Blog
Practical guides on SOC 2, PIPEDA, PHIPA, CPCSC, TRA, PIA and everything Canadian companies need to know about compliance.
ISO 27001 Checklist for Canadian Companies: What the 2022 Standard Actually Asks For
The controls grid is the wrong place to start. An ISO 27001 checklist in the order the standard actually works, plus the Canadian layer an imported template will not cover.
SOC 1 vs SOC 2 vs SOC 3: The Canadian Buyer's Breakdown
The three SOC reports are not a ranking. SOC 1 covers your customer's financial reporting controls, SOC 2 covers the trust services criteria, and SOC 3 is the publishable summary. Here is how to pick, plus the CSAE wrinkle Canadian companies keep hitting.
SOC 2 Cost Canada: What an Audit Actually Costs in 2026
Nobody publishes a SOC 2 price because the engagement is scoped, not listed. A breakdown of the five lines on a Canadian SOC 2 bill, the four variables that move them, and how to build a number you can defend to finance.
SOC 2 Compliance Checklist Canada: The 2026 Readiness Guide
A step by step SOC 2 compliance checklist for Canadian companies: how to set scope, choose trust services categories, build the evidence auditors test, and handle the PIPEDA overlap before fieldwork starts.
CPCSC Compliance: What Canadian Defence Suppliers Must Do Before the Summer Deadline
CPCSC compliance is now the gate between Canadian suppliers and DND contracts. Here is what Level 1 actually requires, why the program exists, and how to get certified before it costs you a bid.
What Is a Vendor Risk Assessment (and Why It Matters)
Your security is only as strong as the vendors you trust with your data. Here's what a vendor risk assessment is, why every framework requires it, and a practical process to run one without drowning in spreadsheets.
How to Prepare for a SOC 2 Audit in 90 Days
A deal is waiting on your SOC 2 report and you have one quarter to get ready. Here's a realistic, week-by-week plan to walk into a Type I audit prepared — and start your Type II clock at the same time.
HIPAA Compliance for Canadian Companies Handling US Health Data
If your Canadian company touches US patient data, HIPAA can apply to you across the border. Here's when you're a Business Associate, what a BAA commits you to, and how to stay compliant — while respecting Canadian privacy law too.
What Is ISO 27001 and Do Canadian Companies Need It?
ISO 27001 is the international gold standard for information security. Here's what it actually is, how it differs from SOC 2, what certification costs and takes, and when a Canadian company should pursue it.
Canadian Data Residency — What It Means and Why It Matters for Your Business
Many Canadian companies don't realize their compliance data, customer information, and sensitive records are sitting on servers in the United States. Here's why that matters legally — and what to do about it.
What Compliance Do I Need to Sell to the Government of Canada?
Winning a federal government contract in Canada requires more than a great product. You need specific security and privacy assessments. Here's exactly what they ask for and how to prepare.
PIPEDA vs GDPR — What Canadian Companies Actually Need to Do
PIPEDA is Canada's federal privacy law. GDPR is Europe's. If your company has Canadian customers, European users, or both — here's what actually applies to you and what you need to do about it.
How to Get SOC 2 Certified in Canada (2026 Guide)
An enterprise customer just asked for your SOC 2 report. Here's exactly what SOC 2 is, how long it takes, what it costs, and how to get it done as a Canadian company — without overpaying.
TRA vs PIA — What's the Difference and When Do You Need Both?
If you're selling to a government agency or hospital in Canada, they'll ask for a TRA and a PIA before signing. Most companies have no idea what these are. Here's a plain-language guide.
What is CPCSC and Does My Canadian Company Need It?
CPCSC is Canada's cybersecurity certification program for defence contractors — similar to the US CMMC. If your company works with the Canadian Department of National Defence, here's exactly what you need to know.