Field notes &
playbooks.
Practitioner writing on cybersecurity, compliance, and the operational reality of running security programs. New articles by email: subscribe.
Does your data have to stay in Canada?
For most Canadian businesses, no law says the data has to stay in Canada. Here's what PIPEDA and Quebec's Law 25 require instead, where residency is a real rule, and where the demand usually comes from.
PIPEDA has no 72-hour breach deadline.
The 72-hour breach clock is the GDPR's, not PIPEDA's. Here's the standard Canadian businesses have to meet, and the 24-month record almost nobody keeps.
The IAM rollout order for a 50-person SaaS.
Access control is the first real wall a growing SaaS hits. Here's the order to roll it out, what a SOC 2 review actually asks for, and where a spreadsheet is still genuinely fine.
A vCISO's first 90 days.
Ninety days with a vCISO does not fix security, it buys you a clear-eyed risk map, a plan you can afford, and a few real wins. Here is what those first months should actually look like, and what really happens in them.
Zero Trust without buying anything.
You got told you need Zero Trust and priced it like a product. For most small companies it's a configuration project, not a purchase, and you already own most of the parts.
PIPEDA vs Law 25: what Canadian small businesses actually have to do.
Someone said the words "Law 25" and now there's a knot in your stomach. What PIPEDA and Quebec's Law 25 actually require about moving your data, in plain English, minus the legalese and the panic.
AI compliance without sending your data to the cloud.
Almost every 'AI-powered' compliance tool reads your documents by shipping them to a model in someone else's cloud. For compliance evidence, that's the one place it shouldn't go. Here's why local inference changes the math, and how to check where your data actually ends up.
Why we keep recommending self-hosted.
Everything is SaaS now, so why do we build our compliance tools to run on your own infrastructure? Because for compliance data, residency isn't sovereignty, and a vendor's badge doesn't change whose government can reach your data.
How Long Does SOC 2 Take? A Realistic Timeline
A Type 1 takes three to six months and a Type 2 six to twelve. This walks through each phase and why no tool shrinks the part that takes time.
NIST CSF 2.0: what changed and why it matters.
NIST CSF 2.0 added a sixth function called Govern. Here's what changed from 1.1, why it matters, and whether you need to redo your assessment.
How we write here.
A short explainer on what to expect from MALTO Cyber field notes: plain language, written by practitioners who do the work.