Pick the practice, see the baseline
The standard build is the same everywhere. What changes is who asks you to prove it.
Regulated professions
Answerable to a named body for how client data is handled. These pages lead with the controls we run and the evidence we produce for that body.
- Law FirmsLaw Society of Ontario · PIPEDA · underwritersZero-trust access, encrypted client matters, and the control evidence an underwriter or a practice review asks to see.Legal IT Compliance BaselineMFA & encrypted devicesZero-trust remote accessImmutable client backupsCyber insurance controlsLaw Society alignmentPriority helpdesk
- Accounting Firmss.230 ITA · PIPEDA · CRA e-filing windowsCRA-aware record-keeping, an April escalation queue, and engineers who already run CaseWare, Profile and TaxCycle.Accounting IT Compliance BaselineEncrypted client filesTested backup recoveryCRA-aligned record-keepingCyber insurance controlsM365 Business PremiumApril escalation queue
- Medical ClinicsPHIPA · IPC Ontario · Canadian data residencyCanadian-hosted PHI, role-based EMR access, and a 4-hour recovery objective your privacy officer can point at.Healthcare IT Compliance BaselinePHIPA-aligned EMRCanadian-only PHI storage4-hour recovery objectiveResilient clinic networkEndpoint protectionSame-day on-site
General business
Answerable to an insurer and to your own continuity. These pages lead with cost shape, uptime, and what happens the week something breaks.
- Engineering FirmsPEO document control · project contract IT clausesLarge-file collaboration that does not drag, zero-trust access from field sites, and version trails that survive an audit.Engineering IT Compliance BaselineDLP on design filesVersioned, off-site backupZero-trust site accessLarge-file SharePointPEO-aware documentationEngineer-priority queue
- Small BusinessesPIPEDA · cyber-insurance controlsOne predictable line instead of a variable invoice, with security in the base plan rather than an upgrade tier.Small Business IT BaselineFlat per-user pricingCybersecurity includedVerified backupsMicrosoft 365 managedSenior-engineer helpdeskCyber insurance ready
Read across a row: it is always included
Twelve controls, five practices. Every control is in every column — that is the standard build. What changes is the name in the cell: the body that will ask you to prove it.
| Control | Law Firms | Accounting Firms | Medical Clinics | Engineering Firms | Small Businesses |
|---|---|---|---|---|---|
| MFA on every account | LSO 3.3-1 | Underwriter | PHIPA s.12 | Contract clause | Underwriter |
| Conditional access | LSO 3.3-1 | PIPEDA | PHIPA s.12 | Contract clause | PIPEDA |
| Access logging + audit | Practice review | s.230 ITA | IPC / privacy officer | PEO 1.5 | Underwriter |
| Managed EDR | Underwriter | Underwriter | Underwriter | Contract clause | Underwriter |
| Disk encryption | LSO 3.3-1 | PIPEDA | PHIPA s.12 | Contract clause | PIPEDA |
| Patching on schedule | Underwriter | Underwriter | IPC / privacy officer | Underwriter | Underwriter |
| Immutable off-site backup | LSO 3.5 | s.230 ITA | PHIPA retention | PEO 5.0 | Underwriter |
| Verified restore | Underwriter | Underwriter | 4-hour RTO | Underwriter | Underwriter |
| Canadian data residency | PIPEDA | PIPEDA | PHIPA — required | Contract clause | PIPEDA |
| Data-loss policy | LSO 3.3-1 | PIPEDA | IPC / privacy officer | PEO 1.5 — IP | PIPEDA |
| Zero-trust remote access | LSO 3.2-1 | Underwriter | PHIPA s.12 | Contract clause | Underwriter |
| Documented incident response | Practice review | PIPEDA breach | IPC reporting | Contract clause | PIPEDA breach |
Every cell is included in every published tier. The label is who asks you to evidence it, not an extra you buy.
Five pages, one standard build
These five exist because we run enough of them to say something specific. The underlying service is the same everywhere — managed IT with EDR, MFA, verified backups and Microsoft 365 administration in every tier — so a business that is not listed is not out of scope. Start from the situation instead of the sector.
Not sure which page describes you?
Book a free 30-minute assessment. A senior engineer will look at what you actually run, tell you which controls are already in place, and scope the rest — no cost and no sales pitch.