[{"data":1,"prerenderedAt":323},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"svc-\u002Fen\u002Fservices\u002Fcybersecurity-audit":45,"svc-alt-\u002Fen\u002Fservices\u002Fcybersecurity-audit":302,"svc-others-\u002Fen\u002Fservices\u002Fcybersecurity-audit":304},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":46,"title":47,"body":48,"deliverables":250,"description":257,"extension":258,"faq":259,"icon":272,"idealFor":273,"meta":278,"navTitle":6,"navigation":279,"order":7,"path":5,"price":280,"process":281,"rawbody":297,"seo":298,"stem":299,"tagline":300,"translationKey":272,"__hash__":301},"services_en\u002Fen\u002Fservices\u002Fcybersecurity-audit.md","Cybersecurity Audit for SMBs in Montréal and Québec",{"type":49,"value":50,"toc":243},"minimark",[51,55,58,63,139,142,151,155,158,187,195,199,202,205,224,228,240],[52,53,54],"p",{},"You know cybersecurity matters, but you are not sure where your business actually stands. Do your backups really work? Does the employee who left last fall still have access to anything? Would your insurer take your answers at face value? A cybersecurity audit answers these questions with facts instead of guesswork.",[52,56,57],{},"Our team looks at both the organization (who decides, who is accountable, what rules exist) and the technology (configurations, accounts, devices, network). The result is a clear picture of what is working, what needs fixing, and in what order.",[59,60,62],"h2",{"id":61},"what-we-review","What we review",[64,65,66,79],"table",{},[67,68,69],"thead",{},[70,71,72,76],"tr",{},[73,74,75],"th",{},"Area",[73,77,78],{},"What we look at",[80,81,82,91,99,107,115,123,131],"tbody",{},[70,83,84,88],{},[85,86,87],"td",{},"Governance",[85,89,90],{},"Roles and responsibilities, existing policies, asset inventory, oversight of IT vendors",[70,92,93,96],{},[85,94,95],{},"Accounts and access",[85,97,98],{},"Multi-factor authentication, admin accounts, employee offboarding, shared passwords",[70,100,101,104],{},[85,102,103],{},"Email security",[85,105,106],{},"SPF, DKIM and DMARC, anti-phishing filtering, suspicious forwarding rules",[70,108,109,112],{},[85,110,111],{},"Backups",[85,113,114],{},"Actual coverage, offline or immutable copy, real restore tests",[70,116,117,120],{},[85,118,119],{},"Endpoints",[85,121,122],{},"Patching, antivirus or EDR, disk encryption, personal devices",[70,124,125,128],{},[85,126,127],{},"Network perimeter",[85,129,130],{},"Firewall, remote access (VPN), internet-facing services, guest Wi-Fi",[70,132,133,136],{},[85,134,135],{},"Law 25",[85,137,138],{},"Safeguards for personal information, incident register, incident procedure",[52,140,141],{},"Each area is assessed against recognized best practices, such as the baseline controls recommended by the Canadian Centre for Cyber Security, then scaled to the real size of your business. We won't recommend an enterprise-grade solution for a 15-person office in Laval.",[52,143,144,145,150],{},"For a closer look at how an engagement unfolds, read our guide to ",[146,147,149],"a",{"href":148},"\u002Fen\u002Fblog\u002Fcybersecurity-audit-small-business-quebec","cybersecurity audits for small businesses",".",[59,152,154],{"id":153},"the-report-you-receive","The report you receive",[52,156,157],{},"A good report is one that actually gets read. Ours is written in plain English (or French, if your team prefers) and speaks to leadership first.",[159,160,161,169,175,181],"ul",{},[162,163,164,168],"li",{},[165,166,167],"strong",{},"An executive summary",": your overall risk level and your top three to five priorities, in business terms.",[162,170,171,174],{},[165,172,173],{},"Ranked findings",": for each one, the concrete risk (\"a fraudster could pose as your accounts payable team\"), the evidence we observed and the recommended fix.",[162,176,177,180],{},[165,178,179],{},"A roadmap",": quick wins for this month, medium-term projects, and items to plan for in next year's budget.",[162,182,183,186],{},[165,184,185],{},"A technical appendix",": the details your IT provider needs to get to work.",[188,189,192],"callout",{"title":190,"type":191},"A fixed-price quote, before we start","info",[52,193,194],{},"After the scoping call, you receive a fixed-price quote that spells out the scope, timeline and deliverables. No open-ended hourly billing, no surprises at the end.",[59,196,198],{"id":197},"why-small-businesses-need-one","Why small businesses need one",[52,200,201],{},"According to a 2025 study by insurer Coalition, 77% of Canadian