Representative Engagements

Challenge

Council sought assurance after peer municipalities suffered ransomware incidents. There was no security policy framework, no assigned executive accountability and no reporting to council.

Approach

• Fractional vCISO engagement with monthly council reporting
• NIST CSF 2.0 maturity baseline and risk register
• Policy framework aligned to MFIPPA obligations
• Incident response plan and executive tabletop exercise

Target outcomes

• Clear executive accountability and governance charter
• Prioritized 24-month roadmap linked to budget cycles
• Recurring cyber risk dashboard for council
• Tested incident response capability

Challenge

Faculty and administrative units were adopting generative AI tools with no policy, procurement guardrails or privacy review, creating academic-integrity and data-protection concerns.

Approach

• AI readiness and risk assessment across academic and administrative units
• Responsible AI policy and acceptable use standard
• AI tool intake and risk-tiering process aligned to NIST AI RMF
• Leadership and faculty awareness sessions

Target outcomes

• Approved institution-wide AI policy
• Repeatable AI tool approval workflow
• Privacy impact assessment template for AI use cases
• Shared vocabulary across leadership, faculty and IT

Challenge

Enterprise prospects required SOC 2 assurance and detailed security questionnaires. Controls existed informally but were undocumented and untested.

Approach

• SOC 2 Trust Services Criteria gap assessment
• Control design, policies and evidence-collection procedures
• Vendor risk management program
• Auditor selection support and readiness review

Target outcomes

• Documented control environment ready for audit
• Faster, consistent responses to customer security questionnaires
• Third-party risk process covering critical vendors
• Security positioned as a sales enabler

Challenge

A distributed workforce, personal devices and limited budget left donor and beneficiary data exposed, while funders began asking for evidence of security controls.

Approach

• Risk-based assessment focused on highest-value data
• Microsoft 365 security hardening and MFA rollout plan
• Practical policy set suited to a lean team
• Multilingual security awareness program

Target outcomes

• Foundational controls prioritized within existing budget
• Evidence pack to satisfy funder due diligence
• Reduced phishing susceptibility through training
• Board-level visibility of cyber risk

Challenge

Leadership could not answer how long production would be down after a ransomware event. Backups were untested and continuity plans did not reflect current systems.

Approach

• Business impact analysis and RTO/RPO definition with operations leaders
• Backup architecture review with immutable-copy design
• Disaster recovery runbooks validated in the lab
• Crisis management tabletop with executive team

Target outcomes

• Business-approved recovery objectives
• Tested restoration procedures for critical systems
• Updated continuity and crisis communications plan
• Evidence to support cyber insurance renewal

Challenge

A planned data-centre exit lacked a cloud governance model, security baseline and clear data-residency decisions, putting timelines and compliance at risk.

Approach

• Cloud strategy and landing-zone governance model
• Security baseline (CIS Benchmarks) and identity design
• Data classification and residency decision framework
• Migration wave planning and vendor oversight

Target outcomes

• Approved cloud governance and security baseline
• Data-residency decisions documented for each workload
• Risk-aware migration sequence
• Internal team upskilled for ongoing operations