For small and mid-sized businesses and organizations with up to 2,000 employees: simulated phishing emails, training suited to each role and a report on the results.
One component trains your employees. The other leaves you with written evidence.
The recurring part. We take care of it, month after month.
The deliverable. Quebec law requires reasonable security measures (s. 10), and staff awareness is one of them. We document it, date by date.
This component does not cover your other obligations, and we do not provide legal advice. We tell you so on the first call.
We identify where the human risk lies in your organization.
We set up the platform and the campaigns. On your side: the employee list, and your IT team allowlisting our simulation emails.
Campaigns, training and adjustments, month after month.
A report documenting your staff's training, to add to your records.
Yes. Before the first campaign, you pass on to them a notice that we provide: what is recorded, who has access to it, where the data is kept and how to exercise their rights. The simulations themselves are not announced one by one; otherwise they would not measure anything.
A little. Your IT team needs to allowlist our simulation emails in your email system, otherwise your filters block them. We provide the instructions and stay available.
On our vendor partner's platform. The hosting region is confirmed to you in writing before anything is signed. If the data leaves Quebec, the law requires a privacy impact assessment and a written agreement (s. 17): we provide the technical information you need.
No, not on its own. Quebec law requires reasonable security measures (s. 10): staff awareness is one of them, among the examples given by the Commission d'accès à l'information, and our report documents it. The Act also requires, among other things, a published person in charge of the protection of personal information, published policies, a register of confidentiality incidents and, in some cases, privacy impact assessments.
The same measure is relevant elsewhere: PIPEDA requires staff awareness in the rest of Canada (Principle 4.7.4), the GDPR requires appropriate measures in Europe (Art. 32), the NIST CSF 2.0 calls for cybersecurity awareness in the United States (PR.AT), and the PCI DSS standard requires a formal program wherever payment cards are involved (Requirement 12.6.1). The report is delivered in French or English.
Email us, and we will reply with available times for a 20-minute call.