Cybersecurity Company in Calgary

Facility count, not analyst seniority, sets the number on Calgary OT security work: a scoped IEC 62443 OT security assessment at Calgary rates over eight to fourteen weeks across one or two facilities (pump stations, compressor stations, gas plants, or refineries), covering asset inventory, network architecture review, zone and conduit design, and a remediation roadmap, a NERC CIP compliance build for an AESO-connected entity scaled by registered functions and asset count, or an OSFI E-21 and B-13 program for ATB Financial-scale or Servus-scale clients. Managed SOC retainers tuned to energy are scoped separately. Calgary rates sit alongside Houston and Aberdeen on energy-specific work and below Toronto on pure IT cyber. Fixed-fee proposals only.

The Alberta Interconnected Electric System is operated by AESO and is part of the Western Interconnection. AltaLink, ATCO Electric, ENMAX, EPCOR, and generating asset owners that meet the registration criteria fall under NERC CIP standards (CIP-002 through CIP-014) covering BES Cyber System Categorization, Security Management Controls, Personnel and Training, Electronic Security Perimeters, Physical Security, Systems Security Management, Incident Reporting, Recovery Plans, Configuration Change Management, Information Protection, Supply Chain Risk, and Physical Security of critical Transmission stations. We deliver evidence packages, control implementations, and audit-ready documentation, and coordinate with the regional entity (WECC) on audit cycles. Final registration and audit outcomes sit with the entity and WECC.

The June 2023 Suncor cyber incident disrupted Petro-Canada retail card payments across thousands of Canadian sites, affected internal operations, and resulted in remediation and reporting work that ran into late 2023. Post-incident, Alberta energy operators have raised baselines on identity (phishing-resistant MFA, conditional access, no standing privileged access), endpoint (EDR with active threat hunting, not just alerting), email (advanced threat protection, DMARC enforcement, vendor email compromise detection), backup (immutable backups, tested restoration, segregated recovery infrastructure), and IT-OT segmentation (strict zone and conduit with monitored traversal). We deliver assessments and roadmaps explicitly mapped to the post-Suncor baseline, so boards and audit committees can demonstrate uplift against a recognized peer event.

Alberta Energy Regulator Directive 088 (Pipeline Management) covers pipeline integrity, safety, and operational management for AER-regulated pipelines. While the directive's primary focus is physical and operational safety, cyber implications are direct: SCADA integrity, leak detection systems, emergency shutdown systems, and management of change processes all depend on cyber-secure OT environments. We map cybersecurity controls to AER Directive 088 expectations, IEC 62443 zone and conduit architecture, and CSA Z246.1 (Security management for petroleum and natural gas industry systems). Cross-border pipelines (TC Energy Keystone, Enbridge Mainline) layer US TSA Pipeline Security Directives on top, and we coordinate the dual-jurisdiction posture.

The Canadian Centre for Cyber Security (CCCS, part of CSE) publishes ITSG-33, baseline controls for small and medium organizations, and threat advisories that Alberta operators reference daily. For energy operators with US-connected systems (interconnected grid, cross-border pipelines, US affiliate entities) we coordinate with FERC and NERC on the US side, CCCS and provincial regulators on the Canadian side, and CISA advisories where they apply to ICS and energy. Incident response runbooks document reporting paths to CCCS, RCMP, AESO, and US partners with timing aligned to mandatory reporting thresholds. Data residency for SCADA telemetry and corporate IT is documented per Alberta PIPA and federal PIPEDA, with cross-border flows assessed under Privacy Impact Assessments.

Yes. OSFI Guideline E-21 (Operational Resilience) and OSFI Guideline B-13 (Technology and Cyber Risk Management), in effect since 2024, apply to federally regulated financial institutions, and Alberta-headquartered entities that fall under federal regulation (or that operate across provinces) need E-21 and B-13 programs. ATB Financial is provincially regulated by the Alberta Treasury Board and Finance with parallel expectations. We deliver operational resilience programs (critical operations, severe-but-plausible scenarios, tolerances for disruption, third-party dependency mapping), technology and cyber risk frameworks, board and senior management reporting cadences, and incident reporting workflows aligned to OSFI thresholds. Provincial credit unions layer in the Credit Union Deposit Guarantee Corporation expectations where applicable.

Alberta PIPA (Personal Information Protection Act) governs personal information held by private organizations in Alberta. Federal PIPEDA applies where PIPA does not preempt, including federally regulated industries (banking, telecommunications, pipelines under federal jurisdiction) and cross-border data flows. The proposed federal Artificial Intelligence and Data Act (AIDA) under Bill C-27 would add obligations on AI systems classified as high-impact, which can include AI-driven anomaly detection, fraud detection, and security decision-making. We design data handling, retention, breach notification, and AI governance to meet all three frameworks concurrently, with documented control mapping that the Office of the Information and Privacy Commissioner of Alberta (OIPC), the Office of the Privacy Commissioner of Canada, and OSFI for federally regulated clients can review without rework.

A typical Alberta upstream or midstream cybersecurity program runs eighteen to thirty-six months end to end. Phase 1 (months 1 to 6) is discovery, IEC 62443 assessment, IT-OT asset inventory, and quick-win uplift (MFA, EDR, immutable backups, network segmentation). Phase 2 (months 7 to 18) is zone-and-conduit implementation, SCADA security uplift, SIEM and SOC operationalization, and NERC CIP build for in-scope entities. Phase 3 (months 19 to 30) is OSFI E-21 program for financial entities, tabletop exercises, red team, and cross-border coordination. Phase 4 (months 31+) is continuous improvement and audit cycles. We deliver milestone-based fixed fees instead of open T and M, and we synchronize with the operator's turnaround calendar so OT work lands during planned outages.