Most audits end with a list of recommendations. The real work starts after that, and it is often where small businesses get stuck: the IT provider is stretched thin, nobody in-house has the time, or it's simply unclear where to begin.
Our team takes it from there. We apply the fixes, document them and confirm they work. Every engagement is quoted at a fixed price once we have analyzed what needs to be fixed.
Typical projects
Multi-factor authentication
MFA rolled out to every account, starting with administrators, email and remote access. Where possible, we favour phishing-resistant methods such as security keys or authenticator apps with number matching, and we block the legacy protocols that bypass MFA. Our article on choosing the right MFA explains why text messages are no longer enough.
Backups
We apply the 3-2-1-1-0 rule: three copies, on two different types of media, one off site, one offline or immutable, and zero errors in restore tests. That includes your Microsoft 365 or Google Workspace data, which many businesses wrongly assume is backed up automatically. All the details are in our article on the 3-2-1-1-0 backup rule.
Email: SPF, DKIM and DMARC
We inventory everything that sends email on your behalf (newsletters, invoicing, CRM), enable DKIM signing, then move DMARC gradually from monitoring to quarantine to reject, reviewing the reports at each step. Not sure what those acronyms mean? Read SPF, DKIM and DMARC explained.
Patching and endpoints
A patch management process for operating systems, browsers, firewalls and VPNs; disk encryption; removal of local admin rights; antivirus or EDR configuration.
Configuration hardening
Hardening Microsoft 365 or Google Workspace, cleaning up firewall rules, closing exposed services such as Remote Desktop, and separating guest Wi-Fi and admin accounts.
Start with the quick wins
Some fixes take a few hours and cut risk sharply: enforcing MFA for administrators, closing an internet-facing Remote Desktop, creating an offline backup copy. We do those first.
Why a report shouldn't sit on a shelf
An audit report that never gets acted on creates a false sense of security: the gaps are known, but still open. And every month adds new patches to install. A KPMG survey published in 2023 found that more than six in ten Quebec SMBs had been hit by a cyberattack in the previous year.
Insurers no longer settle for good intentions either. At renewal, they want to know whether MFA, offline backups and patch management are actually in place. Remediation lets you answer yes, with evidence to back it up.
How we work
- Vendor-neutral where possible: we start with the security features you already pay for. If a new tool is needed, we present options and you choose.
- Step by step, with a plan B: every change is planned, announced and paired with a way to roll it back.
- Verified, not just applied: we test every fix, ideally with a retest.
- Documented: you keep a clear record of what was done, for your team, your insurer and your next audit.
We work remotely or on site anywhere in Quebec. And if you don't have an assessment yet, a cybersecurity audit will tell you exactly what to fix first.