Issue 001 · Spring 2026Toronto · Global
← Resources§ Articles

Field notes &
playbooks.

Practitioner writing on cybersecurity, compliance, and the operational reality of running security programs. One email a month — subscribe.

Guide7 min read

The IAM rollout order for a 50-person SaaS.

Access control is the first real wall a growing SaaS hits. Here's the order to roll it out, what a SOC 2 review actually asks for, and where a spreadsheet is still genuinely fine.

Marcus Tommy
Guide6 min read

A vCISO's first 90 days.

Ninety days with a vCISO does not fix security, it buys you a clear-eyed risk map, a plan you can afford, and a few real wins. Here is what those first months should actually look like, and what really happens in them.

Marcus Tommy
Guide6 min read

Zero Trust without buying anything.

You got told you need Zero Trust and priced it like a product. For most small companies it's a configuration project, not a purchase, and you already own most of the parts.

Marcus Tommy
Guide5 min read

PIPEDA vs Law 25: what Canadian small businesses actually have to do.

Someone said the words "Law 25" and now there's a knot in your stomach. What PIPEDA and Quebec's Law 25 actually require about moving your data, in plain English, minus the legalese and the panic.

Marcus Tommy
Field note6 min read

AI compliance without sending your data to the cloud.

Almost every 'AI-powered' compliance tool reads your documents by shipping them to a model in someone else's cloud. For compliance evidence, that's the one place it shouldn't go. Here's why local inference changes the math, and how to check where your data actually ends up.

Marcus Tommy
Field note7 min read

Why we keep recommending self-hosted.

Everything is SaaS now, so why do we build our compliance tools to run on your own infrastructure? Because for compliance data, residency isn't sovereignty, and a vendor's badge doesn't change whose government can reach your data.

Marcus Tommy
Guide8 min read

The SOC 2 timeline that's actually realistic.

Type 1 in a few months, Type 2 in 6 to 12. Here's the honest SOC 2 timeline, phase by phase, and why no tool shrinks the part that actually takes time.

Marcus Tommy
Field note4 min read

NIST CSF 2.0: what changed and why it matters.

NIST CSF 2.0 added a sixth function called Govern. Here's what changed from 1.1, why it matters, and whether you need to redo your assessment.

Marcus Tommy
Field note1 min read

How we write here.

A short explainer on what to expect from MALTO Cyber field notes — one email a month, plain language, written by practitioners who do the work.

Marcus Tommy