56 safeguards. Every client.
We implement CIS Controls v8 Implementation Group 1, all 56 safeguards, for every managed client. Documented evidence and cyber insurance preparation included, with quarterly assessments on the Complete plan.
Compliance that’s implemented, not aspirational.
We implement compliance as a standard, not an upsell. Every managed client gets the full CIS Controls v8 IG1 framework. No add-ons, no premium tier.
All 56 foundational safeguards are in place.
CIS Controls are a prioritized set of cybersecurity best practices published by the Center for Internet Security, a non-profit trusted by governments and businesses worldwide. Implementation Group 1 is the foundational tier: 56 safeguards that address the most common techniques attackers use against businesses. It is not a watered-down framework. It is the baseline every business should meet, and we implement it in full for every managed client, backed by continuous monitoring and threat detection to track control effectiveness in real time.
A practical standard, measured properly.
CIS Controls are an open framework, not a certification. There is no third-party audit or accreditation process the way there is with ISO 27001 or SOC 2. We adopt IG1 as our security baseline because it is the most practical, evidence-based standard available for small and medium businesses. What makes it meaningful is not a stamp on a certificate. It is the disciplined implementation, documented evidence, and continuous measurement that we apply to every safeguard.
Every safeguard has evidence behind it.
Implementation without evidence is just a claim. For every safeguard we implement, we maintain documented evidence: configuration screenshots, policy documents, test results, and audit trails. When your cyber insurance provider asks if you enforce multi-factor authentication (MFA) on all accounts, the answer comes with the policy that enforces it, the compliance report, and the exceptions log.
On Complete, your posture is reviewed every quarter.
Quarterly risk assessments track your posture over time. We review control effectiveness, identify gaps introduced by environment changes, and update remediation priorities. Each assessment builds on the last, creating a documented security improvement trajectory that insurance underwriters and auditors value.
Insurance answers you can back up.
Cyber insurance questionnaires have become the de facto compliance audit for SMBs. We prepare your applications with verified, evidence-backed answers rather than guesses or hopeful responses, and we give you the documented evidence behind each answer. For what insurers usually ask, see cyber insurance and security requirements.
56 safeguards. Eight areas of protection.
CIS Controls v8 Implementation Group 1 covers the threats that affect small and medium businesses every day. Each category maps to real attack techniques used in ransomware, phishing, and credential theft. We implement all of them.
Every device and app is accounted for.
Asset inventory. Every device and application on your network is identified and tracked. Unrecognized hardware or software is flagged for review. You cannot protect what you do not know exists.
Your data is encrypted, backed up and tested.
Data protection and recovery. Sensitive data is encrypted in transit, backed up on schedule, and verified as recoverable. Devices that are retired or reassigned are wiped to documented standards. This is your safety net against ransomware and hardware failure.
Systems are hardened before they go live.
Secure configuration. Systems are hardened before deployment. Default passwords are changed, unnecessary features are disabled, and configurations follow a documented baseline rather than ad hoc setup.
Everyone has only the access they need.
Access management. Every user gets their own account with only the access their role requires. Shared accounts are eliminated. When someone changes roles or leaves, access is adjusted or revoked the same day.
Known security holes are closed on schedule.
Vulnerability management. Operating systems and applications are patched on a documented schedule. Known security holes are closed promptly, which shortens the window attackers have to use them. When patches cannot be applied immediately, the risk is assessed and tracked.
Phishing is filtered before it reaches staff.
Email and web protection. Malicious attachments, phishing links, and spoofed messages are filtered before reaching your team.
Every computer is centrally protected.
Malware defence. Every endpoint runs centrally managed security software that monitors behaviour patterns, not just known virus signatures. Human analysts review every alert, and confirmed threats are contained automatically.
Important activity is logged and kept.
Audit logging. Logins, failed access attempts, permission changes, and access to sensitive resources are logged and retained. If something goes wrong, there is a documented trail to investigate, not guesswork.
What’s included in compliance management.
Initial assessment of your environment against all 56 safeguards, prioritized remediation plan, and phased control deployment with evidence collected at every step.
Quarterly reviews on the Complete plan, tracking control effectiveness, gap identification, and remediation priorities.
Evidence-backed questionnaire responses prepared from your actual security posture. We give you the documented evidence behind each answer.
Acceptable use, incident response, data handling, and access management policies documented and maintained.
Monthly and quarterly reports showing safeguard implementation status, posture trends, and remediation progress.
Privacy controls for Canadian businesses handling personal information. Backups are stored in Canada only, which supports your PIPEDA and BC PIPA obligations.
Frequently asked questions.
CIS Controls v8 are a prioritized set of cybersecurity best practices developed by the Center for Internet Security. Implementation Group 1 (IG1) includes 56 specific safeguards designed for small and medium businesses. Cyber insurance underwriters increasingly reference CIS Controls when assessing your policy, and a documented record of these controls helps show the reasonable steps you took to protect your systems if a breach happens. We implement all 56 IG1 controls for every managed client.
Cyber insurance questionnaires typically ask about multi-factor authentication enforcement, endpoint protection, backup practices, access controls, and incident response plans. We maintain documentation of all controls we implement and can provide evidence packages showing your current compliance posture. When renewal season arrives, we help you answer technical questionnaires accurately and provide supporting documentation to your broker.
PIPEDA requires Canadian businesses to protect personal information through appropriate security safeguards, obtain meaningful consent for data collection, and report breaches that pose a real risk of significant harm. In BC, the Personal Information Protection Act (PIPA) adds provincial requirements. We help you implement the technical controls, including encryption, access management, audit logging, and breach detection, that support your obligations under both laws. Backups we manage are stored in Canada only, which supports your PIPEDA and BC PIPA obligations. For legal advice on what applies to your organization, talk to your lawyer or privacy advisor.
We maintain a compliance evidence library for each managed client that includes CIS Controls implementation status, security configuration baselines, backup verification logs, access review records, and incident response documentation. This evidence is available on demand for auditors, insurance underwriters, or regulatory inquiries.
How compliant are you, really?
Book a call. We’ll assess your current posture against CIS Controls and show you exactly where the gaps are.