For owners, not boards · current at 9 September 2026
Nobody here does security, and something has just been asked of you
Most of this site is written for boards. This page is not. It is for the owner or manager of a Canadian business with no security team, no budget for one, and a customer questionnaire, an insurance renewal or a bank form sitting in an inbox with a date on it.
You do not need a consultant to start. Nearly everything below costs nothing, requires no sign-up, and is complete rather than a teaser. If you work through it and decide you do not need us, that is a good outcome and we will not chase you.
Why it landed on you
Three things send this to small Canadian businesses, and none of them are technical
A customer will not sign until the questionnaire comes back clean
Larger organisations pass their own obligations down the supply chain by contract. You are being asked to evidence controls because your customer has been asked to evidence theirs. This reaches you long before any law does.
An insurer prices the renewal on what you can show
Cyber-insurance applications ask questions of fact. Under Canadian law a material misrepresentation can void a policy from inception, and it does not have to be deliberate. The form is usually filled in from memory by somebody who will not be the person asked to prove the answers later.
The law already asks more of you than you think
PIPEDA requires you to keep a record of every privacy breach — including the ones you decided were harmless — for two years, and to produce them for the Privacy Commissioner on request. Most small businesses keep no such record at all. In Quebec, Law 25 adds a confidentiality incident register kept for five years, and a duty to tell people when a decision about them was made exclusively by a machine.
Costs nothing · no sign-up · no call afterwards
Start with the free things
In the order we would do them. None of this is a sales route, and none of it is an extract of something we sell.
Where do you stand?
Ten questions about whether you could show it, not whether you feel secure. Five minutes, no email required, and nothing you answer leaves your browser. You get the gaps back in the order we would fix them.
Things you can take and use today
Complete documents, free to adopt under your own name. Change them, cut what does not apply, put your logo on them.
- Privacy breach response policy — with both retention clocks, federal and Quebec.
- Vendor review policy — for the supplier questions you are now being asked.
- AI acceptable use policy — approved tools, and what must never be pasted into one.
- The first hour — what to do in the sixty minutes after you realise something has happened. Also in français.
- Staff awareness posters — English and French.
- A tabletop exercise you can run yourself — ninety minutes, a printed deck, no system touched. It is the question insurers and auditors both ask.
Work out what actually applies to you
Before you pay anyone to tell you.
- What actually governs AI in Canada — there is no Canadian AI Act, whatever you have been told.
- The AI transparency consultation — closed on 23 September 2026; the response will show where AI rules are heading.
- Before you switch on Copilot — twelve questions, nothing leaves your browser.
- ISO 27001 mapped to Canadian law — if a customer has asked for the standard.
- SOC 2 mapped to ISO 27001 — if an American customer has asked for a SOC 2.
- US state privacy applicability tool — which of the twenty state laws reach you.
- Website privacy scan — what your own site is doing that your privacy notice does not mention.
- Where to watch — six sources, and the board question that goes with each.
See what a piece of work looks like before you buy one
Both are fictional organisations, labelled as illustrative, and complete rather than extracts.
If you do want help
What a business your size actually buys from us
The cyber-insurance renewal evidence review
The one most small businesses should look at first. We check each declaration on your application against the evidence before the form goes in, and give you a one-page sign-off recording what the evidence showed and what was not tested. We do not place insurance and we do not sell the fix.
Book it thirty to sixty days before renewal, while you still have a choice.
CAD $1,450 one application, fixed · What is checked →
When a customer sends you a supplier questionnaire
The documents a large buyer asks a small supplier for before they will sign: supplier code of conduct, forced labour statement, anti-bribery, harassment, health and safety, accessibility. Every legal threshold is checked against the statute, so you can also tell a buyer honestly which obligations do not apply to a business your size.
Most of what you are being asked for, you are not legally required to have. Knowing which is which is the point.
CAD $450 20 documents · What is in it →
The documents, without the consulting
If a customer or an auditor has asked for a management system and you need the writing done, you can buy it and never speak to us. No call, no discovery session, no subscription, and no licence that expires. Four of the documents are published free on this site so you can judge the standard of the work before paying.
You will still need the standard itself, which is copyrighted and comes from ISO or the Standards Council of Canada.
CAD $450 – $1,450 Canadian overlay, or the full 49-document pack · What is in them →
Senior judgement, without the hire
Where the questions keep arriving and there is genuinely nobody to answer them, a virtual CISO gives you someone accountable for the answer. This is the one piece on this page priced for a business with a payroll rather than a project.
If it is more than you need, say so and we will tell you what would do instead.
From CAD $3,500 per month, six-month minimum · How it works →
Being straight about the rest
Most of what we do is priced for organisations with a board, and we are not going to pretend otherwise.
An independent assessment is $6,000. A board session is $4,500. Those are the right numbers for the work and the wrong numbers for a ten-person firm, and we would rather say so on this page than discover it on a call. If that is where you are, the free material above is not a consolation prize — it is the same thinking, written out, and a good many organisations never need more than it.
And the rule that governs everything here applies to you as much as to anyone: where we assess an organisation, we do not also remediate it. If we tell you something is wrong, we have no stake in being the ones who fix it.
If you would rather just ask
Tell us what has been asked of you and who is asking. We will tell you what we think it needs, and whether that is us — including when the answer is that you can do it yourself, or that it does not apply to you at all. The first conversation is free and there is nothing at the end of it.