itopsi
Pricing
About
Contact
FrançaisCall me back
Put the rules in writing

Security policies and procedures written for how your organization really works

We write your information security policy and the procedures under it with you, for the way your office really works: acceptable use, access and passwords, backup, incident response, remote work and vendors. Each document is checked against what is set up in your systems and mapped to the Canadian baseline controls and the standards your clients ask about.

Ask us to call you backBook the free audit
An office administrator in her sixties adding blank sheets to an open green ring binder at a white desk, a closed laptop and a cup of tea beside her
Management approves the set, staff read and sign it, and the next review date is written down.

A person here calls you back the same business day, usually within an hour.

  • Written permission first
  • A report in plain words
  • Checked again after the fix

What an information security policy is, and what sits under it

An information security policy is the short document in which management sets the rules for protecting the organization's information and names who is responsible for them. Procedures sit under it and say how each rule is carried out, step by step, by the people who do the work. Together they are what a client, an insurer or an auditor asks to see first.

Canada's Get Cyber Safe guide for small business puts it plainly: a cyber security plan sets out the rules you and your employees need to follow, from passphrases and multi-factor authentication to the software staff may download and what happens when someone leaves.1 An IT security policy or a cyber security policy covers the same ground under another name. What matters is that the paper matches what your office actually does on a Tuesday morning.

The security policies and procedures we write with you

A typical set for a small or medium organization has one umbrella policy and six to eight shorter documents, each written after an interview with the people who run that part of the office. The scope letter lists the exact documents, and a clinic, a law firm and a SaaS company end up with different sets.

Information security policy

The umbrella document: what information the organization holds, who in management answers for its security, how exceptions are approved and when the set is reviewed.

Acceptable use policy

What staff may and may not do with work computers, phones, email, cloud storage and AI tools, written in plain words so a new hire understands it in one reading.

Access, password and MFA policy

Who gets which accounts, how administrator rights are limited, password length and password managers, where a second sign-in step is required, and how access ends on someone's last day.

Backup and restore procedure

What is copied, how often, where the copies live, who may reach them and how a restore is tested, matched to the setup we find. The technical side is covered by our backup and disaster recovery service.

Incident response plan

Who decides what in the first hours, who calls the insurer, police, the Canadian Centre for Cyber Security or a privacy regulator, and a paper contact list. A tabletop exercise is how the plan is tested with your management.

Remote work, devices, vendors and data retention

Home and travel work, personal phones, outside providers with access to your data (see vendor risk), and how long records are kept and how they are destroyed.

1. Interviews How your office works 2. Written for you In English or French 3. Checked in systems Gaps go on a fix list 4. Mapped to the rules CCCS, ISO, SOC 2, PCI DSS 5. Approved and read Staff sign they read it 6. Yearly review Policy matches practice
How a policy set is written and kept current, from the first interview to the yearly review.

How the policies map to Canadian baseline controls and privacy law

Every policy we write is tied to the requirement it answers, and you receive that link as a table. For most Canadian small and medium organizations the reference is the Canadian Centre for Cyber Security's baseline controls, written for organizations with less than 500 employees, several of which ask for written plans, policies or procedures by name.2

Privacy law asks for policies too. PIPEDA requires organizations to implement policies and practices to give effect to its principles, including procedures to protect personal information and staff training, and Quebec's private-sector act requires an enterprise to establish and implement governance policies for personal information, approved by the person in charge of its protection.45 Detailed privacy obligations are covered on our PIPEDA and Law 25 page.

Requirements that ask for written policies or procedures, and the document that answers each
SourceWhat it saysDocument in your set
CCCS baseline controls, BC.1.2Organizations should have a written incident response plan that details who is responsible for handling incidents, including contact information for external parties, stakeholders and regulators, and an up-to-date hard copy of it.2Incident response plan and contact list
CCCS baseline controls, BC.5.3Organizations should have clear policies on password length and reuse, the use of password managers and if, when, and how users can physically write down and securely store a password.2Access, password and MFA policy
CCCS baseline controls, 3.7Organizations should have clear procedures on how to restore from back-ups and regularly verify that back-up and restore mechanisms operate as expected.2Backup and restore procedure
CCCS baseline controls, BC.12.3 and BC.13.2Organizations should remove accounts and/or functionality when employees no longer require these for their tasks, and have processes for the sanitization or destruction of portable media prior to disposal.2Access policy (leavers) and data retention and disposal procedure
NIST CSF 2.0, GV.PO-02Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission.3Review date and change log for the whole set
Quebec, CQLR c P-39.1, s. 3.2Governance policies must provide a framework for keeping and destroying information and define the roles of staff throughout its life cycle.5Data retention and disposal procedure, roles in the umbrella policy

One policy set for ISO 27001, SOC 2, PCI DSS and CyberSecure Canada

One well-built policy set can serve several frameworks at once, because they ask about the same subjects: access, backups, incidents, staff, vendors and change. We write the documents once and add the mapping each framework needs.

