[{"data":1,"prerenderedAt":258},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"svc-\u002Fen\u002Fservices\u002Fremediation-hardening":45,"svc-alt-\u002Fen\u002Fservices\u002Fremediation-hardening":237,"svc-others-\u002Fen\u002Fservices\u002Fremediation-hardening":239},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":46,"title":47,"body":48,"deliverables":184,"description":191,"extension":192,"faq":193,"icon":206,"idealFor":207,"meta":212,"navTitle":22,"navigation":213,"order":23,"path":21,"price":214,"process":215,"rawbody":231,"seo":232,"stem":233,"tagline":234,"translationKey":235,"__hash__":236},"services_en\u002Fen\u002Fservices\u002Fremediation-hardening.md","Security Remediation and Hardening for SMBs",{"type":49,"value":50,"toc":172},"minimark",[51,55,58,63,68,77,81,89,93,100,104,107,111,114,122,126,129,132,136,165],[52,53,54],"p",{},"Most audits end with a list of recommendations. The real work starts after that, and it is often where small businesses get stuck: the IT provider is stretched thin, nobody in-house has the time, or it's simply unclear where to begin.",[52,56,57],{},"Our team takes it from there. We apply the fixes, document them and confirm they work. Every engagement is quoted at a fixed price once we have analyzed what needs to be fixed.",[59,60,62],"h2",{"id":61},"typical-projects","Typical projects",[64,65,67],"h3",{"id":66},"multi-factor-authentication","Multi-factor authentication",[52,69,70,71,76],{},"MFA rolled out to every account, starting with administrators, email and remote access. Where possible, we favour phishing-resistant methods such as security keys or authenticator apps with number matching, and we block the legacy protocols that bypass MFA. Our article on ",[72,73,75],"a",{"href":74},"\u002Fen\u002Fblog\u002Fmulti-factor-authentication-choosing-mfa","choosing the right MFA"," explains why text messages are no longer enough.",[64,78,80],{"id":79},"backups","Backups",[52,82,83,84,88],{},"We apply the 3-2-1-1-0 rule: three copies, on two different types of media, one off site, one offline or immutable, and zero errors in restore tests. That includes your Microsoft 365 or Google Workspace data, which many businesses wrongly assume is backed up automatically. All the details are in our article on ",[72,85,87],{"href":86},"\u002Fen\u002Fblog\u002F3-2-1-1-0-backup-rule-ransomware","the 3-2-1-1-0 backup rule",".",[64,90,92],{"id":91},"email-spf-dkim-and-dmarc","Email: SPF, DKIM and DMARC",[52,94,95,96,88],{},"We inventory everything that sends email on your behalf (newsletters, invoicing, CRM), enable DKIM signing, then move DMARC gradually from monitoring to quarantine to reject, reviewing the reports at each step. Not sure what those acronyms mean? Read ",[72,97,99],{"href":98},"\u002Fen\u002Fblog\u002Fspf-dkim-dmarc-explained","SPF, DKIM and DMARC explained",[64,101,103],{"id":102},"patching-and-endpoints","Patching and endpoints",[52,105,106],{},"A patch management process for operating systems, browsers, firewalls and VPNs; disk encryption; removal of local admin rights; antivirus or EDR configuration.",[64,108,110],{"id":109},"configuration-hardening","Configuration hardening",[52,112,113],{},"Hardening Microsoft 365 or Google Workspace, cleaning up firewall rules, closing exposed services such as Remote Desktop, and separating guest Wi-Fi and admin accounts.",[115,116,119],"callout",{"title":117,"type":118},"Start with the quick wins","tip",[52,120,121],{},"Some fixes take a few hours and cut risk sharply: enforcing MFA for administrators, closing an internet-facing Remote Desktop, creating an offline backup copy. We do those first.",[59,123,125],{"id":124},"why-a-report-shouldnt-sit-on-a-shelf","Why a report shouldn't sit on a shelf",[52,127,128],{},"An audit report that never gets acted on creates a false sense of security: the gaps are known, but still open. And every month adds new patches to install. A KPMG survey published in 2023 found that more than six in ten Quebec SMBs had been hit by a cyberattack