Canada Gets a National AI Strategy: Here's What It Changes
On June 3, 2026, Canada published its first National AI Strategy, AI for All. I read the document so you don't have to.
Blog
Your reference library — practical advice, news and analysis on information security and compliance.
My friend's hacked Facebook ad account: it probably wasn't their fault
A communications colleague called me on a Friday, panicked: an active ad was no longer promoting what it was supposed to promote.
Your Team Codes Well. Nobody Validated the Security of That Code.
At a manufacturing SMB, three developers were building an impressive inventory app. My question: how is the code validated before each release?
Personal Information Inventory: What Exactly Should You List?
The question comes up in almost every Bill 25 compliance engagement I take on.
AI in the SOC: Why 90% of Teams Get No Real Value
I came across a Hacker News article this week referencing the SOC-CMM 2026 Maturity Report, an annual study of about 200 SOCs worldwide.
The Basement Hacker Never Sleeps
Bruce Schneier recommends reading Melissa Hathaway's analysis in the Cyber Defense Review on his blog.
Which Claude Model to Choose — and at What Effort Level?
Since I've been using Claude, I always wonder which model to choose and what effort level to give it: medium, high, or xhigh? Here's what I've found.
ISO/IEC 27043: The Backbone of Digital Investigations
Here is a scenario I have seen play out several times. A security incident occurs in an organization.
ISO/IEC TS 17012:2024: The Official Guide for Remote Audits
If you have received or conducted an audit by videoconference, this standard concerns you directly.
The Exposure Window Has Become a Catastrophe Window
Anthropic has just published the first Project Glasswing data, and if you work in cybersecurity or compliance, here's what it means concretely for your…
What Increases and Decreases Trust in SOC 2 and ISO 27001
Trust in a world where abuse seems to reign. Four years ago, I wrote an article on how to trust an auditor's report.
ISO 42001: Your SMB Only Uses ChatGPT? Here Are the Controls That Do Not Apply
I continue in the same vein as my article on ISO 27001 controls that do not apply to organizations without software development.
Trust in a World Where Abuse Seems to Reign
Four years ago, I wrote an article on how to trust an auditor's report. I asked: how do you assess the auditor's independence, competence, and rigour?
Your Vendors Are a Target — ISO 27001 Planned for It
You think your systems are well protected. Firewall in place, antivirus up to date, password policies respected.
Bill 25 Project to Help You Understand Your Website's Compliance. Free!
I decided to take on this project to get back into programmer mode during the holiday break.
ISO 19011:2026 — What Changes
ISO 19011 was published in May 2026. If you read my article on the 2018 version, here I cover the new edition.
I Got a Link by Email. How Do I Know If It's Safe to Click?
We all receive emails with links. Sometimes we are certain they are legitimate based on past trust; other times we hesitate.
95% of AI Projects Fail — Stay on Track and Measure Value Added
I came across this Fortune article published in August 2025, which reports the results of an MIT study titled GenAI Divide: State of AI in Business 2025.
AI Agents and Prompt Injection: Can a Simple Email Steal Your Data? Yes.
I'll give you the answer right away: yes.
Fear and Trust in AI: People Only See the Chat — But What Is the Rest?
When artificial intelligence comes up in an executive meeting, the image most people form in their minds is ChatGPT. A chat window, a question, an answer.
Silent SMS — Type 0: Your Phone Responds to Someone You Never See
A Type 0 SMS arrives on your phone. You hear nothing. Nothing displays.
Privacy: Even Wounded, It's Worth Fighting For
I've worked in cybersecurity for years. I know what ends up on the dark web. Your name, email, password, phone number, maybe your Social Insurance Number.
ISO/IEC 27701 — Do You Really Manage Your Clients' Personal Information?
A client recently asked me whether their ISO 27001 certification was enough to meet Bill 25 requirements. My short answer: no.
Can You "Pass" ISO 27001 With Templates (or AI)?
A client called me a few months ago. He'd bought an ISO 27001 template pack online. Proud of himself. Six months of work filling in documents.
ISO 19011 — The Standard to Rule Them All in Compliance
I cannot resist quoting one of my favourite books and films, but in this case the reference is not gratuitous.
Why Vibe Coding Is So Polarizing
Lately we've been seeing a new expression: vibe coding.
Version 1.2.1 – Improved Cookie Analysis
Today I present improvements to the tool at https://loi25.certi360.com. Each test checks one aspect of the site's behaviour regarding cookies and consent.
Opinion — Compliance Platforms
Today I'd like to share my opinion on compliance tools and platforms.
Understanding TLS/SSL testing on Loi25.certi360.com
In the context of Quebec’s Act 25 on the protection of personal information, the security of communications between a website and its visitors is a basic…
Does My Site Really Need a Consent Banner?
It's a question that comes up often.
