Compliance frameworks we cover

CPCSC

What it is

The Canadian Program for Cyber Security Certification (CPCSC) is the Government of Canada's cyber security certification program for defence suppliers. Its controls come from ITSP.10.171, a standard published by the Canadian Centre for Cyber Security. The program has three levels:

• Level 1: an annual self-assessment covering 13 controls. Level 1 launched in April 2026.
• Level 2: an external assessment led by an accredited certification body, plus an annual affirmation, covering 98 controls.
• Level 3: an assessment conducted by National Defence, plus an annual affirmation.

As of the program page's update of September 29, 2026, Levels 2 and 3 are still under development.

Who it concerns

Suppliers on Canadian defence contracts that include a CPCSC requirement. The level that applies to you is stated in the contract documents, so start there.

How firms help

We direct you to firms that help you prepare for the level in your contract. We do not certify anyone.

Source: Canadian Program for Cyber Security Certification: program overview (canada.ca)

Get up to 3 quotes

SOC 2

What it is

A SOC 2 report is an attestation report on the controls of a service organization relevant to security, availability, processing integrity, confidentiality or privacy. The examination follows AICPA standards and the report is issued by a CPA firm.

Who it concerns

Service organizations, typically SaaS and technology vendors, whose customers or prospects ask for independent assurance on how their systems and data are protected.

How firms help

Firms can help with readiness before the examination. Only a licensed CPA firm can issue the attestation report; we do not issue SOC 2 reports.

Source: System and Organization Controls (SOC) suite of services (AICPA & CIMA)

Get up to 3 quotes

ISO 27001

What it is

ISO/IEC 27001:2022 sets the requirements for an information security management system (ISMS): how an organization establishes, implements, maintains and continually improves the way it manages information security risks.

Who it concerns

Organizations of any size and in any sector, often at the request of customers or partners who want evidence that information security is managed systematically.

How firms help

Certification is optional. A certificate is issued by a certification body; one from an accredited conformity assessment body adds confidence, because an accreditation body has independently confirmed that body's competence. Firms can help with the gap analysis, the implementation and readiness for certification.

Source: ISO/IEC 27001:2022 (iso.org)

Get up to 3 quotes

PCI DSS

What it is

The Payment Card Industry Data Security Standard (PCI DSS), maintained by the PCI Security Standards Council, sets a baseline of technical and operational requirements to protect payment account data.

Who it concerns

Any entity that stores, processes or transmits cardholder data or sensitive authentication data, or that could affect the security of the cardholder data environment: merchants, processors, acquirers, issuers and service providers.

How firms help

Whether and how you must validate compliance, for example through a self-assessment questionnaire or an assessment by a Qualified Security Assessor (QSA), is decided by your payment brands or your acquirer. Firms can help you scope your environment and prepare.

Source: PCI Data Security Standard (PCI Security Standards Council)

Get up to 3 quotes

ISO 42001

What it is

ISO/IEC 42001:2023 sets the requirements for an artificial intelligence management system (AIMS): how an organization governs the AI it develops, provides or uses, and manages the risks and opportunities that come with it.

Who it concerns

Organizations of any size, in any industry, that develop, provide or use AI-based products or services, including public sector bodies and non-profits.

How firms help

Firms can help you assess your AI practices against the standard and prepare for a certification audit.

Source: ISO/IEC 42001:2023 (iso.org)

Get up to 3 quotes

CASL

What it is

Canada's anti-spam legislation (CASL, S.C. 2010, c. 23) regulates commercial electronic messages, such as marketing emails and text messages, along with practices like installing computer programs without consent.

Who it concerns

Businesses and organizations that send commercial electronic messages. A core obligation is to obtain consent before sending them.

How firms help

Firms can review your consent records, sign-up forms and sending practices.

Sources: Canada's Anti-Spam Legislation, S.C. 2010, c. 23 (Justice Laws); Canada's anti-spam legislation (Innovation, Science and Economic Development Canada)

Get up to 3 quotes

Quebec Law 25

What it is

Law 25 (2021, c. 25) modernized Quebec's Act respecting the protection of personal information in the private sector. Under section 1, the Act sets rules for personal information that a person collects, holds, uses or communicates to third persons in the course of carrying on an enterprise.

Who it concerns

Organizations that handle personal information of people in Quebec. If yours is based outside Quebec, whether and how the Act applies depends on your situation: a firm can help you assess it.

How firms help

Firms can help you map the personal information you hold, assess your obligations and put the required measures in place.

Source: Act respecting the protection of personal information in the private sector, CQLR c. P-39.1 (LégisQuébec)

Get up to 3 quotes