Ottawa, Gatineau, Kingston

Cyber security services in Ottawa, Gatineau and Kingston

Name: Cyber security services in Ottawa, Gatineau and Kingston
Brand: itopsi

We handle cyber security Ottawa-wide, from Centretown and Kanata to Orléans, and across the river in Gatineau, from our base in the city: security checks, email and backup protection, incident response and O. Reg. 51/26 readiness, in English or French. Kingston and Eastern Ontario are served remotely, with any visit agreed in the scope letter.

Ask us to call you back Book the free audit

A three-storey red-brick office building with a glass entrance, orange maple trees in front in autumn, no signs — Most Ottawa work runs remotely; visits are agreed in writing.

A person here calls you back the same business day, usually within an hour.

Written permission first
A report in plain words
Checked again after the fix

Cybersecurity services in Ottawa: what we do here

Ottawa organizations get the full set of our cyber security services, run from our base in the city by INNOVA CONSULT LTD., the federal corporation behind the itopsi brand. Most of the work happens remotely over a connection you approve, and a visit is arranged in writing when hands are needed: a server room, a network closet, or a meeting with your board.

Every engagement starts with a 30-minute conversation and a scope letter that lists what we check, the dates, who we call and what we leave alone. A person calls you back the same business day, usually within an hour, in English or French.

A security audit of your website, servers, email settings and accounts, with findings sorted into today, this month and later
Vulnerability scanning of what you expose to the internet, each finding confirmed by a person
Email security with SPF, DKIM and DMARC, against invoices and messages sent in your name
Backup and disaster recovery proven by a restore, with the date and the time it took written down
Phishing simulation and training, agreed in writing with management
Incident response after a break-in, from closing the way in to a written account of what happened
O. Reg. 51/26 readiness for covered Ontario public sector organizations

Penetration testing and vCISO in Ottawa

Penetration testing for Ottawa organizations and a virtual CISO (vCISO) are available on request. The scope letter names who carries out that work before you sign anything.

Where we work: Ottawa, Gatineau, Kingston and Eastern Ontario

Ottawa and Gatineau form one working area for us, while Kingston and the rest of Eastern Ontario are served remotely first. The table shows how the work usually runs in each place; your scope letter fixes the details for your own office, including any visit dates.

Distance changes less than people expect, because audits, scanning, email changes and backup tests run over an agreed connection. What changes with the address is the law that covers your records, which is why the next section sets the two provinces side by side.

Service area and how the work runs
Area	How the work runs	Language
Centretown, the ByWard Market and the Glebe	Remote work; visits agreed on the callback and confirmed in writing	English or French
Kanata and the west end	Remote work; visits agreed on the callback	English or French
Orléans, Barrhaven and Nepean	Remote work; visits agreed on the callback	English or French
Gatineau and the Outaouais	Remote work; visits planned around the bridges, Quebec law applies	French or English
Kingston and Eastern Ontario	Remote first; any visit agreed in the scope letter	English or French

One working area across the Ottawa River, with the rules that apply on each side.

One river, two sets of rules: Ontario and Quebec

An organization with staff or offices on both sides of the Ottawa River answers to two privacy regimes, and its security work has to satisfy both. An Ottawa business falls under PIPEDA for personal information in its commercial activities, a health practice adds PHIPA, covered public bodies add O. Reg. 51/26, and a Gatineau office falls under Quebec's private sector privacy act as amended by Law 25.

The University of Ottawa Heart Institute is the only organization O. Reg. 51/26 names individually; every other entry is a class of organization.³ Municipalities, the City of Ottawa included, sit outside the regulation and can take the same assessment voluntarily.

We write down which rule covers which records, so an audit report or an incident file holds up on its own on either side of the river. Legal opinions on compliance come from your lawyer; our part is the security measures and the evidence behind them.