84 Audit Questions to Evaluate a Business Continuity Plan
A good Business Continuity Plan (BCP) should not gather dust in the IT department's office.
New ISO/IEC 27701:2025 Standard
It's done — the ISO/IEC 27701:2025 standard has finally been published.
ISO27001 – No software development, here is the list of non-applicable controls
After my latest ISO 27001 audits, I see the same mistake. Companies that declare applicable controls that have nothing to do with their reality.
Difference between OWASP TOP10 and ASVS
First of all, it’s important to know that Le Top 10 is an awareness document that explains the main application risks, making it perfect for education,…
OWASP ASVS – What is it?
Even a simple website often relies on complex platforms, such as CMS (content management systems) or APIs. Safety must no longer be an afterthought.
Introduction ISO 9001: Quality management!
It is a quality management standard that structures the way an organization operates, documents its processes and demonstrates compliance.
ISO/IEC 27018:2025 : New version for cloud processors
I’ve already talked about the ICI standard – March 2022 article: /en/iso-27018-privacy-protection-for-cloud-processors/
Which ISO 27001 Controls Apply Under Quebec Bill 25?
For those who have implemented ISO 27001:2022, you must create a file called a Statement of Applicability based on the Annex A controls.
Which ISO27001 standards are applicable in accordance with Quebec’s Act 25 on…
Those who have implemented ISO27001:2022 must create a file called a “declaration of applicability” based on the controls in Annex A.
ISO27031:2025 – New version for IT continuity
When it comes to business continuity in cybersecurity, most SMEs immediately think of backups or a redundant cloud server.
Correcting without looking for the cause is wrong!
A Root Cause Analysis (RCA) is a structured approach to identifying the root causes of an incident or non-conformance in an exhaustive and precise manner.
ISO 22301:2019 focuses on business continuity
ISO 22301:2019 is entitled “Security and resilience – Business continuity management systems – Requirements”.
Physical intrusion testing?
My former company, Gardien Virtuel, used to do this type of testing, and I had so much fun carrying out these mandates, because with each project, there…
Information security VS Cybersecurity
Over the past few days, I’ve seen a lot of comments on LinkedIn around words like “cybersecurity”, “information security” and “cyberattack”.
Opinion on open source software: Stop financing our technological dependence
Every year, millions of our tax dollars are sent directly to US multinationals for software licenses.
Consent standards, ISO 27560 and ISO 29184
Today I’d like to talk to you about the families of the ISO standard with a concrete example.
ISO 27001 audits: Differences between Stage 1 and Stage 2
Achieving ISO 27001 certification is an important and stressful process for organizations wishing to demonstrate their commitment to information security.
Understand the role of ISO certification and accreditation bodies.
Getting started with the International Organization for Standardization (ISO) It all began with ISO (International Organization for Standardization), an…
ISO27001 – Defining the scope of the security program
ISO/IEC 27001:2022 describes the requirements for implementing an Information Security Management System (ISMS).
ISO 27001 – A.5.31- Legal, regulatory and contractual requirements
When we think of information security, we often think of encryption, firewalls or access management.
Your privacy policy template
This sample privacy policy is the basis on which I develop privacy policies for my clients’ websites.
ISO27001 – A8.29 with CI/CD pipeline – Continuous integration and continuous deployment
The security measure in Annex A8.29 of ISO 27001:2022 is entitled “Security testing in development and acceptance”.
ISO27001 – A8.28 – DAST and SAST – Security and development tools
As part of my work on the implementation of ISO27001:2022, I have had to deal with issues relating to application development and testing, mainly for the…
What is the role of an information asset manager?
The importance of IT security and the growing value of data in the business world have led to the creation of specific roles to manage and protect the…
Event logs: Bill 25 and privacy explained
The management of event logs is an essential aspect of the protection of personal information, particularly in the context of Quebec’s Bill 25.
Cookies : Bill 25 and privacy explained
Lately, I’ve been working on a number of mandates that, to my great delight, include the management of personal information, especially since the adoption…
20 myths about PCI-DSS
PCI-DSS (Payment Card Industry Data Security Standard) certification is a set of security standards designed to ensure that all companies that process,…
How long can I keep my system event logs?
What is an event log? An event log, also known as an audit trail or log, is a record that documents actions taken by computer systems, applications and…
Information security training: investment or false hope?
Imagine an e-commerce company with annual sales of $20 million having its operations interrupted for 72 hours by a phishing e-mail.
ISO 27001 Clause 10.2 – Non-conformity management procedure
Even the best-designed safety programs run into discrepancies. What to do in these situations?
ISO 27001 Clause 10.1 – Continuous improvement
As in other fields, in the world of information security, standing still is tantamount to going backwards!
My 10 Best reads of 2024
This year, I’ve been lucky enough to read quite a few books that have made an impression on me.
