Three modules · English and French Canadian · available today
A policy says what you believe. A runbook says what to do on Tuesday.
Most small organisations have the policy and not the procedure. When something happens, somebody senior improvises under pressure, and the record of what was decided is a set of text messages. These modules are the other half: the steps, in order, with the person who owns each one, the evidence it leaves behind, and the Canadian obligations already written in — the two retention clocks, the OPC and CAI routes, and section 12.1 of Law 25.
Incident response
What to do in the first hour, and the five incidents a Canadian small organisation actually gets. Written to be followed by whoever is in the building, not by a security team you do not have.
- The first hour — what to do, what to stop doing, and what to write down while you still remember it.
- A notification decision tree on its own tear-out page, carrying the federal real-risk-of-significant-harm test and Quebec’s serious-injury test side by side, with both retention clocks — 24 months federally, five years in Quebec.
- Ransomware — including the questions to settle before anyone discusses paying.
- Business email compromise, which is the one you are most likely to get and the one most often mistaken for a finance error.
- A lost or stolen device, and how the answer changes depending on what was on it.
- Data sent to the wrong person — the incident nobody reports because it feels too small.
- A supplier’s breach becoming yours, and what you are obliged to do about somebody else’s failure.
- A contact block to fill in before you need it, because looking up a regulator’s number at 7am is not a plan.
CAD $165
Buy the incident response module — $165Secure checkout by Stripe · files emailed within one working day
Everyday security operations
The six routine tasks that fail quietly, and turn up later as an audit finding, a breach, or a client question you cannot answer. None of them are difficult. All of them are skipped.
- Joiners, movers and leavers — almost every access problem an auditor finds started here, months earlier, when somebody took the short route.
- The access review, written so it asks about people rather than systems, which is the difference between a review and a formality.
- Patching and updates, with an exceptions route, because a rule with no exceptions route is broken the first time somebody needs one.
- Backups and a restore test people actually run. An untested backup is a belief, not a control.
- Vendor onboarding and offboarding — including the access that survives the contract.
- Log and alert review, sized for an organisation with no security team.
- An owner and a frequency for each, and a one-page annual check: six questions, answered with evidence rather than memory.
CAD $165
Buy the operations module — $165Secure checkout by Stripe · files emailed within one working day
AI use and oversight
Most AI policies are written about the technology. The obligations are not about the technology — they are about decisions taken about people, and about where data goes. This module is organised around the moments where something can actually go wrong.
- Approving a new tool — what data goes into it, whether the vendor trains on it, and where the processing happens. Free tiers especially, because they carry the weakest terms and arrive without anyone deciding.
- What staff may put into one, written in examples rather than data categories, because nobody classifies data correctly under time pressure.
- Reviewing a deployment before it goes live: not whether it is accurate, but who is harmed when it is wrong and whether anybody would notice.
- The automated decision inventory that section 12.1 of Law 25 requires. It attaches to decisions made by automated means and never mentions AI — so a scoring rule in a spreadsheet counts, and those are the ones nobody lists.
- A model or vendor change, because the version you approved is not necessarily the version running today.
- When it gets something consequential wrong — correcting the person first, then finding out why.
- Six questions for a board, twice a year, with the revealing bad answers named.
CAD $165
Buy the AI oversight module — $165Secure checkout by Stripe · files emailed within one working day
All three modules
Eighteen procedures, the notification decision tree, the owner-and-frequency tables and the annual and twice-yearly checks. Every module in English and French Canadian, both included, at no extra cost.
- PDF to print, pin up and hand to somebody, and Word to edit — put your own names, numbers, tools and thresholds in.
- One organisation, unlimited internal use, no renewal. Yours permanently.
- The Canadian half is already done. Both retention clocks, the OPC and CAI routes, when the Canadian Centre for Cyber Security should hear from you, and CPCSC where defence supply applies.
- If a module could be sold unchanged to a firm in Manchester or Denver, it is not finished and it is not worth paying for. These could not.
- Saves $100 against buying the three separately.
CAD $395
Buy all three modules — $395Secure checkout by Stripe · files emailed within one working day
Before you buy anything
Read one of them free, in full
The first-hour incident checklist is published complete on this site and costs nothing — read the whole thing in English or in French, right now, without giving us your email address. It is the most useful single page we could give a Canadian small business, and it is a fair sample of the writing in all three modules.
If that is not the standard of work you want, do not buy a module.
Runbooks go stale in a way policies do not
A policy says what you believe and survives for years. A runbook names tools, thresholds, roles and regulator contact routes, and it is wrong the moment any of those change. Revisions are free for twelve months, as with everything we sell.
After that, a refreshed module is $65, any time, at any age — so nobody is left holding a procedure that looks current and is not.
If you are already buying the documentation packs
The full pack and all three modules — $1,650
The Core ISMS pack gives you the documents a management system requires. The runbooks give you the procedures that make the system real rather than filed. Bought together, $1,650 — $195 less than separately.
Tell us on the enquiry form and we will send one invoice.
Which one do you need first?
If you have no management system and no immediate audit, start with a runbook module: it is $165 and it changes what happens next week. If you have an audit, a client questionnaire or a certification date, start with the pack — the runbooks will not answer a Statement of Applicability.
If you are not sure, ask. We will tell you which is the smaller purchase, including when that is neither.
Where the line falls
Buying a runbook does not stop us assessing you. Buying a documentation pack does.
We do not carry out an independent assessment of a management system built on documents we sold you. That rule is the only reason our findings are worth anything, and we are not trading it for a sale. But a runbook is a procedure, not a management system — so buying one leaves us free to assess you, and buying a full pack does not. The distinction is written into the licence terms rather than decided later when it happens to suit us.
And the obvious one, said plainly: these are a starting point for your own legal and professional advice, not a substitute for it. The thresholds and notification routes are stated as we understand them and as at the date on the file. Where a decision is close, take advice — the runbook tells you when that moment has arrived, which is most of the value.
How to buy
Buy any module above and the files reach you by email within one working day, in both languages, PDF and Word. No account to create, no subscription, and we will not add you to anything. If you would rather be invoiced, or you want all three with a documentation pack, tell us and we will send an invoice instead.