[{"data":1,"prerenderedAt":231},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"svc-\u002Fen\u002Fservices\u002Fongoing-security-partner":45,"svc-alt-\u002Fen\u002Fservices\u002Fongoing-security-partner":210,"svc-others-\u002Fen\u002Fservices\u002Fongoing-security-partner":212},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":46,"title":47,"body":48,"deliverables":158,"description":165,"extension":166,"faq":167,"icon":180,"idealFor":181,"meta":186,"navTitle":26,"navigation":187,"order":27,"path":25,"price":188,"process":189,"rawbody":205,"seo":206,"stem":207,"tagline":208,"translationKey":188,"__hash__":209},"services_en\u002Fen\u002Fservices\u002Fongoing-security-partner.md","Virtual CISO and Ongoing Security Partner for SMBs",{"type":49,"value":50,"toc":146},"minimark",[51,55,58,63,68,71,75,84,88,96,100,107,111,114,118,121,124,128,131,139],[52,53,54],"p",{},"Security isn't a project you finish. New people join, new software gets added, vulnerabilities are disclosed every week and fraudsters keep changing tactics. An audit is a snapshot; ongoing support is the full picture over time.",[52,56,57],{},"A KPMG survey published in 2023 found that 65% of Quebec SMBs lack qualified staff to manage cyber risk. Hiring a full-time security manager isn't realistic for most of them. Our team fills that role through a monthly retainer: you get a single point of contact who knows your business, your systems and your obligations, and who tells you where to focus.",[59,60,62],"h2",{"id":61},"whats-included","What's included",[64,65,67],"h3",{"id":66},"monitoring-your-exposure","Monitoring your exposure",[52,69,70],{},"Every quarter, we scan what your business exposes to the internet: open services, certificates, email configuration, newly disclosed vulnerabilities. When an issue is fixed, we retest to confirm it is really closed.",[64,72,74],{"id":73},"policies-and-governance","Policies and governance",[52,76,77,78,83],{},"Short policies, written in plain language and adapted to how you actually work: acceptable use, access management, backups, remote work, incident response. We keep them current as things change. For incident response, we build on our ",[79,80,82],"a",{"href":81},"\u002Fen\u002Fblog\u002Fincident-response-plan-template-small-business","incident response plan template for small businesses",".",[64,85,87],{"id":86},"training-and-phishing-simulations","Training and phishing simulations",[52,89,90,91,95],{},"Short, practical training sessions for your employees, and regular phishing simulations to track progress. Our article on ",[79,92,94],{"href":93},"\u002Fen\u002Fblog\u002Fphishing-simulation-employees","phishing simulations for employees"," explains how these campaigns work.",[64,97,99],{"id":98},"insurance-and-client-questionnaires","Insurance and client questionnaires",[52,101,102,103,83],{},"Cyber insurance questionnaires and client security assessments keep getting more detailed. We help you answer them accurately, and fix first whatever could cause trouble. See our tips on ",[79,104,106],{"href":105},"\u002Fen\u002Fblog\u002Fcyber-insurance-questionnaire-requirements","cyber insurance questionnaire requirements",[64,108,110],{"id":109},"reporting-to-leadership","Reporting to leadership",[52,112,113],{},"Every quarter, a simple dashboard: MFA coverage, patch status, simulation results, open and closed findings. A document you can present as is to your board of directors.",[59,115,117],{"id":116},"why-ongoing-support-beats-a-one-off-audit","Why ongoing support beats a one-off audit",[52,119,120],{},"An audit tells you where you stand on a given date. Six months later, things have changed: a new cloud app, an employee replaced, a firewall rule added \"temporarily.\" Without follow-up, gaps pile up without anyone noticing.",[52,122,123],{},"Time matters too. According to a 2025 CDW study, the time it takes small Canadian organizations to detect an incident grew from 4.0 days in 2024 to 6.8 days in 2025. Regular follow-up shrinks blind spots and helps you react faster.",[59,125,127],{"id":126},"neutral-practical-advice","Neutral, practical advice",[52,129,130],{},"Our recommendations serve your interests, not a product catalogue: we make the most of what you already have, such as the security features built into Microsoft 365 or Google Workspace, and only suggest a new tool when it addresses a real risk.",[132,133,136],"callout",{"title":134,"type":135},"One point of contact","tip",[52,137,138],{},"The same person follows your file from month to month. You don't have to re-explain your business on every call.",[52,140,141,142,145],{},"We work remotely or on site anywhere in Quebec, with deliverables in English or French. If you'd rather start with a one-time assessment, a ",[79,143,144],{"href":5},"cybersecurity audit"," is the natural first step toward ongoing support.",{"title":147,"searchDepth":11,"depth":15,"links":148},"",[149,156,157],{"id":61,"depth":11,"text":62,"children":150},[151,152,153,154,155],{"id":66,"depth":15,"text":67},{"id":73,"depth":15,"text":74},{"id":86,"depth":15,"text":87},{"id":98,"depth":15,"text":99},{"id":109,"depth":15,"text":110},{"id":116,"depth":11,"text":117},{"id":126,"depth":11,"text":127},[159,160,161,162,163,164],"A