Cybersecurity Company in Edmonton

Whether the estate includes OT is the biggest single swing on an Edmonton security engagement, and each engagement is scoped and quoted in CAD. A scoped external network penetration test is a three to five week engagement sized against attack surface. Web, mobile, and internal Active Directory pen testing are scoped per application or per estate. An OSFI B-13-aligned cyber risk assessment suits an Alberta credit union or ATB-tier institution. OT/ICS assessments for an oil sands or pipeline operator under IEC 62443 cost more because of the site travel, lab work, and protocol depth involved. A managed SOC retainer with 24x7 monitoring scales from small Alberta SMBs up to energy and financial clients. Edmonton sits 15 to 25 percent below Toronto and Calgary for equivalent depth because our overhead is lower.

Yes. OT and ICS work is the differentiator for an Edmonton-based shop. Our engagements follow IEC 62443 zone-and-conduit methodology, NIST SP 800-82 (Guide to ICS Security), and the Canadian Centre for Cyber Security guidance for critical infrastructure, layered with AER Directive 088 for pipeline safety where applicable. We are explicit about safety boundaries: passive reconnaissance and architecture review first, with active testing confined to scheduled maintenance windows or isolated lab environments. We do not run aggressive scanning against a live process control network. Our team has supported tabletop exercises with OT site teams, threat modelling against the Purdue Model for upstream and midstream environments, and segmentation reviews aligned with the asset owner’s safety case. For grid operators under NERC CIP, we map evidence to CIP-002 through CIP-014 with auditor-ready documentation.

PIPEDA is the federal private-sector privacy law and applies to most commercial activity. Alberta PIPA is the provincial equivalent and is recognised as substantially similar to PIPEDA, so Alberta-based companies dealing with Alberta personal information generally operate under PIPA. The Health Information Act (HIA) governs health information custodians in Alberta and applies the moment your environment touches PHI inside the Alberta health system or integrates with Alberta Netcare or Connect Care (Epic). For a cyber program that means: breach notification to the Office of the Information and Privacy Commissioner of Alberta within the statutory window (real risk of significant harm test), a documented Privacy Impact Assessment for HIA-scope systems, encryption at rest and in transit, role-based access with audit logging on PHI, and an incident response plan that lists the OIPC and the affected custodians as named contacts. We build that scaffolding into the program rather than treating it as a checkbox at audit time.

Yes. OSFI Guideline B-13 (Technology and Cyber Risk Management) applies to federally regulated financial institutions and is treated as the de-facto bar by provincial credit unions and ATB through Credit Union Deposit Guarantee Corporation expectations. We deliver B-13-aligned programs covering governance and risk appetite, technology asset and configuration management, technology resilience, technology operations, identity and access management, threat and vulnerability management, cyber incident management, technology risk assessment for third parties, and reporting to the board risk committee. Evidence is packaged in a format that OSFI examiners and internal audit accept without re-mapping. We also align cyber incident reporting timelines with OSFI’s 24-hour material incident expectation under the Technology and Cyber Security Incident Reporting Advisory, and we have run tabletop exercises that rehearse that exact notification path.

Yes, and it is the most useful thing we do. Tabletop exercises happen at Codazz HQ downtown Edmonton in a half-day or full-day format covering ransomware, OT compromise (energy clients), wire fraud (financial clients), data exfiltration with extortion, and supply-chain compromise scenarios. Participants typically include the CISO, CIO, COO, legal counsel, communications lead, and a board observer. Founder Raman Makkar is in the room for major-account engagements rather than the offshore-handoff pattern. Red team workshops cover threat modelling against the MITRE ATT&CK matrix tailored to your sector (energy, finance, public sector, SaaS), assumed-breach scenario design, and detection engineering gaps in the current SIEM and EDR posture. For Calgary, Red Deer, and Lethbridge clients we travel or host at Edmonton HQ depending on preference. For US and East Coast Canadian clients the kickoff is on-site and ongoing cadence is hybrid.

Honestly and explicitly. There is no Alberta-resident hyperscaler region today. AWS ca-central-1 is in Montreal, Azure Canada Central is in Toronto, and GCP northamerica-northeast1 is in Montreal with northamerica-northeast2 in Toronto. For most Alberta clients, Canadian residency in Montreal or Toronto satisfies PIPEDA, Alberta PIPA, and OSFI B-13 expectations because the data stays in Canada under Canadian jurisdiction. For workloads that genuinely require Alberta-resident processing (a small number of provincial government and AHS workloads), we architect using Alberta-based data centre operators (eStruxture, Cologix, Telus Calgary and Edmonton facilities) with documented residency commitments. We document the residency strategy in the system security plan rather than letting it become an audit finding at year three. We also document the cross-border posture explicitly when frontier AI services (Anthropic, OpenAI) are consumed, with a Privacy Impact Assessment supporting the decision.

Endpoint count and sector are what tier an Alberta incident response retainer, so retainers are scoped per client. A baseline IR retainer suits SMBs under 200 endpoints and covers a 4-hour response SLA, a named lead handler, and pre-negotiated forensic tooling access. Mid-market retainers (200 to 2,000 endpoints) add 1-hour critical response, monthly tabletop participation, and integrated SOC handoff. Energy and financial sector retainers add 24x7 escalation, on-site response capability within four hours across the Edmonton-Calgary corridor, and OT response capability for industrial clients. Drawdown work (active incident hours) is billed at a discounted rate against the retainer. We have a documented relationship with the Canadian Centre for Cyber Security and the RCMP National Cybercrime Coordination Unit for escalation paths, and we coordinate with the OIPC for breach notification timing rather than letting clients miss the statutory window.

Yes. The Edmonton SaaS scene (Jobber, Showbie, Vendasta-adjacent, plus a long tail of Series A and B startups out of Startup Edmonton and A100) typically faces SOC 2 first because US enterprise customers ask for it. We deliver SOC 2 readiness with a CC criterion-by-criterion control map, evidence collection automation through Drata, Vanta, Secureframe, or Thoropass, and audit support through Schellman, A-LIGN, or Canadian firms like MNP. ISO 27001 follows similar mechanics with a 114-control Statement of Applicability and a 6 to 12 month observation period for certification. PCI DSS engagements (for fintechs touching payment card data) involve scope reduction first (tokenisation, P2PE, hosted payment pages) and then a SAQ or Report on Compliance through a QSA. We have walked Alberta SaaS through all three frameworks and we are explicit that SOC 2 readiness is achievable in 12 to 16 weeks, while a Type II report requires a 6 to 12 month observation window that no amount of fee will compress.