Common questions about our compliance, risk, and privacy assessment services.
What is Quebec Law 25, and does it apply to businesses outside Quebec?
Yes. Quebec Law 25 applies to any enterprise processing the personal information of Quebec residents, regardless of where your business is headquartered. It introduces strict requirements for consent, mandatory Privacy Officers, Privacy Impact Assessments (PIAs), and severe penalties (up to $25M or 4% of worldwide turnover) for non-compliance.
How do Privacy Impact Assessments (PIAs) work?
A PIA is a systematic evaluation of how personal data is collected, stored, and shared within a project or system. Under Law 25 and GDPR, we map data flows, identify privacy risks, and propose technical or organizational mitigations to ensure legal compliance before a system goes live.
What is the difference between a SOC 2 Type 1 and Type 2 report?
SOC 2 Type 1 evaluates the design of your security controls at a single, specific point in time. SOC 2 Type 2 evaluates both the design and the operating effectiveness of those controls over a prolonged observation period (usually 3 to 12 months).
How long does a typical SOC 2 or ISO 27001 Readiness Assessment take?
Depending on the size and complexity of your infrastructure, our Readiness Assessments typically take between 4 to 8 weeks. This process provides you with a clear roadmap of gaps that need to be remediated before initiating the formal external audit.
Why do we need Third-Party Risk Management (TPRM) if our internal network is secure?
Many modern data breaches originate from compromised third-party vendors who have access to your data or network (supply-chain attacks). A TPRM program identifies, assesses, and monitors the cyber risks posed by your suppliers, ensuring they don't serve as a backdoor into your sensitive corporate environment.
What is a Fractional vCISO, and how does it save costs?
A Fractional Virtual Chief Information Security Officer (vCISO) is an outsourced, part-time security executive. It allows organizations to access elite, board-level security strategy and leadership without the substantial overhead costs (salary, benefits, equity) of hiring a full-time, in-house CISO.
What are IT General Controls (ITGC) vs. IT Application Controls (ITAC)?
ITGCs are foundational controls applied to your overall IT environment, such as logical access, physical security, and change management. ITACs are specific, automated controls embedded within a single software application, such as input validations, mathematical accuracy checks, and interface error handling.
Who needs to comply with NIST SP 800-171?
NIST SP 800-171 is a mandatory compliance framework for any non-federal organization (such as contractors and sub-contractors) that processes, stores, or transmits Controlled Unclassified Information (CUI) on behalf of the US Department of Defense (DoD) or other federal agencies.
How do you help with Business Continuity Planning (BCP)?
We assist in performing Business Impact Analyses (BIA) to identify critical functions, developing resilient Disaster Recovery (DR) plans, and leading executive Tabletop Exercises to simulate scenarios like ransomware attacks or natural disasters to test the organization's response protocols.
Do you assist with remediation, or just perform the assessments?
Unlike external auditors who must maintain strict independence, ITAuditone acts as your advisory partner. We not only identify gaps but actively provide strategic roadmaps, policy templates, and technical guidance to help you successfully remediate those vulnerabilities.
Why should we align our program with the NIST Cybersecurity Framework (CSF 2.0)?
NIST CSF 2.0 is considered the global gold standard for cybersecurity architecture. Aligning with its core functions (Govern, Identify, Protect, Detect, Respond, Recover) ensures a holistic, risk-based approach to security that is easily communicated to board members and legally defensible in the event of a breach.
How often should we conduct security and compliance assessments?
Industry best practices and major frameworks (SOC 2, ISO 27001) require comprehensive security assessments to be performed at least annually, or immediately following any significant changes to your IT infrastructure, business operations, or regulatory environment.