Short answer
To choose a cybersecurity firm, check its experience with the type of engagement you need, the skills of the assigned team, the proposed deliverables and the confidentiality arrangements. Ask who performs the work, what is excluded and how remediation will be followed up. Courtier TI suggests an IT services company that matches your project; you then decide whether to accept its quote.
How are providers qualified?
Courtier TI checks seven qualification criteria, including business registration, professional liability insurance and two client references. Review the criteria and verification steps to understand how a provider is qualified.
When should you call on a cybersecurity firm?
- You want to know where your security stands: a security audit assesses the current state and prioritizes fixes.
- You want to check whether an attacker could get in: a penetration test simulates an authorized attack.
- You need to strengthen your measures related to Law 25: access, incidents, vendors, personal information.
- You have no one in-house to analyze alerts: a managed security provider can handle it, under the terms of its contract.
- A client, an insurer or a contract requires specific measures, such as multifactor authentication or employee training.
A few figures
According to Statistics Canada (opens in a new tab), about 1 in 6 (16%) Canadian businesses with 10 or more employees were impacted by cyber security incidents in 2023, a proportion that has declined since 2019. Among impacted businesses, 13% reported a ransomware attack. Recovery spending doubled in two years, reaching 1.2 billion dollars in 2023. A cybersecurity firm can help you assess your risks based on your environment.
Target population: Canadian businesses with 10 or more employees (Statistics Canada, 2023 (opens in a new tab)).
Written cyber security policies
In 2023, 26% of Canadian businesses with 10 or more employees had written policies for cyber security (Statistics Canada, 2023 (opens in a new tab)).
What to check before choosing
| What to check | Why it matters | Question to ask |
|---|---|---|
| The type of service | An audit, a penetration test and managed security call for different skills. | Which services do you offer, and which ones do you deliver yourselves? |
| The team’s certifications | They show recognized training, depending on the service. | What certifications do the people assigned to my project hold? |
| Knowledge of Quebec’s Law 25 | Your obligations regarding personal information remain yours. | How do you take Law 25 into account in your recommendations? |
| The deliverable | A clear report lets you act and track fixes. | Can you show me a sample report, without client data? |
| Incident handling | You need to know who does what if an incident occurs. | What is your incident process, and what is included? |
| References | They show experience in a context close to yours. | Can you give me references from companies of a similar size? |
Define the cybersecurity engagement
Prepare the information for a quote
How does it work?
- You describe your project once, in a single form.
- The Courtier TI team first contacts you in less than 48 business hours, to understand your need, then suggests an IT services company that matches your project.
- That company presents its quote, and you decide.
Among businesses that did not have cyber security employees, 47% reported using consultants or contractors to monitor cyber security (population: businesses with 10 or more employees; Statistics Canada, 2023 (opens in a new tab)). The Courtier TI service is free for the business making the request.
Frequently asked questions
Where do I start if I don’t know which cybersecurity service I need?
Describe your situation: number of employees, tools used, sensitive data and concerns. A security audit can be a starting point, depending on your environment. The Courtier TI team first contacts you in less than 48 business hours, then suggests an IT services company that matches your project.
What is the difference between a security audit and a penetration test?
An audit takes stock of your security measures and ranks fixes by priority. A penetration test simulates an authorized attack to check whether a malicious person could get in. The two can work together.
Can a cybersecurity firm help me with Law 25?
It can help you put security measures in place and prepare for a privacy incident. The obligations under Law 25 remain those of your company. This content is for information only and is not legal advice.
What information should I provide to receive a quote?
Indicate the service you need, the number of employees and workstations, your main systems, any specific requirements and your deadline. The more precise the description, the more precise the quote can be.
How much does the Courtier TI service cost?
The Courtier TI service is free for the business making the request. The firm presents its quote, and you decide.