,"type":192},"A fixed-price quote, before we start","info",[53,194,195],{},"After the scoping call, you receive a fixed-price quote that spells out the scope, timeline and deliverables. No open-ended hourly billing, no surprises at the end.",[60,197,199],{"id":198},"why-small-businesses-need-one","Why small businesses need one",[53,201,202],{},"According to a 2025 study by insurer Coalition, 77% of Canadian small businesses believe they are too small to be targeted, yet 86% had experienced a cybersecurity event in the last five years. Attackers don't pick victims by size; they look for open doors.",[53,204,205],{},"An audit also helps on three practical fronts:",[160,207,208,214,219],{},[163,209,210,213],{},[166,211,212],{},"Cyber insurance",": insurers are asking increasingly specific questions about multi-factor authentication, backups and patching. Better to know your answers before you sign.",[163,215,216,218],{},[166,217,136],{},": Quebec's privacy law requires reasonable security measures to protect personal information. The audit documents where you stand.",[163,220,221,224],{},[166,222,223],{},"Your clients",": more and more large customers ask their suppliers for evidence of good security practices.",[60,226,228],{"id":227},"audit-pentest-or-scan-which-one","Audit, pentest or scan: which one?",[53,230,231,232,235,236,240],{},"An audit gives you the big picture, covering people and processes as well as technology. A ",[147,233,234],{"href":9},"penetration test"," simulates a real attack against a specific target. For most small businesses, the audit is the right starting point; a pentest then validates the most critical systems. Our article on ",[147,237,239],{"href":238},"\u002Fen\u002Fblog\u002Fsecurity-audit-vs-pentest-vs-vulnerability-scan","security audits vs. pentests vs. vulnerability scans"," breaks down the differences.",[53,242,243],{},"We work remotely or on site anywhere in Quebec, from Montréal to the Eastern Townships and beyond. And if you'd rather ease into it, the free quick audit gives you a first look at your internet exposure, with no commitment.",{"title":245,"searchDepth":11,"depth":15,"links":246},"",[247,248,249,250],{"id":62,"depth":11,"text":63},{"id":154,"depth":11,"text":155},{"id":198,"depth":11,"text":199},{"id":227,"depth":11,"text":228},[252,253,254,255,256,257],"A plain-language audit report, with an executive summary written for leadership","Findings ranked by business risk and by the effort needed to fix them","A prioritized roadmap: quick wins, medium-term projects and items to budget for","An overview of your security safeguards against Quebec Law 25 requirements","A list of the items that weigh most on a cyber insurance questionnaire","A results walkthrough with your team and your IT provider","A cybersecurity audit built for Quebec SMBs: accounts, email, backups, network and Law 25 safeguards, with a plain-language report and a prioritized plan.","md",[261,264,267,270],{"q":262,"a":263},"How long does a cybersecurity audit take?","It depends on the number of employees, locations and systems. For a typical small business, expect a few weeks between the scoping call and the report walkthrough. The exact timeline is set out in the quote.",{"q":265,"a":266},"Will the audit disrupt our staff or operations?","Very little. Technical checks are mostly read-only, and interviews are short and scheduled in advance. We work around your calendar, not the other way around.",{"q":268,"a":269},"How is this different from the free quick audit?","The quick audit is a passive, automated scan of what is visible from the internet, paired with a maturity quiz. The full audit goes much further: interviews, a review of your internal configurations, backups and workstations, and a detailed action plan.",{"q":271,"a":272},"Do we need to give you access to our systems?","Yes, for the technical portion, usually through a read-only account or with your IT contact present. Access is removed at the end of the engagement and your information is handled confidentially.","audit",[275,276,277,278],"A small business that has never had its security assessed and doesn't know where to start","A company filling out or renewing a cyber insurance questionnaire","Leadership that wants to know whether current safeguards hold up under Law 25","A supplier whose client is asking for proof of sound security practices",{},true,"diagnostic",[283,286,289,292,295],{"title":284,"text":285},"Scoping","A call to understand your business, your systems and your obligations. You then receive a fixed-price quote before committing to anything.",{"title":287,"text":288},"Information gathering","Interviews with leadership and whoever handles IT, a review of your documentation and technical checks, remotely or on site.",{"title":290,"text":291},"Analysis","We compare what we observe with recognized best practices and rank each finding by the real risk it poses to your business.",{"title":293,"text":294},"Report and walkthrough","We deliver the report and walk you through it, so every recommendation is understood and actionable.",{"title":296,"text":297},"Follow-up","You fix things with your own team, your IT provider or with us. We stay available to answer your questions.","---\ntitle: \"Cybersecurity Audit for SMBs in Montréal and Québec\"\nnavTitle: \"Cybersecurity Audit\"\ndescription: \"A cybersecurity audit built for Quebec SMBs: accounts, email, backups, network and Law 25 safeguards, with a plain-language report and a prioritized plan.\"\ntranslationKey: audit\norder: 1\nicon: audit\nprice: diagnostic\ntagline: \"Find out where your business really stands, and get a clear, prioritized plan to fix what matters most.\"\ndeliverables:\n  - \"A plain-language audit report, with an executive summary written for leadership\"\n  - \"Findings ranked by business risk and by the effort needed to fix them\"\n  - \"A prioritized roadmap: quick wins, medium-term projects and items to budget for\"\n  - \"An overview of your security safeguards against Quebec Law 25 requirements\"\n  - \"A list of the items that weigh most on a cyber insurance questionnaire\"\n  - \"A results walkthrough with your team and your IT provider\"\nprocess:\n  - title: \"Scoping\"\n    text: \"A call to understand your business, your systems and your obligations. You then receive a fixed-price quote before committing to anything.\"\n  - title: \"Information gathering\"\n    text: \"Interviews with leadership and whoever handles IT, a review of your documentation and technical checks, remotely or on site.\"\n  - title: \"Analysis\"\n    text: \"We compare what we observe with recognized best practices and rank each finding by the real risk it poses to your business.\"\n  - title: \"Report and walkthrough\"\n    text: \"We deliver the report and walk you through it, so every recommendation is understood and actionable.\"\n  - title: \"Follow-up\"\n    text: \"You fix things with your own team, your IT provider or with us. We stay available to answer your questions.\"\nidealFor:\n  - \"A small business that has never had its security assessed and doesn't know where to start\"\n  - \"A company filling out or renewing a cyber insurance questionnaire\"\n  - \"Leadership that wants to know whether current safeguards hold up under Law 25\"\n  - \"A supplier whose client is asking for proof of sound security practices\"\nfaq:\n  - q: \"How long does a cybersecurity audit take?\"\n    a: \"It depends on the number of employees, locations and systems. For a typical small business, expect a few weeks between the scoping call and the report walkthrough. The exact timeline is set out in the quote.\"\n  - q: \"Will the audit disrupt our staff or operations?\"\n    a: \"Very little. Technical checks are mostly read-only, and interviews are short and scheduled in advance. We work around your calendar, not the other way around.\"\n  - q: \"How is this different from the free quick audit?\"\n    a: \"The quick audit is a passive, automated scan of what is visible from the internet, paired with a maturity quiz. The full audit goes much further: interviews, a review of your internal configurations, backups and workstations, and a detailed action plan.\"\n  - q: \"Do we need to give you access to our systems?\"\n    a: \"Yes, for the technical portion, usually through a read-only account or with your IT contact present. Access is removed at the end of the engagement and your information is handled confidentially.\"\n---\n\nYou know cybersecurity matters, but you are not sure where your business actually stands. Do your backups really work? Does the employee who left last fall still have access to anything? Would your insurer take your answers at face value? A cybersecurity audit answers these questions with facts instead of guesswork.\n\nOur team looks at both the organization (who decides, who is accountable, what rules exist) and the technology (configurations, accounts, devices, network). The result is a clear picture of what is working, what needs fixing, and in what order.\n\n## What we review\n\n| Area | What we look at |\n|---|---|\n| Governance | Roles and responsibilities, existing policies, asset inventory, oversight of IT vendors |\n| Accounts and access | Multi-factor authentication, admin accounts, employee offboarding, shared passwords |\n| Email security | SPF, DKIM and DMARC, anti-phishing filtering, suspicious forwarding rules |\n| Backups | Actual coverage, offline or immutable copy, real restore tests |\n| Endpoints | Patching, antivirus or EDR, disk encryption, personal devices |\n| Network perimeter | Firewall, remote access (VPN), internet-facing services, guest Wi-Fi |\n| Law 25 | Safeguards for personal information, incident register, incident procedure |\n\nEach area is assessed against recognized best practices, such as the baseline controls recommended by the Canadian Centre for Cyber Security, then scaled to the real size of your business. We won't recommend an enterprise-grade solution for a 15-person office in Laval.\n\nFor a closer look at how an engagement unfolds, read our guide to [cybersecurity audits for small businesses](\u002Fen\u002Fblog\u002Fcybersecurity-audit-small-business-quebec).\n\n## The report you receive\n\nA good report is one that actually gets read. Ours is written in plain English (or French, if your team prefers) and speaks to leadership first.\n\n- **An executive summary**: your overall risk level and your top three to five priorities, in business terms.\n- **Ranked findings**: for each one, the concrete risk (\"a fraudster could pose as your accounts payable team\"), the evidence we observed and the recommended fix.