Service · retained, monthly
Senior security judgement without the hire
Most Canadian organisations under a few hundred people cannot justify a full-time chief information security officer and do not need one. What they need is someone accountable: a named person who owns the risk register, keeps the controls and policies honest, answers the security questionnaires customers send, and writes the quarterly report the board actually reads. That is what this is.
Who this is for
Organisations of roughly thirty to three hundred people with something to protect and nobody whose job it is: a growing professional-services firm, a software company whose enterprise customers now send a forty-page questionnaire, a not-for-profit holding sensitive data, a supplier to a federally regulated institution being asked to evidence its own controls.
You have an IT provider. What you do not have is anyone who decides what the IT provider should be doing, or who can tell the board whether it is enough.
What we own
The register, the control set and the decisions about what to fix first.
- A risk register that is maintained, reviewed and reported — not written once for an auditor
- Controls mapped to our published control set, with the evidence for each one held and dated
- Policies kept current with the law: PIPEDA, Quebec's Law 25, provincial privacy statutes, and your sector's rules
- Supplier and AI vendor reviews as they arise, and a register of what is deployed
What happens before, during and after a bad day.
- An incident-response plan that names real people, exercised at least annually
- First call in an incident, and the judgement on whether a breach poses a real risk of significant harm — which is the test that starts everything else
- The security questionnaires, due-diligence packs and insurer applications your customers and brokers send
- Direction to your IT provider on what to do and in what order, and a check that it was done
The part that is usually missing.
- A one-page quarterly report: position against the controls, the decisions only the board can take, what changed
- Attendance at the board or audit committee quarterly, in person or online
- Minute-ready wording, so the board's oversight is recorded rather than assumed
- An annual statement of where you stand, for insurers, customers and regulators
The independence rule, and what it means here
A retained CISO advises you and helps you fix things. That is the job. It also means we cannot then assess your organisation and tell the world it passed, because we would be marking our own work.
If you need an independent assessment, or a certification, while we hold this role, we get you ready for it and introduce a firm that has never advised you to do the assessing. We do not take a referral fee for the introduction. We say this before you sign because it matters more than anything else on this page.
What this looks like in practice
The education software company that kept getting the same 180 questions
A 45-person SaaS company selling to Ontario school boards and municipalities.
Why it mattered now. Ontario’s Bill 194 gave school boards and municipalities mandatory privacy impact assessments and breach notification from July 2025, with cyber and AI requirements set by regulation. Public bodies pass those duties to their suppliers through contracts and questionnaires.
What we found.
- Eleven earlier questionnaire answers contradicted each other, and three described controls that did not exist.
- Nobody was named to decide when an incident became a breach, so a school board’s notification timeline could not have been met.
What the board received. One evidenced answer set, the missing controls in place, and a quarterly board report. After six months a new questionnaire took two days instead of two weeks.
“The questionnaires stopped being a threat to the sale and started being a reason to buy.”
This is an illustrative composite based on typical engagements, not a named client. Source: Dentons, Ontario Bill 194 in force.
What it costs
A named senior person, a defined number of days each month agreed in the scoping letter, the quarterly board report, and first call in an incident.
From CAD $3,500 per month
Plus applicable taxes. Six-month minimum term. The fee depends on the days per month and the state you start in; it is fixed for the term and reviewed at renewal.
Cyber on call gives you the same named person on a block of hours with no monthly commitment — for the questionnaire, the investor's diligence pack, or the contract clause you do not like the look of.
From CAD $2,500
Ten hours, valid six months; CAD $4,500 for twenty. No retainer, no minimum term.
What actually happens, and when
First conversation
No charge. What you hold, who is asking you for evidence, what your IT provider does and does not do, and whether a retainer is the right shape at all — sometimes a bounded piece of work is.
Within a week
A scoping letter with the monthly fee, the days per month, the named person, what is in scope, and the independence rule in writing.
Month one, and your effort
A baseline: where you stand against the control set, the risk register started, the incident plan checked for real names. Allow about a day of your leadership's time across that month.
Months two to six
The priority fixes directed and checked, the policies brought current, the questionnaires answered as they arrive, and the first quarterly report to the board.
Quarterly
The one-page report and attendance at the board. What changed, what is next, and the decisions only the board can take.
Renewal
At six months we review the scope together. Many organisations reduce the days once the baseline is done. Everything we produced stays yours whether or not you continue.
There is no charge for the first conversation and no obligation at the end of it. If a retainer is the wrong shape for you, we will say so.