ISO 27001 – Clause 9.3 – Management review
Clause 9.3 of ISO 27001:2022 explains how to carry out a management review, which is an important step in ensuring that the Information Security…
How do I become an ISO27001 external auditor?
ISO 27001 is an international standard that sets out the requirements for an information security management system (ISMS).
ISO27001 – Clause 9.2 – Internal audit – Ensuring conformity
Clause 9.2 of ISO 27001:2022 requires organizations to carry out regular internal audits of their information security management system (ISMS).
ISO27001 – Clause 9.1- Monitoring our dashboard
Clause 9.1 of ISO27001:2022 requires organizations to carry out practical monitoring of their information security management system (ISMS).
Ladies, what to do before meeting a suitor?
It’s a Friday night, you’re chatting on a dating site and your suitor would like to meet you. What research should you do before meeting him?
Testing my business continuity strategies – what does it mean?
How do you know that the team has mastered the business continuity or incident management plan?
Dad, my friend had his cell phone stolen!
Oh no! What bad news, to realize that your phone has been stolen. It’s so frustrating and worrying, especially at your age, knowing that your phone is an…
ISO27001 – Clause 8.3 – Dealing with risks
Clause 8.3 of ISO 27001:2022 is crucial because it addresses how organizations should respond to the information security risks identified in the risk…
As a CISO or CISO, why am I not on the management committee?
The role of a Chief Information Security Officer (CISO) or the Information Systems Security Manager (ISSM) is a very important role for any organization,…
ISO27001 – Clause 8.2- Risk assessment
Clause 8.2 is one of the most important clauses in the standard, as it forms the basis for all other information security controls.
ISO27001 – Clause 8.1- Operations planning
Clause 8.1 of ISO 27001 underlines the importance of rigorous planning and control of information security operations within an organization.
How do you prepare a digital will?
We all know that when we draw up our wills, we need to list our bank accounts, other financial institutions and assets that will be sold after our death,…
Managing information security in the supply chain
I come across a survey report on the subject of supply chain risk management from Gartner 2023.
In search of artifacts: What does a compliance auditor hope to discover?
An artifact is an element created as an output from a process or project.
Protection of personal information in the context of Bill 25 – The difference between data…
Today we’re going to explore the difference between de-identified data and anonymized anonymized data.
ISO27001 – Clause 7.5 – Document management
When it comes to information security, every detail counts, including the way information is created, stored, maintained and destroyed.
![[Article 5] Stalking – Endure porn disclosure and hypertrucage!](/assets/blogue/0s5sUGCd4TlNfB1E9.webp)
[Article 5] Stalking – Endure porn disclosure and hypertrucage!
This is the last article in my series on stalking. This behavior is very disturbing and destabilizing, especially with the use of artificial intelligence…
Best reads of 2023
Here we are at that time of year when we pause and look back at all the work we’ve done, and in my case, I’m also looking back at all the books I’ve read…
![[Article 4] Stalking – How can I tell if someone is spying on me?](/assets/blogue/0Ai2MGc0HeMEvtjap.webp)
[Article 4] Stalking – How can I tell if someone is spying on me?
The issue of security and digital privacy is paramount. As technology advances, it’s essential that we continue to be concerned about protecting our…
![[Article 3] Stalking – Prevent it!](/assets/blogue/1AZtbcy0Ov4KII5k0C9yxpQ.webp)
[Article 3] Stalking – Prevent it!
Today, I present the third article in a series on harassment. In this article, I seek to understand how to prevent harassment.
![[Article 2]Stalking – Its different forms.](/assets/blogue/0N-Ux3gtsNUkzWX4a.webp)
[Article 2]Stalking – Its different forms.
Following on from the previous article, in which I explored the laws surrounding stalking, allow me to present a few concrete examples that illustrate in…
![[Article 1] Criminal harassment – The laws](/assets/blogue/0gNdzHTV51RFqgdU3.webp)
[Article 1] Criminal harassment – The laws
On the night of Friday August 25 to Saturday August 26, 2023, Ianick Lamontagne committed an irreparable act: the murder of his children, followed by his…
ISO27001 – Clause 7.3 – Raising awareness
Information security is a crucial issue in today’s digital age. Yet we often only realize its importance after we’ve been the victim of a cyber-attack or…
ISO27001 – Clause 7.2 – Skills
Clause 7.2 is designed to ensure that those who have an impact on the organization’s information security have the appropriate and necessary skills to…
ISO27001 – Clause 7.1 – Resources
The organization must identify and provide the resources needed to establish, implement, maintain and continuously improve the information security…
ISO 27001 – Clause 6.3 – Change planning
Planning changes to an information security management system (ISMS) is important for several reasons.
ISO 27001 – Clause 6.2 – Objective – How to measure the objectives of a security program
Setting a goal is the best way to achieve it, otherwise how do we know when we’ve succeeded?
