Field notes &
playbooks.

PIPEDA has no 72-hour breach deadline.

The 72-hour breach clock is the GDPR's, not PIPEDA's. Here's the standard Canadian businesses have to meet, and the 24-month record almost nobody keeps.

The IAM rollout order for a 50-person SaaS.

Access control is the first real wall a growing SaaS hits. Here's the order to roll it out, what a SOC 2 review actually asks for, and where a spreadsheet is still genuinely fine.

A vCISO's first 90 days.

Ninety days with a vCISO does not fix security, it buys you a clear-eyed risk map, a plan you can afford, and a few real wins. Here is what those first months should actually look like, and what really happens in them.

Zero Trust without buying anything.

You got told you need Zero Trust and priced it like a product. For most small companies it's a configuration project, not a purchase, and you already own most of the parts.

A security framework developed by the AICPA that defines how service organizations should handle customer data based on five trust service criteria: security, availability, processing integrity, confidentiality, and privacy. Most enterprise buyers require vendors to be SOC 2 compliant.

Type I assesses security controls at a single moment, as a snapshot. Type II evaluates controls over a period (typically 3–12 months) to verify they operate consistently. Most companies start with Type I and progress to Type II.

The 2022 revision of ISO’s information security management system (ISMS) standard. Widely used outside North America and increasingly required by European and Asian enterprise buyers. Includes 93 controls across 4 themes.

Released in 2024, NIST CSF 2.0 is the updated U.S. National Institute of Standards and Technology cybersecurity framework. Adds the Govern function to the original five (Identify, Protect, Detect, Respond, Recover) and covers 106 subcategories.

Canada’s federal privacy law governing how private-sector organizations collect, use, and disclose personal information during commercial activities. Applies to every business operating in Canada. Requires consent, safeguards, and breach notification.

A security model that assumes no user or device is trusted by default, regardless of whether they’re inside the network perimeter. Every access request is verified, authenticated, and authorized. Often summarized as "never trust, always verify."

Who has legal power over your data, and whose courts can order it handed over. Data residency is only where the data is physically stored. The two differ: a Canadian region run by a US-headquartered provider keeps the data in Canada but leaves it reachable by US legal process.

The discipline of managing digital identities (users, service accounts, machine identities) and controlling their access to systems and data. Core practices include SSO, MFA, RBAC, PAM, and periodic access reviews.

A security mechanism requiring two or more verification factors to access a resource. Factors fall into three categories: something you know (password), something you have (phone, token), something you are (biometric). MFA is the single highest-ROI control for most organizations.

A vulnerability assessment scans for known weaknesses and produces a prioritized list. A penetration test attempts to actively exploit weaknesses to determine real-world impact. Pen tests are slower and more expensive but reveal chained attack paths that VAs miss.