Cyber security in Edmonton that small teams can actually maintain

What does a cyber security review cover?

A review checks the controls that matter most for a small team: how people sign in, how Microsoft 365 is set up, whether backups restore, whether devices are patched, how email is protected, who can reach what and which suppliers hold your data. If you have no security department, a review is the first step toward security you can maintain without one.

• Accounts and multi-factor sign-in. Every mailbox, admin account and shared login, including those of people who have left.
• Microsoft 365 settings. External sharing, mail forwarding rules, admin roles, older sign-in methods and audit logging.
• Backups and recovery. What is copied, where the copies live, whether one copy is out of ransomware's reach, and a timed test restore.
• Devices. Operating system and application updates, disk encryption and screen locks on the laptops and phones that carry company data.
• Email security. Domain records that make your mail harder to spoof, plus filtering for attachments and links.
• Access and suppliers. Who can open payroll, client files and banking, and which outside providers hold logins or data.

The output is a written fix list in priority order, not a slide deck. Each item states the risk, the fix and the effort, so you can do the work yourself, hand it to your current provider or ask us.

What is outside our scope?

We do baseline security for small teams. We do not run simulated attacks against your systems (often called pen tests), staff a security operations centre that watches your systems day and night, or prepare you for compliance certification. When you need one of those, we say so, help you write the brief and refer you to a specialist firm.

For a company of 3 to 40 people, the gaps that matter are usually ordinary ones, and closing them costs far less than any of those services. Our baseline draws on the kind of practical advice the Canadian Centre for Cyber Security publishes for small organisations, which you can read free in the Canadian Centre for Cyber Security's guidance.

What does small-business cyber security cost in Edmonton?

Glasshead Tech prices a security review from $1,800, fixed in writing before we begin, and the work takes one to two weeks. The fixes are priced separately once you see the list, because they depend on what the review finds. Many can be done by your own staff using the written instructions.

Our pricing page sets out the bands side by side. If you want the fixes and the upkeep handled for you, that continues under managed IT support.

How do you get ready for ransomware?

Assume one day a laptop or account will be compromised, and make sure that does not take the business down with it. That means at least one backup copy ransomware cannot reach, a restore you have timed, multi-factor sign-in wherever it is offered and an agreed list of which systems come back first.

The incident-response plan we write with you is short on purpose. It names who makes decisions, who calls the bank, the insurer and customers, how staff are reached if email is down, and where a printed copy of the plan is kept. We walk your managers through it once, so the first reading does not happen mid-crisis.

What does PIPA say about reporting a breach?

Alberta's Personal Information Protection Act (PIPA) requires a business to report certain incidents to the Office of the Information and Privacy Commissioner of Alberta: those involving personal information under its control that create a real risk of significant harm for someone. Your plan should name who decides whether that test is met.

We help you record what happened, which data was involved and what was done, which is the information any report will need. That is a general description rather than legal advice, and the decision itself belongs with your lawyer or the Commissioner's office. Where your data is stored matters here too, and our note on Canadian data residency explains what that phrase does and does not cover for your systems.

Keeping the baseline in place after the review

Security slides back into old habits unless someone owns it. New staff join without multi-factor sign-in, a supplier gets admin access for a week and keeps it, a website plugin goes unpatched. The review pays off when someone rechecks the same list on a schedule, whether that is your staff, your provider or us.

Your website is one more thing that can be broken into, and our website maintenance plans keep WordPress, plugins and backups current. If the review raises bigger questions about systems, suppliers or budget, an IT consulting assessment turns them into a costed plan. Book a security review; every enquiry gets an answer within 24 hours.