ISO/IEC 27001:2022, the current third edition published in October 2022, defines the requirements an information security management system must meet, and ISO describes its approach as covering people, policies and technology.7 A SOC 2 report is issued by a CPA firm on a service organization's controls relevant to security, availability, processing integrity, confidentiality and privacy; CPA Canada's 2024 guide adapts the AICPA's guidance to Canadian standards.8 PCI DSS provides a baseline of technical and operational requirements designed to protect payment account data, and is intended for entities that store, process or transmit cardholder data, merchants included.9

The certificate, report or assessment always comes from the outside body named by each framework. Our part is the documents and the work behind them; the related readiness pages explain the rest: ISO 27001 readiness, SOC 2 readiness, PCI DSS for small merchants and CyberSecure Canada readiness.

Ontario public sector: policies behind the O. Reg. 51/26 program

Ontario school boards, colleges and universities, children's aid societies, Group A, B and C public hospitals and the University of Ottawa Heart Institute, all covered by O. Reg. 51/26, must develop and implement a program for ensuring cyber security that satisfies, at a minimum, the requirements set out in the regulation.6 Written policies are the usual way to show what that program is and who runs it.

The regulation names roles and deadlines: a primary point of contact in a senior management position with an alternate, and a report to the Ministry's Chief Information Security Officer no later than 72 hours after a critical incident is confirmed; activating cyber security incident response plans is one of the criteria for such an incident.6 We write those roles, the reporting path and the response plan into the policy set; the assessment is covered on our O. Reg. 51/26 page.

How the work goes, from first interview to signed policies

Writing a policy set takes four stages, and the longest is listening: interviews, drafts in plain English or French, a check against your systems, then approval and staff acknowledgement.

1. Interviews

Short conversations with the owner or director, whoever handles IT, and the people who manage payroll, client files or payments, about what happens in practice, shortcuts included.

2. Drafts written for your organization

Each document uses your names, systems and vocabulary. Rules your office cannot follow yet are marked as dated goals, so the policy stays honest.

3. Check against your systems

We look at the settings the policies describe: sign-in rules, administrator accounts, backups, sharing. Where paper and practice differ, the gap goes on a list for you, your IT provider or our hardening service.

4. Approval, acknowledgement and review

Management approves the set, staff sign that they have read it after a short session, and the next review date is written on the first page.

What you have in hand

You end with documents in your organization's name that you own and can show a client, insurer, auditor or regulator the day they ask.

  • The policy set in your name, in English, French or both, as editable files.
  • A correspondence table linking each policy to the requirements it answers: CCCS baseline controls, ISO/IEC 27001, SOC 2, PCI DSS, PIPEDA, Law 25 or O. Reg. 51/26, as your scope requires.
  • An acknowledgement log showing which staff read which document and when.
  • A list of gaps between what the policies say and what your systems do today, in order of priority.
  • A review date and a change log, so next year's update starts from a record.

Why a contracted team: the risks of doing it alone, with a chatbot or a freelancer

A policy downloaded from the internet describes somebody else's company. It promises quarterly restore tests, encrypted laptops and a security officer your office may not have, and the first person to compare it with your setup is often an insurer after a claim or an auditor during fieldwork. A signed promise that the office does not keep is harder to explain than a gap that was written down honestly.

A chatbot produces fifty pages in a minute with the same flaw, plus confident references to controls or standards it has invented or mixed up. It has never seen your sign-in settings, so it cannot tell which of its promises are already false.

A freelancer can write good documents and still leave them in a personal drive, unchecked against your systems and unknown to staff. With us the scope letter fixes the documents, each policy is checked against the settings it describes, staff acknowledgement is recorded, and every file is yours.

