Cybersecurity & ISO/IEC 27001 readiness
We find and close security gaps in the websites, servers and office IT of small and mid-sized businesses: audit, penetration test, post-breach clean-up, hardening, and preparation for ISO/IEC 27001 and CyberSecure Canada. You get a plain-language report, the fixes and a re-test.
- Sections
- 5
- Tags
- Security audit · Pentest · ISO/IEC 27001 · CyberSecure Canada
What’s included in cybersecurity & ISO/IEC 27001 readiness
- Audit: a written report — what we found, how serious it is, what to fix today, this month or later — plus a short plain-language version for the owner
- Pentest: a report with reproducible findings and evidence, a remediation plan, and a re-test of the fixes within the same scope at no extra charge
- After a breach: the site or server is clean, the way in is closed, passwords and keys are rotated, the backup is proven by a restore; a report on how they got in, what was affected and what was done
- Hardening: a completed checklist of measures, a tested restore from backup, MFA switched on, alerts configured
- ISO/IEC 27001 and CyberSecure Canada: a document set (policies, risk register, SoA), an internal audit, and a list of what remains before the certification audit
Sub-services
Standard process
We do the work and hand you the result. The team relies on its own experience and strong tooling to find problems faster; every finding is checked by a person before it reaches your report, and we fix what we find.
Frequently asked questions
With a security audit of your website and servers. It shows what is visible from outside and sorts the findings into fix today, fix this month, and later. The report tells you which questions you can already answer “yes” to honestly, and what has to be closed first.
Once the system owner signs a scope letter: the targets, the dates, the contacts and the systems that must stay untouched. Testing starts only after that signature.
Yes, on the security side. Payment and e-money institutions in the EU work under the EBA Guidelines on ICT and security risk management, and since 17 January 2025 also under DORA. We prepare the policies, the risk register and the technical measures; the licence application itself runs through our licensing practice.
No. An independent accredited certification body issues it after its audit. We prepare the company for that audit: the ISMS documents, the risk register, the Statement of Applicability (SoA), an internal audit and the technical fixes.
We do, or we work alongside your contractor. After the fixes we re-test and confirm that each finding is closed.
A fixed quote once the scope is agreed: how many websites, applications, servers and offices are in the work.
Related practice areas
Start with one line about your task
One line is enough. A partner reads it and replies in writing within 24 hours.
- A partner replies in writing within 24 hours
- A written quote follows your request
- Nothing is paid before you accept the quote