Insights
Guidance on the questions that come up most often, written for owners and operations managers rather than for engineers.
PHIPA sets out specific circumstances that make reporting to the Information and Privacy Commissioner mandatory, plus an annual filing most clinics do not know about.
Read the note: When an Ontario clinic must report a privacy breach
The shared responsibility model puts availability on Microsoft and your data on you. Most Ontario businesses we assess have no third party backup of mail, SharePoint or OneDrive.
Read the note: Microsoft does not back up your Microsoft 365 data
A short read on what the federal privacy law expects from a commercial organisation, and the breach reporting obligation that catches people out.
Renewal questionnaires have become technical. Answering optimistically can void the policy at claim time, so here is what the questions mean.
Read the note: What a cyber insurance questionnaire actually asks for
Ontario organisations above certain thresholds have website accessibility obligations. Overlay widgets do not discharge them.
The comparison is rarely like for like. Here is the arithmetic and the coverage question that usually settles it.
Read the note: Managed provider or internal hire: how to decide
Gmail, Yahoo and Microsoft now enforce authentication on bulk senders. Here is the sequence that gets you to reject without losing legitimate mail.
Read the note: Getting to DMARC enforcement without breaking your mail