quarterly external scan of your exposed assets, with retests of fixed issues","Security policies written and kept current: acceptable use, access, backups, incidents","Security awareness training and phishing simulations for your staff","Help completing cyber insurance questionnaires and client security assessments","A quarterly dashboard for leadership and your board of directors","A go-to contact for your security questions","A virtual CISO for your SMB: a monthly retainer covering quarterly scans, policies, awareness training, phishing simulations and insurance questionnaires.","md",[168,171,174,177],{"q":169,"a":170},"What is a vCISO?","A virtual Chief Information Security Officer (vCISO) is a part-time, shared security lead. They play the same role as an in-house CISO, but only for the time your business actually needs.",{"q":172,"a":173},"Do you replace our IT provider?","No. Your provider handles day-to-day operations: workstations, servers, user support. We set security priorities, check that safeguards are in place and give you independent advice.",{"q":175,"a":176},"Can we tailor what the retainer includes?","Yes. The retainer is defined in the quote based on your size and obligations: how often simulations run, how many meetings, how much compliance support. It can be revisited at the annual review.",{"q":178,"a":179},"Are phishing simulations meant to catch employees out?","No. They exist to measure and to teach. Results are reported to leadership in aggregate, and clicking a simulated phishing email leads to a short explanation, not a reprimand.","partner",[182,183,184,185],"An SMB with no one in-house responsible for security","A company whose clients or insurer send security questionnaires every year","Leadership or a board that wants regular oversight and clear metrics","An organization that has completed an audit and wants to make sure progress sticks",{},true,"vciso",[190,193,196,199,202],{"title":191,"text":192},"Baseline","We start from a recent audit, or run one, to establish where you stand and set priorities.",{"title":194,"text":195},"Annual roadmap","Together we agree on a 12-month plan that fits your budget and your obligations.",{"title":197,"text":198},"Monthly check-in","Each month, we review progress, new risks and your team's questions.",{"title":200,"text":201},"Quarterly review","External scan, phishing simulation results and a dashboard presented to leadership.",{"title":203,"text":204},"Annual review","We measure how far you've come and build next year's roadmap.","---\ntitle: \"Virtual CISO and Ongoing Security Partner for SMBs\"\nnavTitle: \"Ongoing Security Partner (vCISO)\"\ndescription: \"A virtual CISO for your SMB: a monthly retainer covering quarterly scans, policies, awareness training, phishing simulations and insurance questionnaires.\"\ntranslationKey: vciso\norder: 6\nicon: partner\nprice: vciso\ntagline: \"A part-time security lead who knows your business and keeps an eye on your risks, month after month.\"\ndeliverables:\n  - \"A quarterly external scan of your exposed assets, with retests of fixed issues\"\n  - \"Security policies written and kept current: acceptable use, access, backups, incidents\"\n  - \"Security awareness training and phishing simulations for your staff\"\n  - \"Help completing cyber insurance questionnaires and client security assessments\"\n  - \"A quarterly dashboard for leadership and your board of directors\"\n  - \"A go-to contact for your security questions\"\nprocess:\n  - title: \"Baseline\"\n    text: \"We start from a recent audit, or run one, to establish where you stand and set priorities.\"\n  - title: \"Annual roadmap\"\n    text: \"Together we agree on a 12-month plan that fits your budget and your obligations.\"\n  - title: \"Monthly check-in\"\n    text: \"Each month, we review progress, new risks and your team's questions.\"\n  - title: \"Quarterly review\"\n    text: \"External scan, phishing simulation results and a dashboard presented to leadership.\"\n  - title: \"Annual review\"\n    text: \"We measure how far you've come and build next year's roadmap.\"\nidealFor:\n  - \"An SMB with no one in-house responsible for security\"\n  - \"A company whose clients or insurer send security questionnaires every year\"\n  - \"Leadership or a board that wants regular oversight and clear metrics\"\n  - \"An organization that has completed an audit and wants to make sure progress sticks\"\nfaq:\n  - q: \"What is a vCISO?\"\n    a: \"A virtual Chief Information Security Officer (vCISO) is a part-time, shared security lead. They play the same role as an in-house CISO, but only for the time your business actually needs.\"\n  - q: \"Do you replace our IT provider?\"\n    a: \"No. Your provider handles day-to-day operations: workstations, servers, user support. We set security priorities, check that safeguards are in place and give you independent advice.\"\n  - q: \"Can we tailor what the retainer includes?