\n- **A roadmap**: quick wins for this month, medium-term projects, and items to plan for in next year's budget.\n- **A technical appendix**: the details your IT provider needs to get to work.\n\n::callout{type=\"info\" title=\"A fixed-price quote, before we start\"}\nAfter the scoping call, you receive a fixed-price quote that spells out the scope, timeline and deliverables. No open-ended hourly billing, no surprises at the end.\n::\n\n## Why small businesses need one\n\nAccording to a 2025 study by insurer Coalition, 77% of Canadian small businesses believe they are too small to be targeted, yet 86% had experienced a cybersecurity event in the last five years. Attackers don't pick victims by size; they look for open doors.\n\nAn audit also helps on three practical fronts:\n\n- **Cyber insurance**: insurers are asking increasingly specific questions about multi-factor authentication, backups and patching. Better to know your answers before you sign.\n- **Law 25**: Quebec's privacy law requires reasonable security measures to protect personal information. The audit documents where you stand.\n- **Your clients**: more and more large customers ask their suppliers for evidence of good security practices.\n\n## Audit, pentest or scan: which one?\n\nAn audit gives you the big picture, covering people and processes as well as technology. A [penetration test](\u002Fen\u002Fservices\u002Fpenetration-testing) simulates a real attack against a specific target. For most small businesses, the audit is the right starting point; a pentest then validates the most critical systems. Our article on [security audits vs. pentests vs. vulnerability scans](\u002Fen\u002Fblog\u002Fsecurity-audit-vs-pentest-vs-vulnerability-scan) breaks down the differences.\n\nWe work remotely or on site anywhere in Quebec, from Montréal to the Eastern Townships and beyond. And if you'd rather ease into it, the free quick audit gives you a first look at your internet exposure, with no commitment.\n",{"title":48,"description":258},"en\u002Fservices\u002Fcybersecurity-audit","Find out where your business really stands, and get a clear, prioritized plan to fix what matters most.","I5dK7bnyVLZV8KTBZpDRtQewLp-kTpUsJ2WPmBvgicI",{"id":304,"title":305,"body":306,"deliverables":416,"description":423,"extension":259,"faq":424,"icon":437,"idealFor":438,"meta":443,"navTitle":10,"navigation":280,"order":11,"path":9,"price":437,"process":444,"rawbody":459,"seo":460,"stem":461,"tagline":462,"translationKey":437,"__hash__":463},"services_en\u002Fen\u002Fservices\u002Fpenetration-testing.md","Penetration Testing for SMBs in Montréal and Québec",{"type":50,"value":307,"toc":407},[308,311,314,318,323,326,330,333,341,345,352,356,363,366,383,386,390,393,400],[53,309,310],{},"A penetration test (or pentest) answers a simple question: if someone really wanted to get in, how far would they get? Our team thinks like an attacker and uses real techniques, within strict boundaries you approve in writing.",[53,312,313],{},"Unlike an automated tool, we exploit weaknesses manually, chain them together and measure their concrete impact: access to the CEO's mailbox, client files, the accounting system. You finally know what is serious and what can wait.",[60,315,317],{"id":316},"three-types-of-tests-depending-on-your-needs","Three types of tests, depending on your needs",[319,320,322],"h3",{"id":321},"external-penetration-test","External penetration test",[53,324,325],{},"We attack from the internet, just as anyone in the world could: your website, portals, email, remote access (VPN, Remote Desktop), firewall and forgotten services. This is the first surface an attacker explores.",[319,327,329],{"id":328},"internal-penetration-test","Internal penetration test",[53,331,332],{},"We start from a compromised workstation or a network jack in your office, the scenario where an employee clicked the wrong link. We then assess what an attacker could reach next: Active Directory, file servers, backups, privileged accounts. Testing is done on site anywhere in Quebec, or remotely through secure access set up with your IT team.",[53,334,335,336,340],{},"Not sure which one you need? Our article on ",[147,337,339],{"href":338},"\u002Fen\u002Fblog\u002Fexternal-vs-internal-penetration-test","external vs. internal penetration tests"," will help you decide.",[319,342,344],{"id":343},"web-application-test","Web application test",[53,346,347,348,151],{},"For your client portal, online store or line-of-business application. We follow OWASP methodology (the Top 10 and the Web Security Testing Guide): access control, authentication, session management, injection and business logic. Testing uses dedicated test accounts, ideally in a staging environment. For more detail, read our article on ",[147,349,351],{"href":350},"\u002Fen\u002Fblog\u002Fweb-application-penetration-test-owasp-top-10","web application pentesting and the OWASP Top 10",[60,353,355],{"id":354},"clear-rules-before-the-first-test","Clear rules before the first test",[189,357,360],{"title":358,"type":359},"No testing without written authorization","warning",[53,361,362],{},"In Canada, using a computer without authorization is an offence under the Criminal Code (s. 342.1). We never begin without an authorization signed by someone with the authority to grant it. If your systems are hosted by a third party, their consent may also be required.",[53,364,365],{},"Before we start, we draft the rules of engagement with you. This document sets out:",[160,367,368,371,374,377,380],{},[163,369,370],{},"the domains, IP addresses and applications in scope, and those excluded;",[163,372,373],{},"the testing dates and time windows;",[163,375,376],{},"permitted and prohibited techniques (for example, no denial of service);",[163,378,379],{},"emergency contacts on both sides;",[163,381,382],{},"how we protect any data we come across during the engagement.",[53,384,385],{},"Scope and price are locked in a quote before any work begins. No surprise overruns.",[60,387,389],{"id":388},"a-prioritized-readable-report","A prioritized, readable report",[53,391,392],{},"The report speaks to two audiences. Leadership gets a plain-language executive summary: the risk level, the attack scenarios we demonstrated and the priorities. The technical team gets, for each vulnerability, a description, a severity rating, the evidence (screenshots, requests), steps to reproduce it and the recommended fix.",[53,394,395,396,151],{},"Once your fixes are in place, we retest to confirm the gaps are closed, and you receive an attestation letter to share with clients or your insurer. To get the most out of the document, see our guide on ",[147,397,399],{"href":398},"\u002Fen\u002Fblog\u002Fhow-to-read-penetration-test-report","how to read a penetration test report",[53,401,402,403,406],{},"Not ready for a pentest yet? A ",[147,404,405],{"href":5},"cybersecurity audit"," is often the better first step: it lets you fix the obvious issues before paying someone to find them.",{"title":245,"searchDepth":11,"depth":15,"links":408},[409,414,415],{"id":316,"depth":11,"text":317,"children":410},[411,412,413],{"id":321,"depth":15,"text":322},{"id":328,"depth":15,"text":329},{"id":343,"depth":15,"text":344},{"id":354,"depth":11,"text":355},{"id":388,"depth":11,"text":389},[417,418,419,420,421,422],"Rules of engagement and a signed authorization letter before any testing begins","A report with an executive summary for leadership and reproducible technical details","Vulnerabilities ranked by severity, with proof of exploitation and a recommended fix","A results walkthrough with your team, your IT provider or your developers","A retest of the vulnerabilities you have fixed","An attestation letter you can share with clients or your insurer","External, internal and web application penetration testing (OWASP) with manual exploitation, a prioritized report and a retest once fixes are in place.",[425,428,431,434],{"q":426,"a":427},"Can a penetration test take our systems down?","The risk is low and controlled. Permitted techniques, testing windows and systems to avoid are agreed in advance. The most sensitive tests can be run outside business hours or against a staging environment.",{"q":429,"a":430},"How is a pentest different from a vulnerability scan?","An automated scan produces a list of potential weaknesses, with its share of false positives. A penetration test goes further: a human verifies each weakness, chains them together and shows what an attacker could actually obtain.",{"q":432,"a":433},"Should we tell our employees and our IT provider?","Your IT provider and, where applicable, your hosting provider need to know. Employees don't have to: keeping them unaware lets you see whether the attack gets noticed. We settle this with you during scoping.",{"q":435,"a":436},"How often should we run a penetration test?","Once a year is common practice, along with after any significant change: a new application, a migration, a new remote access service. Some contracts and insurers set their own frequency.","pentest",[439,440,441,442],"A company launching or rebuilding a web application or client portal","An SMB whose client, prime contractor or insurer is asking for a penetration test","An organization that has completed an audit and wants to validate its most critical systems","A business with remote access (VPN, Remote Desktop) exposed to the internet",{},[445,448,451,454,456],{"title":446,"text":447},"Scoping and authorization","Together we define the targets, the testing window and the limits. Nothing starts until your written authorization is signed.",{"title":449,"text":450},"Reconnaissance","We map what an attacker would see: exposed services, technologies in use, accounts and entry points.",{"title":452,"text":453},"Manual exploitation","We attempt to exploit the weaknesses we find, by hand, to measure their real impact without disrupting your operations.",{"title":293,"text":455},"You receive a prioritized report, and we review it with your team to plan the fixes.",{"title":457,"text":458},"Retest","Once fixes are applied, we test the vulnerabilities again to confirm they are properly closed.","---\ntitle: \"Penetration Testing for SMBs in Montréal and Québec\"\nnavTitle: \"Penetration Testing\"\ndescription: \"External, internal and web application penetration testing (OWASP) with manual exploitation, a prioritized report and a retest once fixes are in place.\"\ntranslationKey: pentest\norder: 2\nicon: pentest\nprice: pentest\ntagline: \"We attack your systems the way a real adversary would, with your written permission, so you can fix the gaps first.