How the directory works

What a listing is

Each listing summarizes what a firm says about itself on its own website: the services it lists, the frameworks it names, its head office, and credentials it states. We record the pages we read, and the date.

What it is not

A listing is not a ranking, a recommendation, a review, or a verification that a firm is certified or qualified. A framework tag means the firm’s site names that framework. Confirm any credential directly with the firm and the body that issues it.

Scope

The directory covers security-first firms, meaning companies whose main business is cybersecurity or compliance. It does not currently list general IT managed service providers or large multi-service consultancies, where security is one line of a much broader offering. This is a scope choice that applies to everyone equally, and it is not a judgment of any firm’s quality.

Inclusion

We include firms with a Canadian head office or a Canadian office named on their site that offer cybersecurity or compliance services. There is no charge to be listed and no way to pay for a better listing, a higher position, or a different description. The directory is sorted alphabetically.

Profiles

Firms are tagged as a specialist when they describe essentially one discipline, focused when they describe a few related ones, and full service when they describe a broad portfolio. That is our reading of the firm’s website and is meant to help you find the right kind of firm, not to rate it.

Corrections and removal

Firms can ask us to correct or remove a listing at any time. Use the contact form from an address at the firm’s domain. We check changes against the firm’s website before we make them.