Fortify & Secure
Security Assessment
How exposed are we, and what do we fix first?
What it is
A fixed-price review of your security against a recognized framework (CIS Controls IG1 or IG2, or the NIST Cybersecurity Framework). It can include external and internal penetration testing, web application testing and a phishing simulation. It ends with a prioritized, costed roadmap and a one-page summary for your board, insurer or customer. Defence suppliers get the CPCSC Contract-Ready Assessment instead.
What's included
- Review against CIS Controls IG1/IG2 or the NIST Cybersecurity Framework
- Optional external and internal penetration testing
- Optional web application testing and phishing simulation
- A prioritized, costed roadmap
- A one-page summary for your board, insurer or customer
Who it's for
- Any organization asking "how exposed are we?"
- Boards that want an independent view
- Non-profits preparing a grant application
- Children's aid societies, school boards, colleges, universities and hospitals that need a cyber security maturity assessment
Rules and requirements
What it helps you meet
General information, not legal advice. See the Ontario compliance guide. Last verified: November 6, 2026.
Cyber insurance
Accurate answers to insurer questionnaires.
OngoingPIPEDA (privacy)
Evidence of reasonable safeguards.
PhasedBill C-8 (Critical Cyber Systems Protection Act)
Customer and supply-chain questionnaires.
In force since July 1, 2026Ontario public-sector cyber rules (Bill 194 / EDSTA)
Ontario's maturity-assessment requirement, using standards the Ministry endorses.
Funding that may help
Ways to pay for it
You may qualify; we never promise funding. Last verified: November 6, 2026.
Check your options- Ontario Trillium Foundation: Seed
Non-profits can include it in a capacity or growth project.
- FedDev RTRI (Regional Tariff Response Initiative)
As part of a resilience project for tariff-hit firms.
How it works
5 steps, no surprises
- 01
Scoping call: framework, systems and testing options
- 02
Fixed-price proposal
- 03
Interviews, configuration review and testing
- 04
Ranked, costed roadmap and one-page summary
- 05
Walk-through with your leadership or board
Pricing
Fixed prices, quoted after a short discovery call
You know the cost before the work starts.
FAQ
Questions we hear
We can't fix everything anyway.
That's why the roadmap is ranked and costed. Most clients start with the top five items.
Can't you just run a free scan?
A scan finds missing patches. An assessment finds why they're missing and what to fix first.
Related
Often paired with
Start here
Find out where you stand, at a fixed price.
A short discovery call, then a fixed-price assessment with a ranked, costed roadmap: what to fix first, what it costs, and what funding may help.