Blog
Practical guides on SOC 2, PIPEDA, PHIPA, CPCSC, TRA, PIA and everything Canadian companies need to know about compliance.
CPCSC Level 2: What Canadian Defense Suppliers Need to Know
Level 1 is a self-assessment. CPCSC Level 2 adds an accredited outside assessor and 98 controls. Here is what the federal program pages say today, when it reaches contracts, and what to build first.
CPCSC for Subcontractors and Prime Contractors
A prime contractor sent you a CPCSC clause. Here is what the official Level 1 scoping guide says about primes, subcontractors and the service providers behind them, and what it leaves to your contract.
TISAX Certification: What Canadian Auto Suppliers Actually Get
Your customer asked for TISAX certification. Here is what you actually receive, how the assessment levels work, and why the ISA2027 catalog matters to anyone ordering an assessment for 2027.
Is SOC 2 Enough? What the Report Proves and What It Does Not
A SOC 2 report is an auditor's opinion on the controls you put in scope, not proof you are secure. What the report tests, where breaches still happen, and the four protections to run beside it.
Security Questionnaire Automation for Canadian Vendors: What Saves Time
Security questionnaire automation saves time only when every answer points at evidence. How Canadian vendors build an answer library that holds up with buyers.
SOC 2 Type 1 vs Type 2: What Canadian Buyers Accept
A Type 1 says your controls were designed properly on a date. A Type 2 says they actually ran, and the auditor checked. What each report proves, which one federal cloud buyers take, and how a Canadian SOC 2 is performed.
PIPEDA Compliance Checklist for Canadian Companies (2026)
There is no PIPEDA certificate. What the Act actually requires is a privacy management program you can evidence, and a record of every breach of security safeguards, kept for two years. A working checklist for Canadian companies.
CPCSC Level 1 Checklist for Canadian Defence Suppliers (2026)
Level 1 of the Canadian Program for Cyber Security Certification is a self-assessment, not a certificate someone issues you. Here are all 13 controls, what evidence each one asks for, and where the attestation is recorded.
ISO 27001 Checklist for Canadian Companies: What the 2022 Standard Actually Asks For
The controls grid is the wrong place to start. An ISO 27001 checklist in the order the standard actually works, plus the Canadian layer an imported template will not cover.
SOC 1 vs SOC 2 vs SOC 3: The Canadian Buyer's Breakdown
The three SOC reports are not a ranking. SOC 1 covers your customer's financial reporting controls, SOC 2 covers the trust services criteria, and SOC 3 is the publishable summary. Here is how to pick, plus the CSAE wrinkle Canadian companies keep hitting.
SOC 2 Cost Canada: What an Audit Actually Costs in 2026
Nobody publishes a SOC 2 price because the engagement is scoped, not listed. A breakdown of the five lines on a Canadian SOC 2 bill, the four variables that move them, and how to build a number you can defend to finance.
SOC 2 Compliance Checklist Canada: The 2026 Readiness Guide
A step by step SOC 2 compliance checklist for Canadian companies: how to set scope, choose trust services categories, build the evidence auditors test, and handle the PIPEDA overlap before fieldwork starts.
CPCSC Compliance: What Canadian Defence Suppliers Must Do Before the Summer Deadline
CPCSC is becoming a condition of DND contracts. Here is what Level 1 actually requires, why the program exists, and how to be ready before it costs you a contract.
What Is a Vendor Risk Assessment (and Why It Matters)
Your security is only as strong as the vendors you trust with your data. Here's what a vendor risk assessment is, why every framework requires it, and a practical process to run one without drowning in spreadsheets.
How to Prepare for a SOC 2 Audit in 90 Days
A deal is waiting on your SOC 2 report and you have one quarter to get ready. Here's a realistic, week-by-week plan to walk into a Type I audit prepared — and start your Type II clock at the same time.
HIPAA Compliance for Canadian Companies Handling US Health Data
If your Canadian company touches US patient data, HIPAA can apply to you across the border. Here's when you're a Business Associate, what a BAA commits you to, and how to stay compliant — while respecting Canadian privacy law too.
What Is ISO 27001 and Do Canadian Companies Need It?
ISO 27001 is the international gold standard for information security. Here's what it actually is, how it differs from SOC 2, what certification costs and takes, and when a Canadian company should pursue it.
Canadian Data Residency — What It Means and Why It Matters for Your Business
Many Canadian companies don't realize their compliance data, customer information, and sensitive records are sitting on servers in the United States. Here's why that matters legally — and what to do about it.
What Compliance Do I Need to Sell to the Government of Canada?
Winning a federal government contract in Canada requires more than a great product. You need specific security and privacy assessments. Here's exactly what they ask for and how to prepare.
PIPEDA vs GDPR — What Canadian Companies Actually Need to Do
PIPEDA is Canada's federal privacy law. GDPR is Europe's. If your company has Canadian customers, European users, or both — here's what actually applies to you and what you need to do about it.
How to Get SOC 2 Certified in Canada (2026 Guide)
An enterprise customer just asked for your SOC 2 report. Here's exactly what SOC 2 is, how long it takes, what it costs, and how to get it done as a Canadian company — without overpaying.
TRA vs PIA — What's the Difference and When Do You Need Both?
If you're selling to a government agency or hospital in Canada, they'll ask for a TRA and a PIA before signing. Most companies have no idea what these are. Here's a plain-language guide.
What is CPCSC and Does My Canadian Company Need It?
CPCSC is the Government of Canada's cyber security certification program for suppliers. Here is what Level 1 asks for, when it applies, and how Levels 2 and 3 will work, from the government's own pages.