small businesses believe they are too small to be targeted, yet 86% had experienced a cybersecurity event in the last five years. Attackers don't pick victims by size; they look for open doors.",[52,203,204],{},"An audit also helps on three practical fronts:",[159,206,207,213,218],{},[162,208,209,212],{},[165,210,211],{},"Cyber insurance",": insurers are asking increasingly specific questions about multi-factor authentication, backups and patching. Better to know your answers before you sign.",[162,214,215,217],{},[165,216,135],{},": Quebec's privacy law requires reasonable security measures to protect personal information. The audit documents where you stand.",[162,219,220,223],{},[165,221,222],{},"Your clients",": more and more large customers ask their suppliers for evidence of good security practices.",[59,225,227],{"id":226},"audit-pentest-or-scan-which-one","Audit, pentest or scan: which one?",[52,229,230,231,234,235,239],{},"An audit gives you the big picture, covering people and processes as well as technology. A ",[146,232,233],{"href":9},"penetration test"," simulates a real attack against a specific target. For most small businesses, the audit is the right starting point; a pentest then validates the most critical systems. Our article on ",[146,236,238],{"href":237},"\u002Fen\u002Fblog\u002Fsecurity-audit-vs-pentest-vs-vulnerability-scan","security audits vs. pentests vs. vulnerability scans"," breaks down the differences.",[52,241,242],{},"We work remotely or on site anywhere in Quebec, from Montréal to the Eastern Townships and beyond. And if you'd rather ease into it, the free quick audit gives you a first look at your internet exposure, with no commitment.",{"title":244,"searchDepth":11,"depth":15,"links":245},"",[246,247,248,249],{"id":61,"depth":11,"text":62},{"id":153,"depth":11,"text":154},{"id":197,"depth":11,"text":198},{"id":226,"depth":11,"text":227},[251,252,253,254,255,256],"A plain-language audit report, with an executive summary written for leadership","Findings ranked by business risk and by the effort needed to fix them","A prioritized roadmap: quick wins, medium-term projects and items to budget for","An overview of your security safeguards against Quebec Law 25 requirements","A list of the items that weigh most on a cyber insurance questionnaire","A results walkthrough with your team and your IT provider","A cybersecurity audit built for Quebec SMBs: accounts, email, backups, network and Law 25 safeguards, with a plain-language report and a prioritized plan.","md",[260,263,266,269],{"q":261,"a":262},"How long does a cybersecurity audit take?","It depends on the number of employees, locations and systems. For a typical small business, expect a few weeks between the scoping call and the report walkthrough. The exact timeline is set out in the quote.",{"q":264,"a":265},"Will the audit disrupt our staff or operations?","Very little. Technical checks are mostly read-only, and interviews are short and scheduled in advance. We work around your calendar, not the other way around.",{"q":267,"a":268},"How is this different from the free quick audit?","The quick audit is a passive, automated scan of what is visible from the internet, paired with a maturity quiz. The full audit goes much further: interviews, a review of your internal configurations, backups and workstations, and a detailed action plan.",{"q":270,"a":271},"Do we need to give you access to our systems?","Yes, for the technical portion, usually through a read-only account or with your IT contact present. Access is removed at the end of the engagement and your information is handled confidentially.","audit",[274,275,276,277],"A small business that has never had its security assessed and doesn't know where to start","A company filling out or renewing a cyber insurance questionnaire","Leadership that wants to know whether current safeguards hold up under Law 25","A supplier whose client is asking for proof of sound security practices",{},true,"diagnostic",[282,285,288,291,294],{"title":283,"text":284},"Scoping","A call to understand your business, your systems and your obligations. You then receive a fixed-price quote before committing to anything.",{"title":286,"text":287},"Information gathering","Interviews with leadership and whoever handles IT, a review of your documentation and technical checks, remotely or on site.",{"title":289,"text":290},"Analysis","We compare what we observe with recognized best practices and rank each finding by the real risk it poses to your business.",{"title":292,"text":293},"Report and walkthrough","We deliver the report and walk you through it, so every recommendation is understood and actionable.",{"title":295,"text":296},"Follow-up","You fix things with your own team, your IT provider or with us. We stay available to answer your questions.","---\ntitle: \"Cybersecurity Audit for SMBs in Montréal and Québec\"\nnavTitle: \"Cybersecurity Audit\"\ndescription: \"A cybersecurity audit built for Quebec SMBs: accounts, email, backups, network and Law 25 safeguards, with a plain-language report and a prioritized plan.