Technical Guide — IT & CISO

You can only protect what you know you have. Build and maintain an inventory:

• What personal data do we hold? (customers, employees, prospects, suppliers)
• Where is it? (servers, workstations, SaaS, backups, email, paper)
• Who has access to it?
• How long do we keep it?
• Where does it flow? (internal flows, outside Quebec)

• Least privilege: everyone only accesses what they need for their role
• MFA mandatory for remote access and administrator accounts
• Periodic review of permissions (departures, role changes, external contracts)
• Log access to sensitive data

• In transit: TLS for every exchange (websites, APIs, sensitive emails)
• At rest: encryption of disks, databases and backups
• Mobile devices and removable media encrypted

• Keep access and event logs sufficient to detect and investigate
• Set up monitoring for abnormal access — an EDR or a managed service (MSSP) depending on your resources

• 3-2-1 rule: 3 copies, on 2 different media, with 1 offsite or offline
• Regularly test the restore — an untested backup is not a backup
• Immutable or offline copies to withstand ransomware

• Check providers' certifications (SOC 2, ISO 27001) and data location
• Configure SaaS services correctly — leaks often come from misconfigurations, not sophisticated hacks
• Enable privacy-by-default settings at the highest level

• Automate the purging of data that has reached its retention deadline
• Destroy irreversibly: secure erasure (NIST 800-88), paper shredding
• Document destructions as evidence of due diligence

• Defined roles: who decides, who communicates, who remediates
• Escalation and notification procedure (linked to chapter 7)
• Contact information for the CAI, the Privacy Officer, suppliers, cyber insurer
• Periodic tabletop exercises (at least annually)

Humans remain the most exploited link (phishing, misdirected emails). Provide recurring training and reminders. Our 15 essential modules cover exactly these needs.

Law 25 doesn't mandate a specific framework, but it requires reasonable measures. Rely on recognized frameworks suited to your size: the NIST Cybersecurity Framework (CSF) 2.0, ISO/IEC 27001, the CIS Controls.