\"\ndeliverables:\n  - \"Rules of engagement and a signed authorization letter before any testing begins\"\n  - \"A report with an executive summary for leadership and reproducible technical details\"\n  - \"Vulnerabilities ranked by severity, with proof of exploitation and a recommended fix\"\n  - \"A results walkthrough with your team, your IT provider or your developers\"\n  - \"A retest of the vulnerabilities you have fixed\"\n  - \"An attestation letter you can share with clients or your insurer\"\nprocess:\n  - title: \"Scoping and authorization\"\n    text: \"Together we define the targets, the testing window and the limits. Nothing starts until your written authorization is signed.\"\n  - title: \"Reconnaissance\"\n    text: \"We map what an attacker would see: exposed services, technologies in use, accounts and entry points.\"\n  - title: \"Manual exploitation\"\n    text: \"We attempt to exploit the weaknesses we find, by hand, to measure their real impact without disrupting your operations.\"\n  - title: \"Report and walkthrough\"\n    text: \"You receive a prioritized report, and we review it with your team to plan the fixes.\"\n  - title: \"Retest\"\n    text: \"Once fixes are applied, we test the vulnerabilities again to confirm they are properly closed.\"\nidealFor:\n  - \"A company launching or rebuilding a web application or client portal\"\n  - \"An SMB whose client, prime contractor or insurer is asking for a penetration test\"\n  - \"An organization that has completed an audit and wants to validate its most critical systems\"\n  - \"A business with remote access (VPN, Remote Desktop) exposed to the internet\"\nfaq:\n  - q: \"Can a penetration test take our systems down?\"\n    a: \"The risk is low and controlled. Permitted techniques, testing windows and systems to avoid are agreed in advance. The most sensitive tests can be run outside business hours or against a staging environment.\"\n  - q: \"How is a pentest different from a vulnerability scan?\"\n    a: \"An automated scan produces a list of potential weaknesses, with its share of false positives. A penetration test goes further: a human verifies each weakness, chains them together and shows what an attacker could actually obtain.\"\n  - q: \"Should we tell our employees and our IT provider?\"\n    a: \"Your IT provider and, where applicable, your hosting provider need to know. Employees don't have to: keeping them unaware lets you see whether the attack gets noticed. We settle this with you during scoping.\"\n  - q: \"How often should we run a penetration test?\"\n    a: \"Once a year is common practice, along with after any significant change: a new application, a migration, a new remote access service. Some contracts and insurers set their own frequency.\"\n---\n\nA penetration test (or pentest) answers a simple question: if someone really wanted to get in, how far would they get? Our team thinks like an attacker and uses real techniques, within strict boundaries you approve in writing.\n\nUnlike an automated tool, we exploit weaknesses manually, chain them together and measure their concrete impact: access to the CEO's mailbox, client files, the accounting system. You finally know what is serious and what can wait.\n\n## Three types of tests, depending on your needs\n\n### External penetration test\n\nWe attack from the internet, just as anyone in the world could: your website, portals, email, remote access (VPN, Remote Desktop), firewall and forgotten services. This is the first surface an attacker explores.\n\n### Internal penetration test\n\nWe start from a compromised workstation or a network jack in your office, the scenario where an employee clicked the wrong link. We then assess what an attacker could reach next: Active Directory, file servers, backups, privileged accounts. Testing is done on site anywhere in Quebec, or remotely through secure access set up with your IT team.\n\nNot sure which one you need? Our article on [external vs. internal penetration tests](\u002Fen\u002Fblog\u002Fexternal-vs-internal-penetration-test) will help you decide.\n\n### Web application test\n\nFor your client portal, online store or line-of-business application. We follow OWASP methodology (the Top 10 and the Web Security Testing Guide): access control, authentication, session management, injection and business logic. Testing uses dedicated test accounts, ideally in a staging environment. For more detail, read our article on [web application pentesting and the OWASP Top 10](\u002Fen\u002Fblog\u002Fweb-application-penetration-test-owasp-top-10).\n\n## Clear rules before the first test\n\n::callout{type=\"warning\" title=\"No testing without written authorization\"}\nIn Canada, using a computer without authorization is an offence under the Criminal Code (s. 342.1). We never begin without an authorization signed by someone with the authority to grant it. If your systems are hosted by a third party, their consent may also be required.\n::\n\nBefore we start, we draft the rules of engagement with you. This document sets out:\n\n- the domains, IP addresses and applications in scope, and those excluded;\n- the testing dates and time windows;\n- permitted and prohibited techniques (for example, no denial of service);\n- emergency contacts on both sides;\n- how we protect any data we come across during the engagement.\n\nScope and price are locked in a quote before any work begins. No surprise overruns.\n\n## A prioritized, readable report\n\nThe report speaks to two audiences. Leadership gets a plain-language executive summary: the risk level, the attack scenarios we demonstrated and the priorities. The technical team gets, for each vulnerability, a description, a severity rating, the evidence (screenshots, requests), steps to reproduce it and the recommended fix.\n\nOnce your fixes are in place, we retest to confirm the gaps are closed, and you receive an attestation letter to share with clients or your insurer. To get the most out of the document, see our guide on [how to read a penetration test report](\u002Fen\u002Fblog\u002Fhow-to-read-penetration-test-report).\n\nNot ready for a pentest yet? A [cybersecurity audit](\u002Fen\u002Fservices\u002Fcybersecurity-audit) is often the better first step: it lets you fix the obvious issues before paying someone to find them.\n",{"title":305,"description":423},"en\u002Fservices\u002Fpenetration-testing","We attack your systems the way a real adversary would, with your written permission, so you can fix the gaps first.","jCFX_AkXqMnHRVdUbAU9RqIj4VFRUzHBA1kPJrR6f50",{"id":465,"title":466,"body":467,"deliverables":577,"description":584,"extension":259,"faq":585,"icon":595,"idealFor":596,"meta":601,"navTitle":14,"navigation":280,"order":15,"path":13,"price":595,"process":602,"rawbody":616,"seo":617,"stem":618,"tagline":619,"translationKey":595,"__hash__":620},"services_en\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit.md","Microsoft 365 and Google Workspace Security Audit",{"type":50,"value":468,"toc":567},[469,472,475,479,483,486,490,493,497,500,508,512,515,535,542,546,549,552,556,564],[53,470,471],{},"For most small businesses, Microsoft 365 or Google Workspace is the heart of the operation: email, documents, calendars, Teams or Meet. That also makes it a prime target for fraudsters. A single compromised account is enough to redirect a payment or phish your clients from a legitimate address.",[53,473,474],{},"Default settings aren't always the safest, and configurations drift over the years: former administrators, temporary exceptions that became permanent, forgotten sharing links. Our audit cleans things up without changing anything in your environment.",[60,476,478],{"id":477},"what-we-check-in-microsoft-365","What we check in Microsoft 365",[319,480,482],{"id":481},"identity-and-access-microsoft-entra-id","Identity and access (Microsoft Entra ID)",[53,484,485],{},"MFA on every account, starting with administrators; Conditional Access policies or security defaults; blocking legacy authentication, the older protocols that let attackers bypass MFA; the number of Global Administrators; user consent to third-party apps.",[319,487,489],{"id":488},"email-exchange-online-and-defender","Email (Exchange Online and Defender)",[53,491,492],{},"Mailbox auditing enabled; automatic forwarding rules to external addresses; anti-phishing policies, Safe Links and Safe Attachments in Defender for Office 365; SPF, DKIM and DMARC records.",[319,494,496],{"id":495},"sharing-and-logging","Sharing and logging",[53,498,499],{},"External sharing in SharePoint, OneDrive and Teams; \"Anyone\" links; guest access; the unified audit log and how long logs are retained.",[53,501,502,503,507],{},"Our ",[147,504,506],{"href":505},"\u002Fen\u002Fblog\u002Fmicrosoft-365-security-audit","Microsoft 365 security audit"," article walks through the most important settings.",[60,509,511],{"id":510},"and-in-google-workspace","And in Google Workspace",[53,513,514],{},"The logic is the same, with Google's tools:",[160,516,517,520,523,526,529,532],{},[163,518,519],{},"enforced 2-Step Verification, with security keys for super admins;",[163,521,522],{},"the number of super admin accounts and separation of admin accounts from daily use;",[163,524,525],{},"control over third-party apps that can access your data (API controls and OAuth);",[163,527,528],{},"Gmail safety settings: spoofing protection, attachments, SPF, DKIM and DMARC;",[163,530,531],{},"external sharing in Google Drive and shared drives;",[163,533,534],{},"audit logs and security alerts.",[53,536,537,538,151],{},"Learn more in our article on the ",[147,539,541],{"href":540},"\u002Fen\u002Fblog\u002Fgoogle-workspace-security-audit","Google Workspace security audit",[60,543,545],{"id":544},"a-read-only-audit","A read-only audit",[53,547,548],{},"We don't need the keys to the kingdom. In Microsoft 365, your administrator assigns us roles such as Global Reader and Security Reader; in Google Workspace, a custom admin role limited to viewing. The few checks that need more privileges are done alongside your administrator in a shared session.",[53,550,551],{},"The result: no risk of changing a setting by mistake, and you keep full control of your environment. The audit is done entirely remotely, whether your office is in downtown Montréal, Sherbrooke or anywhere else in Quebec.",[60,553,555],{"id":554},"why-its-a-priority-for-small-businesses","Why it's a priority for small businesses",[53,557,558,559,563],{},"Business email compromise is a serious threat for SMBs: a fraudster gets into a mailbox, quietly watches the conversations, then sends fake banking details at just the right moment. Our article on ",[147,560,562],{"href":561},"\u002Fen\u002Fblog\u002Fbusiness-email-compromise-ceo-fraud","business email compromise and CEO