in the previous year.",[52,130,131],{},"Insurers no longer settle for good intentions either. At renewal, they want to know whether MFA, offline backups and patch management are actually in place. Remediation lets you answer yes, with evidence to back it up.",[59,133,135],{"id":134},"how-we-work","How we work",[137,138,139,147,153,159],"ul",{},[140,141,142,146],"li",{},[143,144,145],"strong",{},"Vendor-neutral where possible",": we start with the security features you already pay for. If a new tool is needed, we present options and you choose.",[140,148,149,152],{},[143,150,151],{},"Step by step, with a plan B",": every change is planned, announced and paired with a way to roll it back.",[140,154,155,158],{},[143,156,157],{},"Verified, not just applied",": we test every fix, ideally with a retest.",[140,160,161,164],{},[143,162,163],{},"Documented",": you keep a clear record of what was done, for your team, your insurer and your next audit.",[52,166,167,168,171],{},"We work remotely or on site anywhere in Quebec. And if you don't have an assessment yet, a ",[72,169,170],{"href":5},"cybersecurity audit"," will tell you exactly what to fix first.",{"title":173,"searchDepth":11,"depth":15,"links":174},"",[175,182,183],{"id":61,"depth":11,"text":62,"children":176},[177,178,179,180,181],{"id":66,"depth":15,"text":67},{"id":79,"depth":15,"text":80},{"id":91,"depth":15,"text":92},{"id":102,"depth":15,"text":103},{"id":109,"depth":15,"text":110},{"id":124,"depth":11,"text":125},{"id":134,"depth":11,"text":135},[185,186,187,188,189,190],"A detailed work plan and fixed-price quote, built from your audit report","Fixes applied and documented: what, where, when, and how to roll back","An MFA rollout with a simple how-to guide for your staff","Reconfigured backups and a documented restore test","A closing report that proves the safeguards are in place, useful for your insurer","Knowledge transfer to your team or your IT provider","We do the fixes ourselves, at your office or remotely: MFA, backups, DMARC, Microsoft 365, workstations. With or without an audit, at a fixed price.","md",[194,197,200,203],{"q":195,"a":196},"Do you work directly at our office?","Yes. In Greater Montréal, we come and do the work on-site: MFA, backups, Wi-Fi, workstations, Microsoft 365. The rest is done remotely, anywhere in Québec. The price is set before we start.",{"q":198,"a":199},"Can you work with our current IT provider?","Yes, and that is often the best arrangement. We can do the work ourselves, split it with your provider or simply guide them. The goal is to get your systems fixed, not to replace anyone.",{"q":201,"a":202},"Do we need to have done an audit with you first?","No. We can start from a report produced by another firm, an insurance questionnaire or a specific problem. If no assessment exists, we begin with a short review so we're not fixing things blindly.",{"q":204,"a":205},"Will the work disrupt our employees?","Some changes, like MFA, require a small adjustment from staff. We announce them in advance, provide a simple guide and schedule sensitive changes outside business hours.","wrench",[208,209,210,211],"An SMB that received an audit or pentest report but lacks the resources to act on it","A company whose insurer requires MFA, offline backups or EDR before renewal","An organization whose IT provider handles day-to-day support but not security projects","A business that wants to move DMARC to a reject policy without blocking its own email",{},true,null,[216,219,222,225,228],{"title":217,"text":218},"Prioritization","We start from your audit report, ours or a third party's, and pick the fixes that reduce risk the most.",{"title":220,"text":221},"Quote","You receive a fixed-price quote with the exact list of tasks, the timeline and the expected impact on your staff.",{"title":223,"text":224},"Implementation","We roll out changes in stages, outside peak hours when needed, with a rollback plan for each one.",{"title":226,"text":227},"Validation","Every fix is verified: is the gap really closed? Can your people still work normally?",{"title":229,"text":230},"Documentation","You receive documentation of every change and proof that the safeguards are in place.","---\ntitle: \"Security Remediation and Hardening for SMBs\"\nnavTitle: \"Remediation and Hardening\"\ndescription: \"We do the fixes ourselves, at your office or remotely: MFA, backups, DMARC, Microsoft 365, workstations. With or without an audit, at a fixed price.