Cybersecurity leadership for mid-market companies in Ontario and Quebec

---

Know in three weeks where you stand, what could stop the business, and what your insurer will ask for.

Call us when:

• A cyber insurance renewal or questionnaire is on your desk
• Your board asks whether the company is exposed
• A peer or a supplier was just attacked

You get:

• Your current profile on NIST CSF 2.0, including the new Govern function
• A check against the controls insurers now expect: multifactor authentication, endpoint detection, tested backups, privileged access, patching, incident plan
• Your top ten risks, each with an owner
• A 90-day action plan and a two-page board summary

Duration and format: 3 weeks. Remote, with one half day on site.

Built on: NIST CSF 2.0 (2024); CIS Controls v8.1 (2024); Canadian Centre for Cyber Security readiness goals (2024).

Fee: per diem rate; number of days agreed in writing before work starts.

Your executive team makes the hard decisions once in rehearsal, not for the first time during an attack.

Call us when:

• Nobody has rehearsed who decides to pay, to notify or to shut down
• Your incident plan has never been tested
• Your insurer or a customer asks for evidence of readiness

You get:

• A scenario built on your own operations: plants, billing, field teams
• A half-day exercise with your executive team
• Decision rights written down: pay or not, notify, communicate, restore
• An after-action report and an updated incident response plan and ransomware playbook

Duration and format: 4 weeks, including a half-day session. Preparation remote, exercise on site or online.

Built on: NIST SP 800-61 Rev. 3 (2025); Canadian Centre for Cyber Security ransomware guidance.

Fee: per diem rate; number of days agreed in writing before work starts.

A three-year roadmap and budget your board approves, and a way to show progress every quarter.

Call us when:

• Security spending grows but nobody can say what it buys
• An audit, a customer or a regulator asks for a framework
• You are preparing next year's budget

You get:

• Current and target profiles on NIST CSF 2.0, with the CIS Controls v8.1 gap
• A risk register and a risk appetite written in business terms
• A costed three-year roadmap, capital and operating
• A policy framework and five board metrics to report every quarter
• A board presentation

Duration and format: 8 weeks. Remote, with workshops on site.

Built on: NIST CSF 2.0 (2024); CIS Controls v8.1 (2024); NACD Director's Handbook on Cyber-Risk Oversight (2026).

Fee: per diem rate; number of days agreed in writing before work starts.

A named senior security leader who answers to your board, without a full-time executive salary.

Call us when:

• You have no security leader, or your IT manager carries security alone
• Customers and insurers ask questions nobody has time to answer
• You need someone to own the roadmap after the plan

You get:

• The security roadmap and risk register owned and kept current
• A quarterly report to the board
• Insurer and customer questionnaires answered
• Oversight of your managed service provider and Microsoft 365 security
• A yearly tabletop exercise and a named person to call during an incident

Duration and format: 12 months, a set number of days each month, in three levels.

Built on: NIST CSF 2.0 (2024); NACD Director's Handbook on Cyber-Risk Oversight (2026).

Fee: per diem rate, for a number of days each month agreed in writing.