Articles

Bill C-8 received Royal Assent on June 16, 2026, turning a three-year cybersecurity fight through two separate Parliaments into a live legal regime for Canada’s critical infrastructure. It gives Ottawa new authority to compel action from telecom providers and creates mandatory cybersecurity obligations, with penalties of up to $15 million per day for operators in […]

The CIS Critical Security Controls are a prioritized, 18-control blueprint for cyber defense, maintained by a nonprofit and free for any organization to use. They started as a grassroots effort in 2008 to study real-world attacks and turn that knowledge into a practical to-do list for defenders. They’ve since become one of the most widely […]

CMMC certification and CPCSC are the two acronyms you’re likely aware of if your company sells in both the Canadian and American defence markets. They share the same technical DNA, but they’re not identical. In this article, we’ll explain what CMMC actually requires, how its levels compare directly to CPCSC’s, and how to figure out […]

CPCSC determines whether your company is eligible to compete for Department of National Defence contracts, or to subcontract with a company that does. Despite being announced recently, parts of it are already live. Companies that ignore it are likely to lose contracts they’ve held for years without seeing it coming. Announced on April 14, 2026 […]

Bill C-36 was introduced on June 15, 2026 by Canada’s Minister of Artificial Intelligence and Digital Innovation. This is an overhaul of Canada’s federal private-sector privacy law in over two decades. If passed, it would replace the privacy provisions of PIPEDA, create a more powerful regulator, and raise penalties substantially, bringing Canada closer to the […]

Organizations are subject to PIPEDA Canada requirements if they collect, use, or disclose personal information in Canada, or handle the data of Canadians from abroad.  Passed in 2000, the PIPEDA law remains the country’s main federal privacy law for the private sector. Non-compliance often results in investigations, court-ordered remedies, and fines. In this article, we’ll […]

In April 2026, Canadian Finance Minister François-Philippe Champagne told the BBC that Claude Mythos 5, a new AI model, had earned a seat at the table of every finance minister at the International Monetary Fund. He said the risk posed by Anthropic’s new model was “the unknown, unknown.” Three months later, that uncertainty became a […]

Scope is the most expensive decision in PCI DSS — and the one most teams make by accident. Here’s how to shrink it, segment it, and prove it the way auditors actually want. Ask any QSA where PCI assessments go sideways, and they’ll tell you the same thing: scope. Not the fancy controls — scope. […]

Twelve requirements, one payment platform, and a version of PCI DSS that finally wants proof you actually do this stuff — every day, not just audit week. If you run a Canadian fintech, PCI DSS has a way of showing up uninvited. You add a card-on-file feature, or a partner bank asks for your Attestation […]

Kill the screenshots. Automate the proof. Make audits boring again. Every compliance program has a dirty little secret, and it usually lives in a shared drive named something like Audit_Evidence_FINAL_v3. Inside: hundreds of screenshots, a dozen spreadsheets, and a quiet prayer that nobody asks when, exactly, any of it was captured. If that hits a […]

Five frameworks. One security program. A lot less duplicated work than you have been told. If you are reading this, there is a good chance two or three auditors are circling at the same time. One customer wants SOC 2. A buyer in Europe asks about ISO 27001. The payments roadmap drags in PCI DSS, […]

Compliance is expensive. Most companies already know that. But what many founders, CFOs, security leaders, and MSP owners still do not fully understand is where the money actually goes. When a company starts preparing for SOC 2, ISO 27001, PCI DSS, HIPAA, or another security framework, the first quote can be a shock. Consultants charge […]