Cybersecurity Company in Victoria

Victoria security work runs at one of two depths: a focused security architecture review at Victoria rates, or a full SOC 2 Type I readiness engagement (gap assessment, remediation plan, policy library, control mapping). Scope drivers include identity, network, data, and detection coverage tied to your top five business risks. SOC 2 Type II observation periods add three months of evidence collection. Crown corporation and BC ministry engagements with OCIO sign-off requirements typically scope at the higher end because of documentation overhead. We deliver fixed-fee from our Edmonton and Chandigarh hubs on MST hours, with New York and Dubai offices for after-hours incident coverage.

Yes. The Freedom of Information and Protection of Privacy Act (FIPPA) governs BC public bodies including ministries, health authorities, post-secondary institutions, and municipalities, while the Personal Information Protection Act (PIPA) governs BC private sector organizations. We map your data inventory to FIPPA section 30.1 disclosure controls (in-Canada storage for public bodies), PIPA reasonable security obligations, and PIPEDA federal overlay where applicable. Deliverables include a Privacy Management Program aligned with OIPC BC guidance, a Privacy Impact Assessment for any new system, and breach response runbooks tied to OIPC notification expectations. We coordinate with the BC OCIO security and privacy teams when ministry sign-off is in scope and prepare materials that survive an OIPC investigation without scrambling for documentation.

We work with defence-adjacent suppliers that operate in unclassified and Protected A or B environments — naval avionics integrators, shipyard subcontractors, dual-use research groups around UVic Ocean Networks Canada, and Crown contractors holding Designated Organization Screening (DOS). We do not directly hold Top Secret clearance in-house; for Secret and above we coordinate through cleared partner firms while running unclassified architecture, identity, and SOC 2 work ourselves. Our baselines map to CCCS Top 10, ITSG-33 Annex 3 control profiles for Protected B, and NIST 800-171 where US-facing defence trade scope applies. We are familiar with Controlled Goods Program registration requirements and will flag scope items that need cleared sub-suppliers up front rather than after a procurement halt.

Most VIATEC startups we work with — Series A or B with ten to forty staff — need SOC 2 Type II to win enterprise deals from BC Hydro, Telus, ICBC, BCLC, or US Fortune 500 buyers. Readiness is a sixteen to twenty-two week engagement: weeks one to four scope the Trust Services Criteria (Security is mandatory; Availability, Confidentiality, Processing Integrity, and Privacy are scoped to client demand), inventory in-scope systems, and map controls to your actual stack. Weeks five to fourteen close gaps in change management, access reviews, vendor management, logging, and incident response. Type I report follows at week sixteen to eighteen, then a three-to-six month observation window produces Type II. We coordinate with Schellman, A-LIGN, or Prescient Assurance — whichever auditor your enterprise procurement team prefers.

We offer two tiers. Retainer clients get a defined response SLA, a pre-built playbook, evidence-preservation guidance, and on-call coverage spanning EST through MST hours plus Dubai for after-hours triage. Project clients pay time and materials at incident rates. Either way, the OIPC BC breach-notification clock starts the moment you have reasonable grounds to believe personal information has been compromised — usually 72 hours for federal PIPEDA-equivalent triggers, with BC OIPC expecting notification 'as soon as feasible.' Our runbooks pre-stage the OIPC breach report template, internal communications, customer notice drafts, and forensic preservation steps so you spend day one containing the incident rather than writing policy from scratch.

We assess and harden operational technology and ICS environments at Reliable Controls-style building automation suppliers and shipyard OT integrators, but we are clear about the boundary: deep PLC and HMI engineering is a specialist discipline and we partner with cleared OT firms (Dragos-style capability) when the scope demands hands-on PLC work. Where we do operate end-to-end is the IT-OT boundary: network segmentation, jump host design, OT-specific identity workflows, Claroty or Nozomi sensor deployment for visibility, and incident detection rules tuned to BACnet, Modbus, or Ethernet/IP traffic patterns. The control framework reference is typically IEC 62443 layered on top of ISO 27001, with CCCS guidance for critical infrastructure where federal funding or national security designation applies.

BC FIPPA section 30.1 historically required public bodies to keep personal information in Canada (relaxed in 2021 but still preferred for sensitive data), and BC OCIO standards default cloud workloads to Canadian regions. We deploy on AWS ca-central-1 (Montreal), AWS ca-west-1 (Calgary, launched 2024 — closer to Victoria for latency), Azure Canada Central (Toronto) and Canada East (Quebec City), and GCP northamerica-northeast1 (Montreal) or northamerica-northeast2 (Toronto). Customer-managed keys (CMK) sit in Canadian KMS regions. For Protected B workloads we also support GC Cloud (the federal Government of Canada hosted environment) when client procurement requires it. The Privacy Impact Assessment documents residency, encryption-at-rest, encryption-in-transit, and key-management posture so OIPC BC and OCIO reviewers have a clear answer when they ask.

Custom security work involving genuine technical uncertainty — novel detection logic for a niche protocol, custom OT-aware SIEM correlation, original cryptographic engineering, or research-grade adversary emulation — can qualify for the Scientific Research and Experimental Development (SR&ED) program. Canadian-controlled private corporations (CCPCs) earn up to 35 percent refundable credit on eligible spend up to the $3M expenditure limit, and 15 percent non-refundable above. BC layers an additional 10 percent provincial SR&ED tax credit on qualifying expenditures. Routine security configuration, off-the-shelf SOC 2 control implementation, and standard pen testing do not qualify. We deliver time-tracked technical narratives, experiment logs, failed-hypothesis documentation, and CRA T661-aligned reports. Final eligibility sits with your SR&ED consultant and CRA review.