\"\ntranslationKey: remediation\norder: 5\nicon: wrench\ntagline: \"Not just an audit: we do the fixes ourselves, at your office in Greater Montréal or remotely.\"\ndeliverables:\n  - \"A detailed work plan and fixed-price quote, built from your audit report\"\n  - \"Fixes applied and documented: what, where, when, and how to roll back\"\n  - \"An MFA rollout with a simple how-to guide for your staff\"\n  - \"Reconfigured backups and a documented restore test\"\n  - \"A closing report that proves the safeguards are in place, useful for your insurer\"\n  - \"Knowledge transfer to your team or your IT provider\"\nprocess:\n  - title: \"Prioritization\"\n    text: \"We start from your audit report, ours or a third party's, and pick the fixes that reduce risk the most.\"\n  - title: \"Quote\"\n    text: \"You receive a fixed-price quote with the exact list of tasks, the timeline and the expected impact on your staff.\"\n  - title: \"Implementation\"\n    text: \"We roll out changes in stages, outside peak hours when needed, with a rollback plan for each one.\"\n  - title: \"Validation\"\n    text: \"Every fix is verified: is the gap really closed? Can your people still work normally?\"\n  - title: \"Documentation\"\n    text: \"You receive documentation of every change and proof that the safeguards are in place.\"\nidealFor:\n  - \"An SMB that received an audit or pentest report but lacks the resources to act on it\"\n  - \"A company whose insurer requires MFA, offline backups or EDR before renewal\"\n  - \"An organization whose IT provider handles day-to-day support but not security projects\"\n  - \"A business that wants to move DMARC to a reject policy without blocking its own email\"\nfaq:\n  - q: \"Do you work directly at our office?\"\n    a: \"Yes. In Greater Montréal, we come and do the work on-site: MFA, backups, Wi-Fi, workstations, Microsoft 365. The rest is done remotely, anywhere in Québec. The price is set before we start.\"\n  - q: \"Can you work with our current IT provider?\"\n    a: \"Yes, and that is often the best arrangement. We can do the work ourselves, split it with your provider or simply guide them. The goal is to get your systems fixed, not to replace anyone.\"\n  - q: \"Do we need to have done an audit with you first?\"\n    a: \"No. We can start from a report produced by another firm, an insurance questionnaire or a specific problem. If no assessment exists, we begin with a short review so we're not fixing things blindly.\"\n  - q: \"Will the work disrupt our employees?\"\n    a: \"Some changes, like MFA, require a small adjustment from staff. We announce them in advance, provide a simple guide and schedule sensitive changes outside business hours.\"\n---\n\nMost audits end with a list of recommendations. The real work starts after that, and it is often where small businesses get stuck: the IT provider is stretched thin, nobody in-house has the time, or it's simply unclear where to begin.\n\nOur team takes it from there. We apply the fixes, document them and confirm they work. Every engagement is quoted at a fixed price once we have analyzed what needs to be fixed.\n\n## Typical projects\n\n### Multi-factor authentication\n\nMFA rolled out to every account, starting with administrators, email and remote access. Where possible, we favour phishing-resistant methods such as security keys or authenticator apps with number matching, and we block the legacy protocols that bypass MFA. Our article on [choosing the right MFA](\u002Fen\u002Fblog\u002Fmulti-factor-authentication-choosing-mfa) explains why text messages are no longer enough.