\"\ntranslationKey: audit\norder: 1\nicon: audit\nprice: diagnostic\ntagline: \"Find out where your business really stands, and get a clear, prioritized plan to fix what matters most.\"\ndeliverables:\n  - \"A plain-language audit report, with an executive summary written for leadership\"\n  - \"Findings ranked by business risk and by the effort needed to fix them\"\n  - \"A prioritized roadmap: quick wins, medium-term projects and items to budget for\"\n  - \"An overview of your security safeguards against Quebec Law 25 requirements\"\n  - \"A list of the items that weigh most on a cyber insurance questionnaire\"\n  - \"A results walkthrough with your team and your IT provider\"\nprocess:\n  - title: \"Scoping\"\n    text: \"A call to understand your business, your systems and your obligations. You then receive a fixed-price quote before committing to anything.\"\n  - title: \"Information gathering\"\n    text: \"Interviews with leadership and whoever handles IT, a review of your documentation and technical checks, remotely or on site.\"\n  - title: \"Analysis\"\n    text: \"We compare what we observe with recognized best practices and rank each finding by the real risk it poses to your business.\"\n  - title: \"Report and walkthrough\"\n    text: \"We deliver the report and walk you through it, so every recommendation is understood and actionable.\"\n  - title: \"Follow-up\"\n    text: \"You fix things with your own team, your IT provider or with us. We stay available to answer your questions.\"\nidealFor:\n  - \"A small business that has never had its security assessed and doesn't know where to start\"\n  - \"A company filling out or renewing a cyber insurance questionnaire\"\n  - \"Leadership that wants to know whether current safeguards hold up under Law 25\"\n  - \"A supplier whose client is asking for proof of sound security practices\"\nfaq:\n  - q: \"How long does a cybersecurity audit take?\"\n    a: \"It depends on the number of employees, locations and systems. For a typical small business, expect a few weeks between the scoping call and the report walkthrough. The exact timeline is set out in the quote.\"\n  - q: \"Will the audit disrupt our staff or operations?\"\n    a: \"Very little. Technical checks are mostly read-only, and interviews are short and scheduled in advance. We work around your calendar, not the other way around.\"\n  - q: \"How is this different from the free quick audit?\"\n    a: \"The quick audit is a passive, automated scan of what is visible from the internet, paired with a maturity quiz. The full audit goes much further: interviews, a review of your internal configurations, backups and workstations, and a detailed action plan.\"\n  - q: \"Do we need to give you access to our systems?\"\n    a: \"Yes, for the technical portion, usually through a read-only account or with your IT contact present. Access is removed at the end of the engagement and your information is handled confidentially.\"\n---\n\nYou know cybersecurity matters, but you are not sure where your business actually stands. Do your backups really work? Does the employee who left last fall still have access to anything? Would your insurer take your answers at face value? A cybersecurity audit answers these questions with facts instead of guesswork.\n\nOur team looks at both the organization (who decides, who is accountable, what rules exist) and the technology (configurations, accounts, devices, network). The result is a clear picture of what is working, what needs fixing, and in what order.