Our services
Networking, cybersecurity, cloud and sovereign AI: RISS Canada supports organizations and SMBs across Quebec throughout the lifecycle of their critical environments.
Our services cover the design, deployment and operation of your networking, cybersecurity and cloud systems, with a constant focus on compliance (Law 25) and data sovereignty. Every service line is delivered by a certified team following a proven method, from the initial audit to continuous improvement. Explore our areas of expertise and our latest insights below.
A fast read of your real exposure : access, backups, email, awareness. You leave with your priorities and a clear action plan.
Start the diagnosticAnswer your cyber insurer's questionnaire with confidence: MFA, backups, EDR, logging : we put the prerequisites in place and document them.
Learn moreThe essentials, done right: multi-factor authentication, tested 3-2-1 backups, patching, least privilege and segmentation.
Lay the foundationsTrain your teams and test them with simulated phishing campaigns: your first firewall is an informed employee.
Train my teamsYour outsourced security team: monitoring, detection and response, tooling management and reporting : the RISS 360 PME managed offer.
Discover the managed offerLaw 25 and PIPEDA without the headache: policies, incident register, privacy impact assessments, designated officer and NIST alignment.
Frame my complianceA managed offering that continuously drives your security posture: monitoring, compliance and measurable improvement, without tying up your teams.
A press report mentions a cyberattack in Canada, without specifying the sector affected or the extent of the damage. This uncertainty is a useful reminder of the obligations Law 25 places on Quebec organizations in this kind of situation.
Collège du Mont Notre-Dame, in Quebec's Eastern Townships, has confirmed a cyberattack that compromised personal information. The exact scope of the data affected remains unclear, based on information currently available.
A cyberattack reportedly disrupted operations at an education sector organization, to the point of considering a delayed start of the school year. This case is a reminder that no Quebec SME or nonprofit is immune to a similar scenario.
Key points
With a factual review, never with a tool. Buying a solution before knowing your exposure is like choosing a medication before the diagnosis. Three questions are enough to set the direction, and they can be answered in an hour of conversation.
The organizations that contact us almost always arrive with a request already phrased as a solution: "we need a new firewall", "we want a penetration test", "our insurer is asking for an audit". Those requests are legitimate, but they skip a step. In roughly half of cases, the genuinely useful engagement is not the one that was requested.
An assessment to establish where you stand, a compliance engagement, an upgrade of the technical foundations, preparation for insurance questionnaires, team awareness training, and continuously managed security. Each has a written deliverable.
In four stages, in this order: assessment, prioritised plan, deployment in reversible waves, then continuous management or handover to your teams. Each stage produces a document, and each stage can be the last if you decide so.
The table below answers the question the way executives actually ask it. It is deliberately readable without knowing us, and without technical vocabulary.
| Your situation | The right engagement | Why that one |
|---|---|---|
| We have never had our security assessed | Cybersecurity assessment | Draw the map before digging, so you do not fund work that reduces nothing |
| A client or insurer has sent us a questionnaire | Cyber insurance readiness | Answer factually, find the blocking gaps, build the correction plan |
| We handle personal information and Law 25 worries us | Governance and Law 25 compliance | The obligation applies with no size threshold, and documentation is what demonstrates diligence |
| Our backups exist but have never been restored | IT security foundations | An untested backup is an assumption, not a control |
| An employee clicked a suspicious link | Awareness and simulation | What teams can recognise, they do not fall for |
| We have a plan and nobody to hold it day to day | RISS 360 | Monitoring and compliance are continuous activities, not projects |
Yes, and that is the most common case. We are not a managed IT services provider and we are not looking to replace yours. Our role is analysis, advice and oversight, which includes clarifying what their contract ought to guarantee.
This separation of roles matters. A provider who deploys the tools, sells them and then verifies their own installation has a conflict of interest, even in good faith. We earn nothing from the choice of a product, which lets us assess what is already in place and say when a contractual commitment is missing.
In practice, we regularly help executives put to their provider the questions they lacked the technical means to ask: what patching timelines are committed to, what scope the contract actually covers, and how quickly you would be notified of an incident at their end.
No single price can be published honestly, because scope depends entirely on your context: number of users and sites, what your licences already cover, applicable regulatory obligations, the real cost of an hour of downtime, the level of handover you want, and your clients' and insurer's requirements. Two organizations of the same headcount receive very different proposals for those reasons. We set out each variable on the page about building a proposal, and the first conversation exists precisely to establish them.
No, and trying is the surest way to finish nothing. The sequence we recommend is ordered: assess, fix the foundations, then validate with a technical exercise. Many organizations progress across several budget cycles, handling each year whatever reduces the most risk for the funds available. A staged plan that is actually followed beats an ambitious programme abandoned in the first quarter.
Yes. The initial assessment is free, carries no commitment, and the written summary of your principal exposure stays yours even if you do not proceed. That is a deliberate position: an organization that leaves with a clear view of its risks and decides to handle them itself has still gained something, and we prefer that to an engagement sold before it was understood.
Yes. We are based in Montérégie and work in Greater Montreal and throughout Quebec, on site and remotely. Technical reviews and most governance work are done remotely; physical infrastructure surveys, wireless coverage studies and awareness workshops happen on site. For Europe, our engagements are run with our partner RISS Consulting in France.
Say so explicitly in your message or by phone: those requests go ahead of everything else. The first hours determine a great deal, and decisions taken under pressure without a written procedure are often the ones people regret. If you have no support in place, two immediate reflexes: do not power off the affected machines, which destroys useful evidence, and write down the time and nature of what you observe.
An initial assessment, free and without commitment, to evaluate your security posture.