The rules that reach Ottawa and Gatineau organizations, security side only
Rule	Who it reaches	Security duty
PIPEDA	Private businesses in Ontario handling personal information in commercial activities	Report breaches of security safeguards that create a real risk of significant harm, notify the people affected, keep a record of every breach¹
PHIPA	Health information custodians in Ontario, from clinics to hospitals	Reasonable steps against theft, loss and unauthorized use; notify patients, and in some cases the Commissioner²
O. Reg. 51/26	School boards, colleges and universities, children's aid societies, the Heart Institute, public hospitals in Groups A, B or C	A senior point of contact, a critical incident report within 72 hours, a maturity assessment within a year of the rules applying, then every two years³
Quebec private sector act, as amended by Law 25	Enterprises holding personal information in Quebec, such as a Gatineau office	A person in charge of personal information, prompt notice to the Commission d'accès à l'information when an incident risks serious injury, a register of confidentiality incidents⁴

Ottawa organizations that usually call us first

The calls we get from the Ottawa region tend to come from organizations that sell to larger ones or hold sensitive records, because their contracts and their rules ask for written proof of how systems are protected.

Firms and associations with government clients

Law and accounting practices, associations and consultancies downtown often receive security questionnaires from the departments and institutions they serve. We answer the technical part with you and say plainly where the honest answer is still "not yet", together with what it takes to change it.

Technology suppliers in Kanata

Engineering and software firms that supply larger companies face supplier reviews of the systems they use every day. A security audit puts the findings and the fixes in your hands before the customer's reviewer sees them.

Clinics and health practices

A clinic holds personal health information under PHIPA, so its backups, its access to records and its email have to stand up if a theft or loss notice is ever needed. The details are on PHIPA security.

Public bodies under O. Reg. 51/26

Ottawa's school boards, colleges, universities and covered hospitals have a year from the date the rules first apply to them to finish their first maturity assessment. Sector pages explain the work for hospitals, school boards and colleges and universities.

Charities and member associations

These organizations keep donor and member records with small teams and volunteers. Email protection and a backup proven by a restore are where most of them start.

How fast someone responds in Ottawa

A person calls you back the same business day, usually within an hour, once you leave your name and number, and an emergency request reaches the person on duty as soon as you send it. Most first steps happen on that call and over a remote connection; when someone needs to be on site in Ottawa or Gatineau, the visit time is agreed on the call and confirmed in writing.

The rest of the timeline depends on the scope: the size of the network, the number of sites, and whether we only report or also fix. The scope letter gives dates you can plan around, and they move only with your agreement.

During an incident, report it to the Canadian Centre for Cyber Security through its online form and contact the Ottawa Police Service, or the Gatineau police for a Quebec office, if it looks criminal, and call 911 if anyone's safety is at risk.⁵ Tell your insurer early as well.

Why a contracted team: the risks of doing it alone, with a chatbot or a freelancer

Around Ottawa, a security mistake often costs a lost contract or a breach notice in two provinces, so the work needs someone who answers for it.

A chatbot gives general advice. It cannot see which of your records fall under Ontario rules and which under Quebec law, and its answers carry no signature an insurer or a client will accept.
A freelancer may fix one machine well; the gap shows later, when a client's reviewer asks for the scope, the insurance and the report.
Doing it in-house works until the one person who knows the setup is away during the incident.
A contracted team works under a signed scope letter, in English or French, from an Ottawa base, with commercial general liability insurance in force and a report that stays with you.

Five plain reasons to trust us with this

A registered Canadian company
INNOVA CONSULT LTD., federal corporation 1522612-1, based in Ottawa. itopsi is its brand.
In practice since 2013
The group behind itopsi has run legal and marketing practices since 2013. Its founder has worked in law and compliance for more than 14 years.
We run servers of our own
Our own servers and more than 80 websites are checked for known vulnerabilities every day.
Insured
Commercial general liability insurance of CAD 1 million is in force.
Your scope, your report
A fixed scope in a signed letter before any work starts. Licences and equipment at cost, with no vendor commission. The report belongs to you.

