Service · evidence-based, dated
A report you can hand to a customer, an insurer or your board
An evidence-based review against a defined set of thirty-six controls, producing a dated report that says where you stand, what was tested, what was not, and what to fix first. It is not an accredited certification and we say so on the front page. It is what you need when someone asks for more than your own word — and when you want to know the answer before they do.
Who this is for
Organisations that need to show a third party — a large customer running supplier due diligence, an insurer at renewal, a regulator, a funder, an acquirer — that their security and privacy controls have been looked at by someone with no stake in the answer.
It suits organisations that do not yet want the cost of ISO 27001 or SOC 2 but need more than a self-assessment questionnaire, and organisations that hold a certificate and want to know whether the controls behind it still work. It is also the honest starting point for a board that suspects it does not know where the organisation stands. The report answers that in one page, with the detail behind it for the people who have to act.
What we actually do
Each control is tested against what can be produced, not what is described.
- Documents dated and read, not listed
- Configurations and reports seen, sampled where the population is large
- People asked to show us, not tell us
- Where evidence could not be obtained, the report says so rather than assuming
Thirty-six controls, published in full, mapped to the things people ask you about.
- ISO 27001:2022 Annex A and SOC 2 trust services criteria, so the findings carry across
- PIPEDA and the provincial statutes, including Quebec's Law 25 and its automated decision duties
- The Canadian Centre for Cyber Security's baseline controls, for the technical layer
- AI deployment and supplier oversight, which the older frameworks miss
Three documents, all dated.
- The full report: each control, the evidence seen, the rating, and the finding
- A one-page board report: position, the decisions the board must take, what to fix first
- A statement of scope and limitations you can hand to a third party without editing
- A re-check of the priority findings within six months, included
What this is not
It is not ISO 27001, SOC 2 or CyberSecure Canada, and it does not produce a certificate or a mark. We are not an accredited certification body and we do not pretend to be one. If you need a recognised mark — because a contract names it — we tell you which one, get you ready for it, and introduce a body that has never advised you. We do not take a referral fee for the introduction.
It is also not a penetration test. We look at whether controls exist and operate; a penetration test looks at whether they can be beaten. The two answer different questions and many organisations do both. Testing is available through our accredited partner, whom we name before you sign.
The rule that makes it worth anything. We do not assess an organisation we have advised. If we designed your controls or wrote your policies, someone else assesses them. It costs us work, and it is the reason a third party has any reason to read the report.
What this looks like in practice
The defence supplier whose self-assessment said “yes” a little too often
A 120-person Ontario precision machining firm, asked by its prime contractor for CPCSC Level 1 confirmation.
Why it mattered now. CPCSC Level 1 asks defence suppliers to self-assess 13 requirements based on ITSP.10.171 every year, and it has appeared in select defence contracts since summer 2026. The IT provider had marked all 13 as met in an afternoon, and would also be the one fixing anything that was not.
What we found.
- Nine of 13 requirements were met with evidence; three were partly met and one was not.
- Multi-factor authentication covered email but not the remote access tool the CNC equipment vendor used to reach the machine network.
- Two former employees still had active accounts on the server holding customer drawings.
What the board received. A dated report the chief executive could sign against, with four fixes small enough to close in weeks and a head start on Level 2, due from spring 2027.
“A self-assessment is only as good as the evidence behind it. Ours now has some.”
This is an illustrative composite based on typical engagements, not a named client. Source: PSPC, CPCSC Level 1.
What it costs
All thirty-six controls, one legal entity, one main site, up to roughly two hundred and fifty people. The figure in the scoping letter is the figure you pay.
Typically CAD $6,000–CAD $9,000
Plus applicable taxes, priced on scope. Larger organisations, multiple sites or entities, and Canadian groups with a Bermuda or overseas subsidiary are priced on scope. Where a customer's questionnaire or an insurer's form defines the scope, we assess against that and say so in the report.
The free self-assessment takes about five minutes and gives you a first position against the same thinking, with a recommendation for each gap.
Free
No account, no email address, and nothing you answer leaves your browser. The full control set is published, so you can see exactly what is being asked before you engage us.
What actually happens, and when
First conversation
No charge. Who is asking, what they are asking for, and whether we have advised you before — if we have, we tell you now and introduce someone else.
Within a week
A scoping letter with the fixed fee, the entities and sites in scope, and the evidence request: a list of what we will ask to see, so nothing is a surprise.
Your effort
Allow one to two days of your team's time across the engagement: gathering evidence, one day with us on site or online, and the walkthrough.
Two to three weeks
We test each control against the evidence produced and the things we are shown. Anything serious is reported the same day rather than saved for the report.
Walkthrough
An hour with the people who will act on the findings, and twenty minutes with the board or its chair if wanted. All three documents are issued that day.
Afterwards
The findings are yours. We do not fix them. Within six months we re-test the priority findings and issue a dated update, included in the fee.
Allow four to six weeks from first conversation to walkthrough. Timings assume evidence arrives reasonably promptly; if it does not, we will tell you what is holding it up rather than quietly slipping.
There is no charge for the first conversation and no obligation at the end of it. If a recognised certification is what you actually need, we will say so and point you to it. The full control set is published, so you can see what is being asked before you decide.