\n\n## What we review\n\n| Area | What we look at |\n|---|---|\n| Governance | Roles and responsibilities, existing policies, asset inventory, oversight of IT vendors |\n| Accounts and access | Multi-factor authentication, admin accounts, employee offboarding, shared passwords |\n| Email security | SPF, DKIM and DMARC, anti-phishing filtering, suspicious forwarding rules |\n| Backups | Actual coverage, offline or immutable copy, real restore tests |\n| Endpoints | Patching, antivirus or EDR, disk encryption, personal devices |\n| Network perimeter | Firewall, remote access (VPN), internet-facing services, guest Wi-Fi |\n| Law 25 | Safeguards for personal information, incident register, incident procedure |\n\nEach area is assessed against recognized best practices, such as the baseline controls recommended by the Canadian Centre for Cyber Security, then scaled to the real size of your business. We won't recommend an enterprise-grade solution for a 15-person office in Laval.\n\nFor a closer look at how an engagement unfolds, read our guide to [cybersecurity audits for small businesses](\u002Fen\u002Fblog\u002Fcybersecurity-audit-small-business-quebec).\n\n## The report you receive\n\nA good report is one that actually gets read. Ours is written in plain English (or French, if your team prefers) and speaks to leadership first.\n\n- **An executive summary**: your overall risk level and your top three to five priorities, in business terms.\n- **Ranked findings**: for each one, the concrete risk (\"a fraudster could pose as your accounts payable team\"), the evidence we observed and the recommended fix.\n- **A roadmap**: quick wins for this month, medium-term projects, and items to plan for in next year's budget.\n- **A technical appendix**: the details your IT provider needs to get to work.\n\n::callout{type=\"info\" title=\"A fixed-price quote, before we start\"}\nAfter the scoping call, you receive a fixed-price quote that spells out the scope, timeline and deliverables. No open-ended hourly billing, no surprises at the end.\n::\n\n## Why small businesses need one\n\nAccording to a 2025 study by insurer Coalition, 77% of Canadian small businesses believe they are too small to be targeted, yet 86% had experienced a cybersecurity event in the last five years. Attackers don't pick victims by size; they look for open doors.\n\nAn audit also helps on three practical fronts:\n\n- **Cyber insurance**: insurers are asking increasingly specific questions about multi-factor authentication, backups and patching. Better to know your answers before you sign.\n- **Law 25**: Quebec's privacy law requires reasonable security measures to protect personal information. The audit documents where you stand.\n- **Your clients**: more and more large customers ask their suppliers for evidence of good security practices.\n\n## Audit, pentest or scan: which one?\n\nAn audit gives you the big picture, covering people and processes as well as technology. A [penetration test](\u002Fen\u002Fservices\u002Fpenetration-testing) simulates a real attack against a specific target. For most small businesses, the audit is the right starting point; a pentest then validates the most critical systems. Our article on [security audits vs. pentests vs. vulnerability scans](\u002Fen\u002Fblog\u002Fsecurity-audit-vs-pentest-vs-vulnerability-scan) breaks down the differences.\n\nWe work remotely or on site anywhere in Quebec, from Montréal to the Eastern Townships and beyond. And if you'd rather ease into it, the free quick audit gives you a first look at your internet exposure, with no commitment.\n",{"title":47,"description":257},"en\u002Fservices\u002Fcybersecurity-audit","Find out where your business really stands, and get a clear, prioritized plan to fix what matters most.","I5dK7bnyVLZV8KTBZpDRtQewLp-kTpUsJ2WPmBvgicI",{"path":303},"\u002Fservices\u002Faudit-cybersecurite",[305,308,311,315,319],{"path":9,"navTitle":10,"tagline":306,"icon":307,"price":307,"order":11},"We attack your systems the way a real adversary would, with your written permission, so you can fix the gaps first.","pentest",{"path":13,"navTitle":14,"tagline":309,"icon":310,"price":310,"order":15},"Your email and files live in the cloud. Let's make sure the right settings are actually protecting your business.","cloud",{"path":17,"navTitle":18,"tagline":312,"icon":313,"price":314,"order":19},"Turn Law 25 from a vague to-do into documented, working practices, starting with the security of your data.","law","loi25",{"path":21,"navTitle":22,"tagline":316,"icon":317,"price":318,"order":23},"Not just an audit: we do the fixes ourselves, at your office in Greater Montréal or remotely.","wrench",null,{"path":25,"navTitle":26,"tagline":320,"icon":321,"price":322,"order":27},"A part-time security lead who knows your business and keeps an eye on your risks, month after month.","partner","vciso",1792972903764]