fraud"," describes how it plays out.",[53,565,566],{},"Cyber insurance questionnaires now routinely ask whether MFA is enforced on email and admin accounts. And your mailboxes hold personal information protected under Quebec's Law 25. A well-configured environment addresses all three concerns at once.",{"title":245,"searchDepth":11,"depth":15,"links":568},[569,574,575,576],{"id":477,"depth":11,"text":478,"children":570},[571,572,573],{"id":481,"depth":15,"text":482},{"id":488,"depth":15,"text":489},{"id":495,"depth":15,"text":496},{"id":510,"depth":11,"text":511},{"id":544,"depth":11,"text":545},{"id":554,"depth":11,"text":555},[578,579,580,581,582,583],"A full configuration review of your Microsoft 365 tenant or Google Workspace domain","A list of risky accounts: admins, accounts without MFA, inactive or shared accounts","Findings ranked by risk, with the exact location of each setting to change in the admin console","A check of your SPF, DKIM and DMARC records","A prioritized remediation plan, ready to hand to your IT provider","A results walkthrough and Q&A session with your team","Security audit for Microsoft 365 or Google Workspace: MFA, Conditional Access, sharing, email and logging. Read-only access and a prioritized, plain report.",[586,589,592],{"q":587,"a":588},"Do you read our email or documents during the audit?","No. We review settings, logs and account lists, not the contents of your mailboxes or files. The read-only roles we use don't grant access to email content in the first place. Access is removed at the end of the engagement.",{"q":590,"a":591},"Is our Microsoft 365 licence enough to be properly protected?","Several essential protections are available with every licence, such as security defaults, which enforce MFA. Others, like Conditional Access or Defender for Office 365, require higher-tier licences such as Business Premium. The report shows what you can do with your current licences and what an upgrade would add.",{"q":593,"a":594},"Don't Microsoft and Google already handle security?","They secure their infrastructure, but configuring your account is up to you: who can sign in, how, and what can be shared externally. This is the shared responsibility model, and your side of it is exactly what the audit checks.","cloud",[597,598,599,600],"A small business that has used Microsoft 365 or Google Workspace for years without a security review","A company that has dealt with a compromised email account or an attempted payment fraud","An organization that must prove to its insurer that MFA is enforced for everyone","A business whose environment was set up by a former provider or an employee who has since left",{},[603,605,608,610,613],{"title":284,"text":604},"We confirm your platform, licences and priorities. You then receive a fixed-price quote.",{"title":606,"text":607},"Read-only access","Your administrator grants us read-only access, which you can revoke at any time. We guide you through it step by step.",{"title":290,"text":609},"We review identity, email, sharing and logging settings, then go through your accounts one by one.",{"title":611,"text":612},"Report","You receive a prioritized report that sets out, for each finding, the concrete risk and the fix to apply.",{"title":614,"text":615},"Remediation (optional)","Your team applies the fixes, or we take care of them on a quoted basis.","---\ntitle: \"Microsoft 365 and Google Workspace Security Audit\"\nnavTitle: \"Microsoft 365 \u002F Google Workspace Audit\"\ndescription: \"Security audit for Microsoft 365 or Google Workspace: MFA, Conditional Access, sharing, email and logging. Read-only access and a prioritized, plain report.\"\ntranslationKey: cloud\norder: 3\nicon: cloud\nprice: cloud\ntagline: \"Your email and files live in the cloud. Let's make sure the right settings are actually protecting your business.\"\ndeliverables:\n  - \"A full configuration review of your Microsoft 365 tenant or Google Workspace domain\"\n  - \"A list of risky accounts: admins, accounts without MFA, inactive or shared accounts\"\n  - \"Findings ranked by risk, with the exact location of each setting to change in the admin console\"\n  - \"A check of your SPF, DKIM and DMARC records\"\n  - \"A prioritized remediation plan, ready to hand to your IT provider\"\n  - \"A results walkthrough and Q&A session with your team\"\nprocess:\n  - title: \"Scoping\"\n    text: \"We confirm your platform, licences and priorities. You then receive a fixed-price quote.\"\n  - title: \"Read-only access\"\n    text: \"Your administrator grants us read-only access, which you can revoke at any time. We guide you through it step by step.\"\n  - title: \"Analysis\"\n    text: \"We review identity, email, sharing and logging settings, then go through your accounts one by one.\"\n  - title: \"Report\"\n    text: \"You receive a prioritized report that sets out, for each finding, the concrete risk and the fix to apply.\"\n  - title: \"Remediation (optional)\"\n    text: \"Your team applies the fixes, or we take care of them on a quoted basis.\"\nidealFor:\n  - \"A small business that has used Microsoft 365 or Google Workspace for years without a security review\"\n  - \"A company that has dealt with a compromised email account or an attempted payment fraud\"\n  - \"An organization that must prove to its insurer that MFA is enforced for everyone\"\n  - \"A business whose environment was set up by a former provider or an employee who has since left\"\nfaq:\n  - q: \"Do you read our email or documents during the audit?\"\n    a: \"No. We review settings, logs and account lists, not the contents of your mailboxes or files. The read-only roles we use don't grant access to email content in the first place. Access is removed at the end of the engagement.\"\n  - q: \"Is our Microsoft 365 licence enough to be properly protected?\"\n    a: \"Several essential protections are available with every licence, such as security defaults, which enforce MFA. Others, like Conditional Access or Defender for Office 365, require higher-tier licences such as Business Premium. The report shows what you can do with your current licences and what an upgrade would add.\"\n  - q: \"Don't Microsoft and Google already handle security?\"\n    a: \"They secure their infrastructure, but configuring your account is up to you: who can sign in, how, and what can be shared externally. This is the shared responsibility model, and your side of it is exactly what the audit checks.\"\n---\n\nFor most small businesses, Microsoft 365 or Google Workspace is the heart of the operation: email, documents, calendars, Teams or Meet. That also makes it a prime target for fraudsters. A single compromised account is enough to redirect a payment or phish your clients from a legitimate address.\n\nDefault settings aren't always the safest, and configurations drift over the years: former administrators, temporary exceptions that became permanent, forgotten sharing links. Our audit cleans things up without changing anything in your environment.\n\n## What we check in Microsoft 365\n\n### Identity and access (Microsoft Entra ID)\n\nMFA on every account, starting with administrators; Conditional Access policies or security defaults; blocking legacy authentication, the older protocols that let attackers bypass MFA; the number of Global Administrators; user consent to third-party apps.\n\n### Email (Exchange Online and Defender)\n\nMailbox auditing enabled; automatic forwarding rules to external addresses; anti-phishing policies, Safe Links and Safe Attachments in Defender for Office 365; SPF, DKIM and DMARC records.\n\n### Sharing and logging\n\nExternal sharing in SharePoint, OneDrive and Teams; \"Anyone\" links; guest access; the unified audit log and how long logs are retained.\n\nOur [Microsoft 365 security audit](\u002Fen\u002Fblog\u002Fmicrosoft-365-security-audit) article walks through the most important settings.\n\n## And in Google Workspace\n\nThe logic is the same, with Google's tools:\n\n- enforced 2-Step Verification, with security keys for super admins;\n- the number of super admin accounts and separation of admin accounts from daily use;\n- control over third-party apps that can access your data (API controls and OAuth);\n- Gmail safety settings: spoofing protection, attachments, SPF, DKIM and DMARC;\n- external sharing in Google Drive and shared drives;\n- audit logs and security alerts.\n\nLearn more in our article on the [Google Workspace security audit](\u002Fen\u002Fblog\u002Fgoogle-workspace-security-audit).\n\n## A read-only audit\n\nWe don't need the keys to the kingdom. In Microsoft 365, your administrator assigns us roles such as Global Reader and Security Reader; in Google Workspace, a custom admin role limited to viewing. The few checks that need more privileges are done alongside your administrator in a shared session.\n\nThe result: no risk of changing a setting by mistake, and you keep full control of your environment. The audit is done entirely remotely, whether your office is in downtown Montréal, Sherbrooke or anywhere else in Quebec.\n\n## Why it's a priority for small businesses\n\nBusiness email compromise is a serious threat for SMBs: a fraudster gets into a mailbox, quietly watches the conversations, then sends fake banking details at just the right moment. Our article on [business email compromise and CEO fraud](\u002Fen\u002Fblog\u002Fbusiness-email-compromise-ceo-fraud) describes how it plays out.\n\nCyber insurance questionnaires now routinely ask whether MFA is enforced on email and admin accounts. And your mailboxes hold personal information protected under Quebec's Law 25. A well-configured environment addresses all three concerns at once.