How the work goes

Five steps, in the same order every time.

Before any test, you sign a scope letter: what we test, on which dates, who to call, and what we must leave alone.

Your signature comes first

Step 1

We agree what to check

A short call, or the form at the foot of this page. Together we decide which website, server or office systems we look at.

Step 2

You sign the scope letter

It sets the targets, the dates, the contacts, and what we must leave alone. Work starts only once it is signed.

Step 3

We check, and write it down

One report in plain words for you, with the technical detail attached for whoever looks after your systems.

Step 4

We fix it

We make the repairs ourselves, or together with your current IT provider or web developer.

Step 5

We check again

A second check confirms that each problem is closed.

What it costs

Each job is a different size, so each one gets a fixed quote once the scope is agreed. You see the price in writing before any work starts.

Ask for a quote →

A fixed quote once the scope is agreed
The price in writing before work starts
A second check after the fixes

Questions

Questions owners ask us

Your question is missing? Leave your number and ask it in your own words.

Ask on a call

Do you work on-site in Ottawa and Gatineau?

Yes, by arrangement. Most security work runs remotely over a connection you approve, which keeps it quick and leaves a record of what was done. When a task needs hands on site, such as a server room, a network closet or a board meeting, we agree the visit on the callback and confirm the time in writing. For a Gatineau address we plan the visit around the bridges.

Can we get service and reports in French?

Yes. Ask for French on the callback and the call, the scope letter, the report and the day-to-day exchanges come in French. Many organizations in Ottawa and Gatineau work in both languages, so tell us who reads the report and we write it for them. This whole section of the site exists in both languages for the same reason.

Do you cover Kingston and Eastern Ontario?

Yes, remotely first. Security audits, vulnerability scanning, email protection, backup testing and O. Reg. 51/26 readiness all run over an agreed connection and video calls, so distance changes little. If a visit to Kingston or elsewhere in Eastern Ontario is needed, it is agreed in the scope letter with the date in writing before anyone travels.

How fast can someone respond in Ottawa?

Leave your name and number and a person calls back the same business day, usually within an hour. If something is happening right now, use the emergency page: the request reaches the person on duty as soon as you send it. Until we call, leave affected machines as they are, wipe nothing, and stay out of contact with the attacker.

A client sent us a security questionnaire. Can you help answer it?

Yes, for the technical part, and we answer it honestly. Where the true answer is that you lack something, the answer says so, together with what it would take to have it. A questionnaire answered with a false yes tends to cost you the client later, at a worse moment. A security audit beforehand gives each answer a written basis.

Do you run security checks and penetration tests for Ottawa businesses?

Security checks, yes: the audit of your website, servers and accounts, vulnerability scanning, clean-up after a break-in and the fixes all run for Ottawa and Gatineau organizations, in English or French. Penetration testing is available on request, and the scope letter names who carries it out. Every test starts with your written permission and a scope letter you sign.

How much do cyber security services cost for an Ottawa organization?

The price depends on the number of sites, servers and accounts in scope, whether we only report or also fix, whether visits are needed, and which rules apply, such as PHIPA or O. Reg. 51/26. After a 30-minute conversation you receive a fixed price in the scope letter. Licences and equipment are billed at cost, with no vendor commission.

Who do we report a cyber incident to in Ottawa?

Report it to the Canadian Centre for Cyber Security through its online form, contact the Ottawa Police Service, or the Gatineau police for a Quebec office, if it looks criminal, and call 911 if anyone's safety is at risk. Tell your insurer early, since the policy may set conditions on the response. If personal information is involved, PIPEDA, PHIPA or Quebec law may require notices to people and regulators. Then call us, and we help gather the facts.

Tell us what worries you.

Leave your name and a number. A person here calls you back the same business day, usually within an hour, and asks what you want checked. Would you rather start on your own? The free audit takes about three minutes.

Book the free audit instead

Same day callback
Written permission first
Fixed quote