Five plain reasons to trust us with this

  • A registered Canadian company

    INNOVA CONSULT LTD., federal corporation 1522612-1, based in Ottawa. itopsi is its brand.

  • In practice since 2013

    The group behind itopsi has run legal and marketing practices since 2013. Its founder has worked in law and compliance for more than 14 years.

  • We run servers of our own

    Our own servers and more than 80 websites are checked for known vulnerabilities every day.

  • Insured

    Commercial general liability insurance of CAD 1 million is in force.

  • Your scope, your report

    A fixed scope in a signed letter before any work starts. Licences and equipment at cost, with no vendor commission. The report belongs to you.

How the work goes

Five steps, in the same order every time.

Before any test, you sign a scope letter: what we test, on which dates, who to call, and what we must leave alone.

Your signature comes first

  1. Step 1

    We agree what to check

    A short call, or the form at the foot of this page. Together we decide which website, server or office systems we look at.

  2. Step 2

    You sign the scope letter

    It sets the targets, the dates, the contacts, and what we must leave alone. Work starts only once it is signed.

  3. Step 3

    We check, and write it down

    One report in plain words for you, with the technical detail attached for whoever looks after your systems.

  4. Step 4

    We fix it

    We make the repairs ourselves, or together with your current IT provider or web developer.

  5. Step 5

    We check again

    A second check confirms that each problem is closed.

What it costs

Each job is a different size, so each one gets a fixed quote once the scope is agreed. You see the price in writing before any work starts.

  • A fixed quote once the scope is agreed
  • The price in writing before work starts
  • A second check after the fixes
Questions

Questions owners ask us

Your question is missing? Leave your number and ask it in your own words.

What is a security policy?
A security policy is a document in which management sets the rules for protecting the organization's information and names who is responsible for them. It says what must happen, for example that every email account uses a second sign-in step. Procedures sit under the policy and explain how each rule is done. Clients, insurers and auditors usually ask for both.
What security policies does a small business need?
Most small offices need an umbrella information security policy, an acceptable use policy, an access and password policy, a backup and restore procedure and an incident response plan. Firms with remote staff, outside providers or personal data usually add remote work, vendor and data retention documents. The exact set depends on your clients, your insurer and the frameworks you answer to.
What should an information security policy include?
It should say what information the organization holds, who in management is responsible for protecting it, which other policies and procedures apply, how exceptions are approved and when the documents are reviewed. It stays short and readable. The technical detail belongs in the procedures, so the policy can stay stable while systems change.
Can we simply download ready-made policies?
You can, and many offices do, but a generic document describes measures your office may not have. When an insurer, auditor or client compares the paper with your systems, those differences become findings. We write each policy around your real setup and mark anything still missing as a goal with a date, so what you sign matches what you do.
How often should security policies be reviewed?
At least once a year, and also after a major change: a new system, a move to the cloud, a new framework or an incident. NIST's Cybersecurity Framework 2.0 lists, as an outcome, policy that is reviewed and updated to reflect changes in requirements, threats, technology and mission. We can run the yearly review with you by agreement, starting from the change log.
Are written policies enough for ISO 27001, SOC 2 or CyberSecure Canada?
They are a necessary part, and the outside assessor also checks that the rules are followed in practice. ISO 27001 certificates come from an accredited certification body, SOC 2 reports from a CPA firm, and CyberSecure Canada from a certification body in that program. Our readiness pages describe the rest of the work for each one.
Can the policies be written in French and English?
Yes. Each document can be written in English, in French or in both, with the same structure so that staff in Ottawa and Gatineau read the same rules. Both versions keep the same numbering, so a policy cited in an audit is the same document in either language. The languages are set in the scope letter.
How much does it cost to write security policies?
The price depends on how many documents you need, how many people we interview, the frameworks the table must map to, whether you want English, French or both, and whether we also check your systems. After a 30-minute call we write a fixed price into the scope letter, covering exactly the documents it lists.

Read this next

Tell us what worries you.

Leave your name and a number. A person here calls you back the same business day, usually within an hour, and asks what you want checked. Would you rather start on your own? The free audit takes about three minutes.

  • Same day callback
  • Written permission first
  • Fixed quote

Ask us to call you back

Leave your name and number. A real person calls you back the same business day, usually within an hour.

We use your number to call you back about your request. Nothing else.

Call me back