\n",{"title":466,"description":584},"en\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Your email and files live in the cloud. Let's make sure the right settings are actually protecting your business.","f205_19uFWpbkA-kak-ra6-lbX9hxGhhK3MxI9I3qHU",{"id":622,"title":623,"body":624,"deliverables":719,"description":726,"extension":259,"faq":727,"icon":740,"idealFor":741,"meta":746,"navTitle":18,"navigation":280,"order":19,"path":17,"price":747,"process":748,"rawbody":763,"seo":764,"stem":765,"tagline":766,"translationKey":747,"__hash__":767},"services_en\u002Fen\u002Fservices\u002Flaw-25-compliance.md","Quebec Law 25 Compliance for Small Businesses",{"type":50,"value":625,"toc":707},[626,629,632,638,642,646,654,658,665,669,676,680,684,687,691,697,701,704],[53,627,628],{},"Law 25 overhauled privacy protection in Quebec's private sector. Its obligations came into force in stages between September 2022 and September 2024, and they apply to small businesses just as they do to large corporations, whether you operate in French, English or both.",[53,630,631],{},"Many companies published a privacy policy, named a privacy officer… and stopped there. Yet much of the law is really about security: protecting information, detecting incidents, recording them and responding properly. That is exactly where our team comes in.",[189,633,635],{"title":634,"type":359},"We are not lawyers",[53,636,637],{},"Our team handles the security side of Law 25 and its practical implementation. We don't provide legal advice: we work alongside your legal counsel and clearly flag the points they should validate.",[60,639,641],{"id":640},"governance-roles-registers-and-assessments","Governance: roles, registers and assessments",[319,643,645],{"id":644},"person-in-charge-of-the-protection-of-personal-information","Person in charge of the protection of personal information",[53,647,648,649,653],{},"By default, this is the person with the highest authority in the business, but the role can be delegated in writing (s. 3.1). We help you clarify the role, prepare the delegation if needed, publish the officer's title and contact information on your website, and, above all, equip that person for the security side of the job. Our article on ",[147,650,652],{"href":651},"\u002Fen\u002Fblog\u002Fprivacy-officer-quebec-security-role","the privacy officer's security role"," gives an overview.",[319,655,657],{"id":656},"incident-register-and-response","Incident register and response",[53,659,660,661,151],{},"Every confidentiality incident must be recorded in a register (s. 3.8). Those presenting a risk of serious injury must be reported to the Commission d'accès à l'information (CAI) and to the people affected (s. 3.5). We give you a ready-to-use register and a simple procedure: who does what, how to assess the risk, who to notify. The CAI received 518 incident notices between January 1 and December 10, 2025, so this is far from theoretical. See also our ",[147,662,664],{"href":663},"\u002Fen\u002Fblog\u002Fconfidentiality-incident-register-template","confidentiality incident register template",[319,666,668],{"id":667},"privacy-impact-assessments-pia","Privacy impact assessments (PIA)",[53,670,671,672,151],{},"A PIA (known in French as an EFVP) is required for any project to acquire, develop or overhaul an information system involving personal information (s. 3.3): a new payroll system, a CRM, a client portal. We provide a tailored template and handle the security portion: hosting, access, encryption, vendors. Learn more in our article on ",[147,673,675],{"href":674},"\u002Fen\u002Fblog\u002Fprivacy-impact-assessment-pia-quebec-security","privacy impact assessments and security",[60,677,679],{"id":678},"your-website-and-your-security-safeguards","Your website and your security safeguards",[319,681,683],{"id":682},"cookies-and-consent","Cookies and consent",[53,685,686],{},"Technologies that can identify, locate or profile a person must be turned off by default (s. 8.1). We review your website: cookies, advertising pixels, analytics tools, consent banner, and a privacy policy written in clear, simple terms.",[319,688,690],{"id":689},"security-safeguards","Security safeguards",[53,692,693,694,696],{},"The law requires reasonable security measures, proportionate to the sensitivity of the information. We check what matters: access control, multi-factor authentication, encryption, backups, retention and destruction of data. If needed, a full ",[147,695,405],{"href":5}," goes deeper on this front.",[60,698,700],{"id":699},"why-start-with-security","Why start with security",[53,702,703],{},"A well-written privacy policy has never stopped ransomware. It is the incident that exposes a business: to its clients, to the regulator, sometimes in court. By putting security at the centre of your compliance work, you reduce the risk of an incident and you are ready to respond if one happens anyway.",[53,705,706],{},"We work remotely or on site anywhere in Quebec. Documents can be prepared in English, in French or both, ready for your leadership to adopt.",{"title":245,"searchDepth":11,"depth":15,"links":708},[709,714,718],{"id":640,"depth":11,"text":641,"children":710},[711,712,713],{"id":644,"depth":15,"text":645},{"id":656,"depth":15,"text":657},{"id":667,"depth":15,"text":668},{"id":678,"depth":11,"text":679,"children":715},[716,717],{"id":682,"depth":15,"text":683},{"id":689,"depth":15,"text":690},{"id":699,"depth":11,"text":700},[720,721,722,723,724,725],"A gap analysis against the main Law 25 obligations","A ready-to-use confidentiality incident register and an incident response procedure","Privacy policy and governance policy templates, to be reviewed by your legal counsel","A privacy impact assessment (PIA) template tailored to your projects, with support for your first one","A review of your website: cookies, tracking tools and consent","A prioritized plan for the security safeguards that protect personal information","Quebec Law 25 compliance for SMBs: privacy officer, incident register, privacy impact assessments, cookie consent and the security safeguards behind them.",[728,731,734,737],{"q":729,"a":730},"Does Law 25 apply to small businesses?","Yes. It applies to any private-sector business that collects, holds, uses or discloses personal information in Quebec, regardless of size. Security measures must be reasonable given the sensitivity, quantity and use of the information. Confirm the exact scope with your legal counsel.",{"q":732,"a":733},"Do we have 72 hours to report an incident?","No. The 72-hour deadline comes from Europe's GDPR. Law 25 requires you to promptly notify the Commission d'accès à l'information and the affected individuals when an incident presents a risk of serious injury. In other words: quickly, but without a fixed deadline.",{"q":735,"a":736},"How long must we keep the incident register?","At least five years, under the Regulation respecting confidentiality incidents. The register must include every incident, even those that pose no risk of serious injury, and a copy must be provided to the Commission d'accès à l'information on request.",{"q":738,"a":739},"What are the penalties?","Administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines $25 million or 4%. For a small business, though, the heaviest cost of a poorly handled incident is often the loss of client trust.","law",[742,743,744,745],"A small business that has named a privacy officer but has no plan or tools to back them up","A company handling sensitive information: health, financial or HR records","An organization that wants to be ready the day a confidentiality incident happens","A business launching a new system, website or app that collects personal information",{},"loi25",[749,751,754,757,760],{"title":284,"text":750},"We identify the personal information you collect, where it lives and who can access it. You then receive a fixed-price quote.",{"title":752,"text":753},"Assessment","We compare your practices with Law 25 obligations and with your actual security measures, backed by documents and system checks.",{"title":755,"text":756},"Action plan","You receive a prioritized list of gaps, sorted into security, governance and items for your legal counsel.",{"title":758,"text":759},"Implementation","We help you set up the register, the incident procedure, the templates and the technical fixes.",{"title":761,"text":762},"Handover","We train your privacy officer and your team so they can keep everything up to date.","---\ntitle: \"Quebec Law 25 Compliance for Small Businesses\"\nnavTitle: \"Law 25 Compliance\"\ndescription: \"Quebec Law 25 compliance for SMBs: privacy officer, incident register, privacy impact assessments, cookie consent and the security safeguards behind them.\"\ntranslationKey: loi25\norder: 4\nicon: law\nprice: loi25\ntagline: \"Turn Law 25 from a vague to-do into documented, working practices, starting with the security of your data.\"\ndeliverables:\n  - \"A gap analysis against the main Law 25 obligations\"\n  - \"A ready-to-use confidentiality incident register and an incident response procedure\"\n  - \"Privacy policy and governance policy templates, to be reviewed by your legal counsel\"\n  - \"A privacy impact assessment (PIA) template tailored to your projects, with support for your first one\"\n  - \"A review of your website: cookies, tracking tools and consent\"\n  - \"A prioritized plan for the security safeguards that protect personal information\"\nprocess:\n  - title: \"Scoping\"\n    text: \"We identify the personal information you collect, where it lives and who can access it. You then receive a fixed-price quote.\"\n  - title: \"Assessment\"\n    text: \"We compare your practices with Law 25 obligations and with your actual security measures, backed by documents and system checks.\"\n  - title: \"Action plan\"\n    text: \"You receive a prioritized list of gaps, sorted into security, governance and items for your legal counsel.\"\n  - title: \"Implementation\"\n    text: \"We help you set up the register, the incident procedure, the templates and the technical fixes.\"\n  - title: \"Handover\"\n    text: \"We train your privacy officer and your team so they can keep everything up to date.\"\nidealFor:\n  - \"A small business that has named a privacy officer but has no plan or tools to back them up\"\n  - \"A company handling sensitive information: health, financial or HR records\"\n  - \"An organization that wants to be ready the day a confidentiality incident happens\"\n  - \"A business launching a new system, website or app that collects personal information\"\nfaq:\n  - q: \"Does Law 25 apply to small businesses?\"\n    a: \"Yes. It applies to any private-sector business that collects, holds, uses or discloses personal information in Quebec, regardless of size. Security measures must be reasonable given the sensitivity, quantity and use of the information. Confirm the exact scope with your legal counsel.\"\n  - q: \"Do we have 72 hours to report an incident?\"\n    a: \"No. The 72-hour deadline comes from Europe's GDPR. Law 25 requires you to promptly notify the Commission d'accès à l'information and the affected individuals when an incident presents a risk of serious injury. In other words: quickly, but without a fixed deadline.\"\n  - q: \"How long must we keep the incident register?\"\n    a: \"At least five years, under the Regulation respecting confidentiality incidents. The register must include every incident, even those that pose no risk of serious injury, and a copy must be provided to the Commission d'accès à l'information on request.\"\n  - q: \"What are the penalties?