\"\n    a: \"Yes. The retainer is defined in the quote based on your size and obligations: how often simulations run, how many meetings, how much compliance support. It can be revisited at the annual review.\"\n  - q: \"Are phishing simulations meant to catch employees out?\"\n    a: \"No. They exist to measure and to teach. Results are reported to leadership in aggregate, and clicking a simulated phishing email leads to a short explanation, not a reprimand.\"\n---\n\nSecurity isn't a project you finish. New people join, new software gets added, vulnerabilities are disclosed every week and fraudsters keep changing tactics. An audit is a snapshot; ongoing support is the full picture over time.\n\nA KPMG survey published in 2023 found that 65% of Quebec SMBs lack qualified staff to manage cyber risk. Hiring a full-time security manager isn't realistic for most of them. Our team fills that role through a monthly retainer: you get a single point of contact who knows your business, your systems and your obligations, and who tells you where to focus.\n\n## What's included\n\n### Monitoring your exposure\n\nEvery quarter, we scan what your business exposes to the internet: open services, certificates, email configuration, newly disclosed vulnerabilities. When an issue is fixed, we retest to confirm it is really closed.\n\n### Policies and governance\n\nShort policies, written in plain language and adapted to how you actually work: acceptable use, access management, backups, remote work, incident response. We keep them current as things change. For incident response, we build on our [incident response plan template for small businesses](\u002Fen\u002Fblog\u002Fincident-response-plan-template-small-business).\n\n### Training and phishing simulations\n\nShort, practical training sessions for your employees, and regular phishing simulations to track progress. Our article on [phishing simulations for employees](\u002Fen\u002Fblog\u002Fphishing-simulation-employees) explains how these campaigns work.\n\n### Insurance and client questionnaires\n\nCyber insurance questionnaires and client security assessments keep getting more detailed. We help you answer them accurately, and fix first whatever could cause trouble. See our tips on [cyber insurance questionnaire requirements](\u002Fen\u002Fblog\u002Fcyber-insurance-questionnaire-requirements).\n\n### Reporting to leadership\n\nEvery quarter, a simple dashboard: MFA coverage, patch status, simulation results, open and closed findings. A document you can present as is to your board of directors.\n\n## Why ongoing support beats a one-off audit\n\nAn audit tells you where you stand on a given date. Six months later, things have changed: a new cloud app, an employee replaced, a firewall rule added \"temporarily.\" Without follow-up, gaps pile up without anyone noticing.\n\nTime matters too. According to a 2025 CDW study, the time it takes small Canadian organizations to detect an incident grew from 4.0 days in 2024 to 6.8 days in 2025. Regular follow-up shrinks blind spots and helps you react faster.\n\n## Neutral, practical advice\n\nOur recommendations serve your interests, not a product catalogue: we make the most of what you already have, such as the security features built into Microsoft 365 or Google Workspace, and only suggest a new tool when it addresses a real risk.\n\n::callout{type=\"tip\" title=\"One point of contact\"}\nThe same person follows your file from month to month. You don't have to re-explain your business on every call.\n::\n\nWe work remotely or on site anywhere in Quebec, with deliverables in English or French. If you'd rather start with a one-time assessment, a [cybersecurity audit](\u002Fen\u002Fservices\u002Fcybersecurity-audit) is the natural first step toward ongoing support.\n",{"title":47,"description":165},"en\u002Fservices\u002Fongoing-security-partner","A part-time security lead who knows your business and keeps an eye on your risks, month after month.","VNEViWIgq352AzzcpHkBdXWDRvBRa7O_f95BYaCrUlU",{"path":211},"\u002Fservices\u002Faccompagnement-continu",[213,217,220,223,227],{"path":5,"navTitle":6,"tagline":214,"icon":215,"price":216,"order":7},"Find out where your business really stands, and get a clear, prioritized plan to fix what matters most.","audit","diagnostic",{"path":9,"navTitle":10,"tagline":218,"icon":219,"price":219,"order":11},"We attack your systems the way a real adversary would, with your written permission, so you can fix the gaps first.","pentest",{"path":13,"navTitle":14,"tagline":221,"icon":222,"price":222,"order":15},"Your email and files live in the cloud. Let's make sure the right settings are actually protecting your business.","cloud",{"path":17,"navTitle":18,"tagline":224,"icon":225,"price":226,"order":19},"Turn Law 25 from a vague to-do into documented, working practices, starting with the security of your data.","law","loi25",{"path":21,"navTitle":22,"tagline":228,"icon":229,"price":230,"order":23},"A report protects no one until the fixes are done. We turn your findings list into action.","wrench",null,1792970120723]