\n\n### Backups\n\nWe apply the 3-2-1-1-0 rule: three copies, on two different types of media, one off site, one offline or immutable, and zero errors in restore tests. That includes your Microsoft 365 or Google Workspace data, which many businesses wrongly assume is backed up automatically. All the details are in our article on [the 3-2-1-1-0 backup rule](\u002Fen\u002Fblog\u002F3-2-1-1-0-backup-rule-ransomware).\n\n### Email: SPF, DKIM and DMARC\n\nWe inventory everything that sends email on your behalf (newsletters, invoicing, CRM), enable DKIM signing, then move DMARC gradually from monitoring to quarantine to reject, reviewing the reports at each step. Not sure what those acronyms mean? Read [SPF, DKIM and DMARC explained](\u002Fen\u002Fblog\u002Fspf-dkim-dmarc-explained).\n\n### Patching and endpoints\n\nA patch management process for operating systems, browsers, firewalls and VPNs; disk encryption; removal of local admin rights; antivirus or EDR configuration.\n\n### Configuration hardening\n\nHardening Microsoft 365 or Google Workspace, cleaning up firewall rules, closing exposed services such as Remote Desktop, and separating guest Wi-Fi and admin accounts.\n\n::callout{type=\"tip\" title=\"Start with the quick wins\"}\nSome fixes take a few hours and cut risk sharply: enforcing MFA for administrators, closing an internet-facing Remote Desktop, creating an offline backup copy. We do those first.\n::\n\n## Why a report shouldn't sit on a shelf\n\nAn audit report that never gets acted on creates a false sense of security: the gaps are known, but still open. And every month adds new patches to install. A KPMG survey published in 2023 found that more than six in ten Quebec SMBs had been hit by a cyberattack in the previous year.\n\nInsurers no longer settle for good intentions either. At renewal, they want to know whether MFA, offline backups and patch management are actually in place. Remediation lets you answer yes, with evidence to back it up.\n\n## How we work\n\n- **Vendor-neutral where possible**: we start with the security features you already pay for. If a new tool is needed, we present options and you choose.\n- **Step by step, with a plan B**: every change is planned, announced and paired with a way to roll it back.\n- **Verified, not just applied**: we test every fix, ideally with a retest.\n- **Documented**: you keep a clear record of what was done, for your team, your insurer and your next audit.\n\nWe work remotely or on site anywhere in Quebec. And if you don't have an assessment yet, a [cybersecurity audit](\u002Fen\u002Fservices\u002Fcybersecurity-audit) will tell you exactly what to fix first.\n",{"title":47,"description":191},"en\u002Fservices\u002Fremediation-hardening","Not just an audit: we do the fixes ourselves, at your office in Greater Montréal or remotely.","remediation","9Q319gItJqgT-mcdgXQ-ng2uhA-kmT9xWqEGTFljiq0",{"path":238},"\u002Fservices\u002Fremediation-durcissement",[240,244,247,250,254],{"path":5,"navTitle":6,"tagline":241,"icon":242,"price":243,"order":7},"Find out where your business really stands, and get a clear, prioritized plan to fix what matters most.","audit","diagnostic",{"path":9,"navTitle":10,"tagline":245,"icon":246,"price":246,"order":11},"We attack your systems the way a real adversary would, with your written permission, so you can fix the gaps first.","pentest",{"path":13,"navTitle":14,"tagline":248,"icon":249,"price":249,"order":15},"Your email and files live in the cloud. Let's make sure the right settings are actually protecting your business.","cloud",{"path":17,"navTitle":18,"tagline":251,"icon":252,"price":253,"order":19},"Turn Law 25 from a vague to-do into documented, working practices, starting with the security of your data.","law","loi25",{"path":25,"navTitle":26,"tagline":255,"icon":256,"price":257,"order":27},"A part-time security lead who knows your business and keeps an eye on your risks, month after month.","partner","vciso",1792972903797]