\"\n    a: \"Administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines $25 million or 4%. For a small business, though, the heaviest cost of a poorly handled incident is often the loss of client trust.\"\n---\n\nLaw 25 overhauled privacy protection in Quebec's private sector. Its obligations came into force in stages between September 2022 and September 2024, and they apply to small businesses just as they do to large corporations, whether you operate in French, English or both.\n\nMany companies published a privacy policy, named a privacy officer… and stopped there. Yet much of the law is really about security: protecting information, detecting incidents, recording them and responding properly. That is exactly where our team comes in.\n\n::callout{type=\"warning\" title=\"We are not lawyers\"}\nOur team handles the security side of Law 25 and its practical implementation. We don't provide legal advice: we work alongside your legal counsel and clearly flag the points they should validate.\n::\n\n## Governance: roles, registers and assessments\n\n### Person in charge of the protection of personal information\n\nBy default, this is the person with the highest authority in the business, but the role can be delegated in writing (s. 3.1). We help you clarify the role, prepare the delegation if needed, publish the officer's title and contact information on your website, and, above all, equip that person for the security side of the job. Our article on [the privacy officer's security role](\u002Fen\u002Fblog\u002Fprivacy-officer-quebec-security-role) gives an overview.\n\n### Incident register and response\n\nEvery confidentiality incident must be recorded in a register (s. 3.8). Those presenting a risk of serious injury must be reported to the Commission d'accès à l'information (CAI) and to the people affected (s. 3.5). We give you a ready-to-use register and a simple procedure: who does what, how to assess the risk, who to notify. The CAI received 518 incident notices between January 1 and December 10, 2025, so this is far from theoretical. See also our [confidentiality incident register template](\u002Fen\u002Fblog\u002Fconfidentiality-incident-register-template).\n\n### Privacy impact assessments (PIA)\n\nA PIA (known in French as an EFVP) is required for any project to acquire, develop or overhaul an information system involving personal information (s. 3.3): a new payroll system, a CRM, a client portal. We provide a tailored template and handle the security portion: hosting, access, encryption, vendors. Learn more in our article on [privacy impact assessments and security](\u002Fen\u002Fblog\u002Fprivacy-impact-assessment-pia-quebec-security).\n\n## Your website and your security safeguards\n\n### Cookies and consent\n\nTechnologies that can identify, locate or profile a person must be turned off by default (s. 8.1). We review your website: cookies, advertising pixels, analytics tools, consent banner, and a privacy policy written in clear, simple terms.\n\n### Security safeguards\n\nThe law requires reasonable security measures, proportionate to the sensitivity of the information. We check what matters: access control, multi-factor authentication, encryption, backups, retention and destruction of data. If needed, a full [cybersecurity audit](\u002Fen\u002Fservices\u002Fcybersecurity-audit) goes deeper on this front.\n\n## Why start with security\n\nA well-written privacy policy has never stopped ransomware. It is the incident that exposes a business: to its clients, to the regulator, sometimes in court. By putting security at the centre of your compliance work, you reduce the risk of an incident and you are ready to respond if one happens anyway.\n\nWe work remotely or on site anywhere in Quebec. Documents can be prepared in English, in French or both, ready for your leadership to adopt.\n",{"title":623,"description":726},"en\u002Fservices\u002Flaw-25-compliance","Turn Law 25 from a vague to-do into documented, working practices, starting with the security of your data.","S05BNbJo_xFGSRmEngSX553X1AIh20QFia8FZsxEA7Y",{"id":769,"title":770,"body":771,"deliverables":894,"description":901,"extension":259,"faq":902,"icon":912,"idealFor":913,"meta":918,"navTitle":22,"navigation":280,"order":23,"path":21,"price":919,"process":920,"rawbody":935,"seo":936,"stem":937,"tagline":938,"translationKey":939,"__hash__":940},"services_en\u002Fen\u002Fservices\u002Fremediation-hardening.md","Security Remediation and Hardening for SMBs",{"type":50,"value":772,"toc":883},[773,776,779,783,787,795,798,805,809,816,820,823,827,830,837,841,844,847,851,877],[53,774,775],{},"Most audits end with a list of recommendations. The real work starts after that, and it is often where small businesses get stuck: the IT provider is stretched thin, nobody in-house has the time, or it's simply unclear where to begin.",[53,777,778],{},"Our team takes it from there. We apply the fixes, document them and confirm they work. Every engagement is quoted at a fixed price once we have analyzed what needs to be fixed.",[60,780,782],{"id":781},"typical-projects","Typical projects",[319,784,786],{"id":785},"multi-factor-authentication","Multi-factor authentication",[53,788,789,790,794],{},"MFA rolled out to every account, starting with administrators, email and remote access. Where possible, we favour phishing-resistant methods such as security keys or authenticator apps with number matching, and we block the legacy protocols that bypass MFA. Our article on ",[147,791,793],{"href":792},"\u002Fen\u002Fblog\u002Fmulti-factor-authentication-choosing-mfa","choosing the right MFA"," explains why text messages are no longer enough.",[319,796,112],{"id":797},"backups",[53,799,800,801,151],{},"We apply the 3-2-1-1-0 rule: three copies, on two different types of media, one off site, one offline or immutable, and zero errors in restore tests. That includes your Microsoft 365 or Google Workspace data, which many businesses wrongly assume is backed up automatically. All the details are in our article on ",[147,802,804],{"href":803},"\u002Fen\u002Fblog\u002F3-2-1-1-0-backup-rule-ransomware","the 3-2-1-1-0 backup rule",[319,806,808],{"id":807},"email-spf-dkim-and-dmarc","Email: SPF, DKIM and DMARC",[53,810,811,812,151],{},"We inventory everything that sends email on your behalf (newsletters, invoicing, CRM), enable DKIM signing, then move DMARC gradually from monitoring to quarantine to reject, reviewing the reports at each step. Not sure what those acronyms mean? Read ",[147,813,815],{"href":814},"\u002Fen\u002Fblog\u002Fspf-dkim-dmarc-explained","SPF, DKIM and DMARC explained",[319,817,819],{"id":818},"patching-and-endpoints","Patching and endpoints",[53,821,822],{},"A patch management process for operating systems, browsers, firewalls and VPNs; disk encryption; removal of local admin rights; antivirus or EDR configuration.",[319,824,826],{"id":825},"configuration-hardening","Configuration hardening",[53,828,829],{},"Hardening Microsoft 365 or Google Workspace, cleaning up firewall rules, closing exposed services such as Remote Desktop, and separating guest Wi-Fi and admin accounts.",[189,831,834],{"title":832,"type":833},"Start with the quick wins","tip",[53,835,836],{},"Some fixes take a few hours and cut risk sharply: enforcing MFA for administrators, closing an internet-facing Remote Desktop, creating an offline backup copy. We do those first.",[60,838,840],{"id":839},"why-a-report-shouldnt-sit-on-a-shelf","Why a report shouldn't sit on a shelf",[53,842,843],{},"An audit report that never gets acted on creates a false sense of security: the gaps are known, but still open. And every month adds new patches to install. A KPMG survey published in 2023 found that more than six in ten Quebec SMBs had been hit by a cyberattack in the previous year.",[53,845,846],{},"Insurers no longer settle for good intentions either. At renewal, they want to know whether MFA, offline backups and patch management are actually in place. Remediation lets you answer yes, with evidence to back it up.",[60,848,850],{"id":849},"how-we-work","How we work",[160,852,853,859,865,871],{},[163,854,855,858],{},[166,856,857],{},"Vendor-neutral where possible",": we start with the security features you already pay for. If a new tool is needed, we present options and you choose.",[163,860,861,864],{},[166,862,863],{},"Step by step, with a plan B",": every change is planned, announced and paired with a way to roll it back.",[163,866,867,870],{},[166,868,869],{},"Verified, not just applied",": we test every fix, ideally with a retest.",[163,872,873,876],{},[166,874,875],{},"Documented",": you keep a clear record of what was done, for your team, your insurer and your next audit.",[53,878,879,880,882],{},"We work remotely or on site anywhere in Quebec. And if you don't have an assessment yet, a ",[147,881,405],{"href":5}," will tell you exactly what to fix first.",{"title":245,"searchDepth":11,"depth":15,"links":884},[885,892,893],{"id":781,"depth":11,"text":782,"children":886},[887,888,889,890,891],{"id":785,"depth":15,"text":786},{"id":797,"depth":15,"text":112},{"id":807,"depth":15,"text":808},{"id":818,"depth":15,"text":819},{"id":825,"depth":15,"text":826},{"id":839,"depth":11,"text":840},{"id":849,"depth":11,"text":850},[895,896,897,898,899,900],"A detailed work plan and fixed-price quote, built from your audit report","Fixes applied and documented: what, where, when, and how to roll back","An MFA rollout with a simple how-to guide for your staff","Reconfigured backups and a documented restore test","A closing report that proves the safeguards are in place, useful for your insurer","Knowledge transfer to your team or your IT provider","We fix what your audit found: MFA rollout, backup repairs, DMARC enforcement, patching and configuration hardening. Quoted per project, anywhere in Quebec.",[903,906,909],{"q":904,"a":905},"Can you work with our current IT provider?","Yes, and that is often the best arrangement. We can do the work ourselves, split it with your provider or simply guide them. The goal is to get your systems fixed, not to replace anyone.",{"q":907,"a":908},"Do we need to have done an audit with you first?","No. We can start from a report produced by another firm, an insurance questionnaire or a specific problem. If no assessment exists, we begin with a short review so we're not fixing things blindly.",{"q":910,"a":911},"Will the work disrupt our employees?","Some changes, like MFA, require a small adjustment from staff. We announce them in advance, provide a simple guide and schedule sensitive changes outside business hours.","wrench",[914,915,916,917],"An SMB that received an audit or pentest report but lacks the resources to act on it","A company whose insurer requires MFA, offline backups or EDR before renewal","An organization whose IT provider handles day-to-day support but not security projects","A business that wants to move DMARC to a reject policy without blocking its own email",{},null,[921,924,927,929,932],{"title":922,"text":923},"Prioritization","We start from your audit report, ours or a third party's, and pick the fixes that reduce risk the most.",{"title":925,"text":926},"Quote","You receive a fixed-price quote with the exact list of tasks, the timeline and the expected impact on your staff.",{"title":758,"text":928},"We roll out changes in stages, outside peak hours when needed, with a rollback plan for each one.",{"title":930,"text":931},"Validation","Every fix is verified: is the gap really closed? Can your people still work normally?",{"title":933,"text":934},"Documentation","You receive documentation of every change and proof that the safeguards are in place.","---\ntitle: \"Security Remediation and Hardening for SMBs\"\nnavTitle: \"Remediation and Hardening\"\ndescription: \"We fix what your audit found: MFA rollout, backup repairs, DMARC enforcement, patching and configuration hardening. Quoted per project, anywhere in Quebec.