An independent, scope-defined cybersecurity assessment designed to produce regulator-ready evidence for Canadian Payment Service Providers (PSPs) subject to Bank of Canada supervision under the RPAA.
Most PSPs can obtain technical testing. Fewer can produce an independent assessment record that is disciplined in scope, explicit in exclusions, and defensible in how findings are evidenced and validated.
Every engagement is defined in writing before testing begins. Deliverables are designed to stand up to regulatory and third-party review.
Defined scope, boundaries, and explicit exclusions — documented before the testing window.
Rules of Engagement (RoE) are clearly documented to protect production and business operations.
Structured for supervisory consumption and partner due diligence.
Within 60–90 days, confirm remediation and provide a validation memo suitable for third-party review.
30–60 minutes focused on risk narrative, exposure summary, and a practical remediation roadmap — designed for decision-makers.
Clear boundaries protect credibility and keep the assessment defensible.
Regulators value predictability. Typical engagement cycle is 4–6 weeks from scoping to final report.
Confirm objectives, in-scope assets, exclusions, communications, and test windows.
Hands-on assessment with evidence capture and optional check-ins for early fixes.
Draft delivered for factual validation (scope confirmation, asset accuracy).
Final report delivery and optional executive readout.
Validate remediation and provide a concise validation memo with pass/fail criteria.