Your transition plan to ISO27001 version 2022!
It’s now almost a year since ISO 27001:2013 was replaced by the new version named ISO 27001:2022. Here’s your transition plan! Change – Photo by Suzanne D.
ISO27001 – Clause 6.1 – Actions to address risks and opportunities!
Information security risk management is the set of actions taken by an organization to understand and reduce the effects of risk.
ISO27001 Clause 5.3 – Information security roles
Roles, responsibilities and power sharing within an organization are of the utmost importance when it comes to information security.
ISO27001 Clause 5.2 – Policy
Policy is the equivalent of a corporate mission, since without a mission there is no corporate project.
ISO27001 Clause 5.1 – Commitment and leadership
Photo by Brooke Lark on Unsplash The organization’s management is key to ensuring that ISO 27001 requirements are met and that the ISMS is effective.
ISO27001 Clause 4.4 – ISMS maintenance
Clause 4.4 of the ISO27001 standard is one of the smallest in size, but the one that, in my opinion, has the greatest day-to-day impact on the organization.
ISO27001 – Clause 4.3 – determining the scope of the security program.
The scope of an ISMS (Information Security Management System) is crucial, as it defines the direction and objective that the security team must follow.
ISO27001 – Clause 4.2 – Understanding stakeholder needs and expectations
As we often say, information security is everybody’s business. We need to identify and understand the needs of this world.
ISO27001 Clause 4.1 – Understanding the organization and its context
To begin with, are we able to define who the organization is in clear terms?
What’s the difference between an information security incident and a non-compliance?
Photo by Possessed Photography on Unsplash When implementing a management system (such as SGSI-ISO27001) we need to understand the difference between…
5 Steps to becoming an ISO27001? external auditor
Photo by Glenn Carstens-Peters on Unsplash Becoming an ISO 27001 external auditor requires a combination of training, professional experience and…
Best reads of 2022.
Photo by Ashim D’Silva on Unsplash You may have been discovering this slowly over the last few years as you’ve read me talking about books, but I really…
How much does it cost to obtain ISO27001 certification?
The question of the cost of an ISO27001 certification project frequently comes up, and rightly so, since this certification is based on the most widely…
ISO 27017 – Guide for the use of cloud services.
Cloud computing is becoming increasingly popular as companies look for ways to improve efficiency and reduce costs. Security in this context is essential.
How can you trust an auditor’s report?
In a world of compliance with laws, regulations and standards, it can be difficult to know whether or not to trust an auditor’s report.
PCI-DSS 4.0 – What’s new?
When I received notification of the standard’s publication on March 31, 2022, I thought it was an April fool’s joke.
ISO 27018 – privacy protection for cloud processors?
Are you a cloud service provider? Do your customers process personal information? Do your customers use your platform to deliver their services?
Password manager – how and why do I need one?
A few days ago I asked a question on the LinkedIn platform, namely what would be the best choice for a password vault application.
Personal information: Do you know your role?
There are two distinct roles when it comes to corporate responsibility for managing personal information.
How do I draw up a communication plan?
A communication plan is a formal document that describes how information will be shared between the organization and its stakeholders, both internal and…
Why do companies fail their security audits?
Lately, I’ve been doing a lot of compliance audits (internal and external), mainly for PCIDSS and ISO standards.
New edition of ISO27002, version 2022
On February 15, 2022, a revision of the ISO/IEC 27002 standard is published and available to all.
How to combat listener fatigue?
During this festive period of exchange and discussion about our mental health, I’d like to bring you a subject that isn’t often discussed in the auditing…
How do you structure your corporate cybersecurity program?
What you need to know to manage a minimal information security program in a corporate context.
PCI DSS – Credit card management!
Do your customers pay you with their credit cards? Then the PCI DSS standard is for you!
Quebec Bill 64 – Year 1 of 3 – Here are the articles that come into force.
We’re in the first year of a three-year implementation period. Here’s what you need to know about this first year!
What is a SOC2 report?
Your company provides services to its customers? and your customers ask you for a SOC 2 type 2 report?
What is ISO/IEC 27001?
ISO/IEC 27001 formally defines an information security management system (ISMS) as a set of activities designed to manage information security risks.
Writing a cybersecurity incident report?
When a cybersecurity incident occurs, it’s important to record all the details so you can remember it and prevent it from happening again.
28 questions to assess your teleworking policy
Here we are again, in a period of confinement due to Covid-19. I thought it was time to evaluate its telecommuting policies.
My best reads of 2021!
Source: Flikr.com Here we are again at the end of the year, and the confinement and sanitary measures have only increased my love of reading, which I must…
6 steps to managing information security incidents
In the course of my work, I come across all kinds of companies, but too many have no procedures or methods for managing incidents.
No articles match your search.