Compliance, handled in practice.
PIPEDA, PHIPA, professional confidentiality rules, CIS 18 and cyber-insurance requirements all come down to the same thing: reasonable, documented safeguards. We put them in place.
Six obligations, one program.
PIPEDA
Canada’s federal private-sector privacy law. It requires security safeguards appropriate to the sensitivity of personal information, records of breaches of security safeguards, and reporting to the Privacy Commissioner and affected individuals when there’s a real risk of significant harm.
PHIPA (Ontario health information)
Ontario’s health-privacy law for custodians such as clinics and practitioners. Personal health information must be protected with reasonable safeguards, and patients notified when it’s stolen, lost or accessed without authority.
CIS Critical Security Controls
A prioritised, practical security baseline of 18 controls. We’ve designed, implemented and monitored CIS 18 for financial clients, including assessments and penetration tests.
Professional confidentiality
Lawyers, accountants and other regulated professionals have duties to protect client information. Those duties now extend to the technology that stores it.
Cyber-insurance requirements
Insurers increasingly require specific controls before they’ll quote or renew, and may deny claims when they’re missing.
Client and supply-chain questionnaires
Larger clients assess their suppliers’ security. A clear, documented program makes those questionnaires straightforward.
Assess. Fix. Prove it.
Assess
A security assessment measures where you stand against the obligations that apply to you.
Prioritise
A plain-language plan ranks gaps by risk, so you fix what matters first.
Implement
We put the safeguards in place: access controls, encryption, monitoring, backups and training.
Document
Records of what's in place, ready for auditors, insurers, boards and clients.
Are you a compliance auditor?
No. We're your technology partner: we implement and document the technical safeguards that privacy laws and frameworks expect. For legal interpretation, work with your lawyer or auditor: we'll work alongside them.
Does PIPEDA apply to my business?
PIPEDA generally applies to private-sector organisations that collect, use or disclose personal information in the course of commercial activities, unless a substantially similar provincial law applies instead. If you're unsure, ask your lawyer, then talk to us about the safeguards.
What are the CIS 18 controls?
The Center for Internet Security's Critical Security Controls: a prioritised set of 18 safeguards, from asset inventory to incident response, that's a practical baseline for small and mid-sized businesses. We've implemented them for financial clients.
What do cyber-insurers usually require?
Expectations vary by insurer, but two-factor authentication, endpoint detection, tested off-site backups, patching and staff training come up again and again. We'll help you answer the questionnaire accurately and close any gaps.
Every long partnership starts with one conversation.
Tell us where your IT is today. An Infinity engineer, not a salesperson, will reply within one business day.
Tell us about your IT.
We answer almost every inquiry within one business day.