\"\ntranslationKey: remediation\norder: 5\nicon: wrench\ntagline: \"A report protects no one until the fixes are done. We turn your findings list into action.\"\ndeliverables:\n  - \"A detailed work plan and fixed-price quote, built from your audit report\"\n  - \"Fixes applied and documented: what, where, when, and how to roll back\"\n  - \"An MFA rollout with a simple how-to guide for your staff\"\n  - \"Reconfigured backups and a documented restore test\"\n  - \"A closing report that proves the safeguards are in place, useful for your insurer\"\n  - \"Knowledge transfer to your team or your IT provider\"\nprocess:\n  - title: \"Prioritization\"\n    text: \"We start from your audit report, ours or a third party's, and pick the fixes that reduce risk the most.\"\n  - title: \"Quote\"\n    text: \"You receive a fixed-price quote with the exact list of tasks, the timeline and the expected impact on your staff.\"\n  - title: \"Implementation\"\n    text: \"We roll out changes in stages, outside peak hours when needed, with a rollback plan for each one.\"\n  - title: \"Validation\"\n    text: \"Every fix is verified: is the gap really closed? Can your people still work normally?\"\n  - title: \"Documentation\"\n    text: \"You receive documentation of every change and proof that the safeguards are in place.\"\nidealFor:\n  - \"An SMB that received an audit or pentest report but lacks the resources to act on it\"\n  - \"A company whose insurer requires MFA, offline backups or EDR before renewal\"\n  - \"An organization whose IT provider handles day-to-day support but not security projects\"\n  - \"A business that wants to move DMARC to a reject policy without blocking its own email\"\nfaq:\n  - q: \"Can you work with our current IT provider?\"\n    a: \"Yes, and that is often the best arrangement. We can do the work ourselves, split it with your provider or simply guide them. The goal is to get your systems fixed, not to replace anyone.\"\n  - q: \"Do we need to have done an audit with you first?\"\n    a: \"No. We can start from a report produced by another firm, an insurance questionnaire or a specific problem. If no assessment exists, we begin with a short review so we're not fixing things blindly.\"\n  - q: \"Will the work disrupt our employees?\"\n    a: \"Some changes, like MFA, require a small adjustment from staff. We announce them in advance, provide a simple guide and schedule sensitive changes outside business hours.\"\n---\n\nMost audits end with a list of recommendations. The real work starts after that, and it is often where small businesses get stuck: the IT provider is stretched thin, nobody in-house has the time, or it's simply unclear where to begin.\n\nOur team takes it from there. We apply the fixes, document them and confirm they work. Every engagement is quoted at a fixed price once we have analyzed what needs to be fixed.\n\n## Typical projects\n\n### Multi-factor authentication\n\nMFA rolled out to every account, starting with administrators, email and remote access. Where possible, we favour phishing-resistant methods such as security keys or authenticator apps with number matching, and we block the legacy protocols that bypass MFA. Our article on [choosing the right MFA](\u002Fen\u002Fblog\u002Fmulti-factor-authentication-choosing-mfa) explains why text messages are no longer enough.\n\n### Backups\n\nWe apply the 3-2-1-1-0 rule: three copies, on two different types of media, one off site, one offline or immutable, and zero errors in restore tests. That includes your Microsoft 365 or Google Workspace data, which many businesses wrongly assume is backed up automatically. All the details are in our article on [the 3-2-1-1-0 backup rule](\u002Fen\u002Fblog\u002F3-2-1-1-0-backup-rule-ransomware).\n\n### Email: SPF, DKIM and DMARC\n\nWe inventory everything that sends email on your behalf (newsletters, invoicing, CRM), enable DKIM signing, then move DMARC gradually from monitoring to quarantine to reject, reviewing the reports at each step. Not sure what those acronyms mean? Read [SPF, DKIM and DMARC explained](\u002Fen\u002Fblog\u002Fspf-dkim-dmarc-explained).\n\n### Patching and endpoints\n\nA patch management process for operating systems, browsers, firewalls and VPNs; disk encryption; removal of local admin rights; antivirus or EDR configuration.\n\n### Configuration hardening\n\nHardening Microsoft 365 or Google Workspace, cleaning up firewall rules, closing exposed services such as Remote Desktop, and separating guest Wi-Fi and admin accounts.\n\n::callout{type=\"tip\" title=\"Start with the quick wins\"}\nSome fixes take a few hours and cut risk sharply: enforcing MFA for administrators, closing an internet-facing Remote Desktop, creating an offline backup copy. We do those first.\n::\n\n## Why a report shouldn't sit on a shelf\n\nAn audit report that never gets acted on creates a false sense of security: the gaps are known, but still open. And every month adds new patches to install. A KPMG survey published in 2023 found that more than six in ten Quebec SMBs had been hit by a cyberattack in the previous year.\n\nInsurers no longer settle for good intentions either. At renewal, they want to know whether MFA, offline backups and patch management are actually in place. Remediation lets you answer yes, with evidence to back it up.\n\n## How we work\n\n- **Vendor-neutral where possible**: we start with the security features you already pay for. If a new tool is needed, we present options and you choose.\n- **Step by step, with a plan B**: every change is planned, announced and paired with a way to roll it back.\n- **Verified, not just applied**: we test every fix, ideally with a retest.\n- **Documented**: you keep a clear record of what was done, for your team, your insurer and your next audit.\n\nWe work remotely or on site anywhere in Quebec. And if you don't have an assessment yet, a [cybersecurity audit](\u002Fen\u002Fservices\u002Fcybersecurity-audit) will tell you exactly what to fix first.\n",{"title":770,"description":901},"en\u002Fservices\u002Fremediation-hardening","A report protects no one until the fixes are done. We turn your findings list into action.","remediation","7OdGnGgR0DV9I5JjoBDN9oxR5rcoLXa4M2lxGyIGMWE",{"id":942,"title":943,"body":944,"deliverables":1044,"description":1051,"extension":259,"faq":1052,"icon":1065,"idealFor":1066,"meta":1071,"navTitle":26,"navigation":280,"order":27,"path":25,"price":1072,"process":1073,"rawbody":1089,"seo":1090,"stem":1091,"tagline":1092,"translationKey":1072,"__hash__":1093},"services_en\u002Fen\u002Fservices\u002Fongoing-security-partner.md","Virtual CISO and Ongoing Security Partner for SMBs",{"type":50,"value":945,"toc":1033},[946,949,952,956,960,963,967,974,978,986,990,997,1001,1004,1008,1011,1014,1018,1021,1027],[53,947,948],{},"Security isn't a project you finish. New people join, new software gets added, vulnerabilities are disclosed every week and fraudsters keep changing tactics. An audit is a snapshot; ongoing support is the full picture over time.",[53,950,951],{},"A KPMG survey published in 2023 found that 65% of Quebec SMBs lack qualified staff to manage cyber risk. Hiring a full-time security manager isn't realistic for most of them. Our team fills that role through a monthly retainer: you get a single point of contact who knows your business, your systems and your obligations, and who tells you where to focus.",[60,953,955],{"id":954},"whats-included","What's included",[319,957,959],{"id":958},"monitoring-your-exposure","Monitoring your exposure",[53,961,962],{},"Every quarter, we scan what your business exposes to the internet: open services, certificates, email configuration, newly disclosed vulnerabilities. When an issue is fixed, we retest to confirm it is really closed.",[319,964,966],{"id":965},"policies-and-governance","Policies and governance",[53,968,969,970,151],{},"Short policies, written in plain language and adapted to how you actually work: acceptable use, access management, backups, remote work, incident response. We keep them current as things change. For incident response, we build on our ",[147,971,973],{"href":972},"\u002Fen\u002Fblog\u002Fincident-response-plan-template-small-business","incident response plan template for small businesses",[319,975,977],{"id":976},"training-and-phishing-simulations","Training and phishing simulations",[53,979,980,981,985],{},"Short, practical training sessions for your employees, and regular phishing simulations to track progress. Our article on ",[147,982,984],{"href":983},"\u002Fen\u002Fblog\u002Fphishing-simulation-employees","phishing simulations for employees"," explains how these campaigns work.",[319,987,989],{"id":988},"insurance-and-client-questionnaires","Insurance and client questionnaires",[53,991,992,993,151],{},"Cyber insurance questionnaires and client security assessments keep getting more detailed. We help you answer them accurately, and fix first whatever could cause trouble. See our tips on ",[147,994,996],{"href":995},"\u002Fen\u002Fblog\u002Fcyber-insurance-questionnaire-requirements","cyber insurance questionnaire requirements",[319,998,1000],{"id":999},"reporting-to-leadership","Reporting to leadership",[53,1002,1003],{},"Every quarter, a simple dashboard: MFA coverage, patch status, simulation results, open and closed findings. A document you can present as is to your board of directors.",[60,1005,1007],{"id":1006},"why-ongoing-support-beats-a-one-off-audit","Why ongoing support beats a one-off audit",[53,1009,1010],{},"An audit tells you where you stand on a given date. Six months later, things have changed: a new cloud app, an employee replaced, a firewall rule added \"temporarily.\" Without follow-up, gaps pile up without anyone noticing.",[53,1012,1013],{},"Time matters too. According to a 2025 CDW study, the time it takes small Canadian organizations to detect an incident grew from 4.0 days in 2024 to 6.8 days in 2025. Regular follow-up shrinks blind spots and helps you react faster.",[60,1015,1017],{"id":1016},"neutral-practical-advice","Neutral, practical advice",[53,1019,1020],{},"Our recommendations serve your interests, not a product catalogue: we make the most of what you already have, such as the security features built into Microsoft 365 or Google Workspace, and only suggest a new tool when it addresses a real risk.",[189,1022,1024],{"title":1023,"type":833},"One point of contact",[53,1025,1026],{},"The same person follows your file from month to month. You don't have to re-explain your business on every call.",[53,1028,1029,1030,1032],{},"We work remotely or on site anywhere in Quebec, with deliverables in English or French. If you'd rather start with a one-time assessment, a ",[147,1031,405],{"href":5}," is the natural first step toward ongoing support.",{"title":245,"searchDepth":11,"depth":15,"links":1034},[1035,1042,1043],{"id":954,"depth":11,"text":955,"children":1036},[1037,1038,1039,1040,1041],{"id":958,"depth":15,"text":959},{"id":965,"depth":15,"text":966},{"id":976,"depth":15,"text":977},{"id":988,"depth":15,"text":989},{"id":999,"depth":15,"text":1000},{"id":1006,"depth":11,"text":1007},{"id":1016,"depth":11,"text":1017},[1045,1046,1047,1048,1049,1050],"A quarterly external scan of your exposed assets, with retests of fixed issues","Security policies written and kept current: acceptable use, access, backups, incidents","Security awareness training and phishing simulations for your staff","Help completing cyber insurance questionnaires and client security assessments","A quarterly dashboard for leadership and your board of directors","A go-to contact for your security questions","A virtual CISO for your SMB: a monthly retainer covering quarterly scans, policies, awareness training, phishing simulations and insurance questionnaires.",[1053,1056,1059,1062],{"q":1054,"a":1055},"What is a vCISO?","A virtual Chief Information Security Officer (vCISO) is a part-time, shared security lead. They play the same role as an in-house CISO, but only for the time your business actually needs.",{"q":1057,"a":1058},"Do you replace our IT provider?","No. Your provider handles day-to-day operations: workstations, servers, user support. We set security priorities, check that safeguards are in place and give you independent advice.",{"q":1060,"a":1061},"Can we tailor what the retainer includes?","Yes. The retainer is defined in the quote based on your size and obligations: how often simulations run, how many meetings, how much compliance support. It can be revisited at the annual review.",{"q":1063,"a":1064},"Are phishing simulations meant to catch employees out?","No. They exist to measure and to teach. Results are reported to leadership in aggregate, and clicking a simulated phishing email leads to a short explanation, not a reprimand.","partner",[1067,1068,1069,1070],"An SMB with no one in-house responsible for security","A company whose clients or insurer send security questionnaires every year","Leadership or a board that wants regular oversight and clear metrics","An organization that has completed an audit and wants to make sure progress sticks",{},"vciso",[1074,1077,1080,1083,1086],{"title":1075,"text":1076},"Baseline","We start from a recent audit, or run one, to establish where you stand and set priorities.",{"title":1078,"text":1079},"Annual roadmap","Together we agree on a 12-month plan that fits your budget and your obligations.",{"title":1081,"text":1082},"Monthly check-in","Each month, we review progress, new risks and your team's questions.",{"title":1084,"text":1085},"Quarterly review","External scan, phishing simulation results and a dashboard presented to leadership.",{"title":1087,"text":1088},"Annual review","We measure how far you've come and build next year's roadmap.","---\ntitle: \"Virtual CISO and Ongoing Security Partner for SMBs\"\nnavTitle: \"Ongoing Security Partner (vCISO)\"\ndescription: \"A virtual CISO for your SMB: a monthly retainer covering quarterly scans, policies, awareness training, phishing simulations and insurance questionnaires.\"\ntranslationKey: vciso\norder: 6\nicon: partner\nprice: vciso\ntagline: \"A part-time security lead who knows your business and keeps an eye on your risks, month after month.\"\ndeliverables:\n  - \"A quarterly external scan of your exposed assets, with retests of fixed issues\"\n  - \"Security policies written and kept current: acceptable use, access, backups, incidents\"\n  - \"Security awareness training and phishing simulations for your staff\"\n  - \"Help completing cyber insurance questionnaires and client security assessments\"\n  - \"A quarterly dashboard for leadership and your board of directors\"\n  - \"A go-to contact for your security questions\"\nprocess:\n  - title: \"Baseline\"\n    text: \"We start from a recent audit, or run one, to establish where you stand and set priorities.\"\n  - title: \"Annual roadmap\"\n    text: \"Together we agree on a 12-month plan that fits your budget and your obligations.\"\n  - title: \"Monthly check-in\"\n    text: \"Each month, we review progress, new risks and your team's questions.\"\n  - title: \"Quarterly review\"\n    text: \"External scan, phishing simulation results and a dashboard presented to leadership.\"\n  - title: \"Annual review\"\n    text: \"We measure how far you've come and build next year's roadmap.\"\nidealFor:\n  - \"An SMB with no one in-house responsible for security\"\n  - \"A company whose clients or insurer send security questionnaires every year\"\n  - \"Leadership or a board that wants regular oversight and clear metrics\"\n  - \"An organization that has completed an audit and wants to make sure progress sticks\"\nfaq:\n  - q: \"What is a vCISO?\"\n    a: \"A virtual Chief Information Security Officer (vCISO) is a part-time, shared security lead. They play the same role as an in-house CISO, but only for the time your business actually needs.\"\n  - q: \"Do you replace our IT provider?\"\n    a: \"No. Your provider handles day-to-day operations: workstations, servers, user support. We set security priorities, check that safeguards are in place and give you independent advice.\"\n  - q: \"Can we tailor what the retainer includes?\"\n    a: \"Yes. The retainer is defined in the quote based on your size and obligations: how often simulations run, how many meetings, how much compliance support. It can be revisited at the annual review.\"\n  - q: \"Are phishing simulations meant to catch employees out?\"\n    a: \"No. They exist to measure and to teach. Results are reported to leadership in aggregate, and clicking a simulated phishing email leads to a short explanation, not a reprimand.\"\n---\n\nSecurity isn't a project you finish. New people join, new software gets added, vulnerabilities are disclosed every week and fraudsters keep changing tactics. An audit is a snapshot; ongoing support is the full picture over time.\n\nA KPMG survey published in 2023 found that 65% of Quebec SMBs lack qualified staff to manage cyber risk. Hiring a full-time security manager isn't realistic for most of them. Our team fills that role through a monthly retainer: you get a single point of contact who knows your business, your systems and your obligations, and who tells you where to focus.\n\n## What's included\n\n### Monitoring your exposure\n\nEvery quarter, we scan what your business exposes to the internet: open services, certificates, email configuration, newly disclosed vulnerabilities. When an issue is fixed, we retest to confirm it is really closed.\n\n### Policies and governance\n\nShort policies, written in plain language and adapted to how you actually work: acceptable use, access management, backups, remote work, incident response. We keep them current as things change. For incident response, we build on our [incident response plan template for small businesses](\u002Fen\u002Fblog\u002Fincident-response-plan-template-small-business).\n\n### Training and phishing simulations\n\nShort, practical training sessions for your employees, and regular phishing simulations to track progress. Our article on [phishing simulations for employees](\u002Fen\u002Fblog\u002Fphishing-simulation-employees) explains how these campaigns work.\n\n### Insurance and client questionnaires\n\nCyber insurance questionnaires and client security assessments keep getting more detailed. We help you answer them accurately, and fix first whatever could cause trouble. See our tips on [cyber insurance questionnaire requirements](\u002Fen\u002Fblog\u002Fcyber-insurance-questionnaire-requirements).\n\n### Reporting to leadership\n\nEvery quarter, a simple dashboard: MFA coverage, patch status, simulation results, open and closed findings. A document you can present as is to your board of directors.\n\n## Why ongoing support beats a one-off audit\n\nAn audit tells you where you stand on a given date. Six months later, things have changed: a new cloud app, an employee replaced, a firewall rule added \"temporarily.\" Without follow-up, gaps pile up without anyone noticing.\n\nTime matters too. According to a 2025 CDW study, the time it takes small Canadian organizations to detect an incident grew from 4.0 days in 2024 to 6.8 days in 2025. Regular follow-up shrinks blind spots and helps you react faster.\n\n## Neutral, practical advice\n\nOur recommendations serve your interests, not a product catalogue: we make the most of what you already have, such as the security features built into Microsoft 365 or Google Workspace, and only suggest a new tool when it addresses a real risk.\n\n::callout{type=\"tip\" title=\"One point of contact\"}\nThe same person follows your file from month to month. You don't have to re-explain your business on every call.\n::\n\nWe work remotely or on site anywhere in Quebec, with deliverables in English or French. If you'd rather start with a one-time assessment, a [cybersecurity audit](\u002Fen\u002Fservices\u002Fcybersecurity-audit) is the natural first step toward ongoing support.\n",{"title":943,"description":1051},"en\u002Fservices\u002Fongoing-security-partner","A part-time security lead who knows your business and keeps an eye on your risks, month after month.","VNEViWIgq352AzzcpHkBdXWDRvBRa7O_f95BYaCrUlU",1792970120651]