Get IT support leads in Canada

Because there is no register to search, the checks that would normally take a minute have to be assembled yourself. Ask how long the company has operated under its current name, ask for clients of roughly your size in roughly your industry, and telephone two of them rather than reading a testimonial. Ask whether the firm carries commercial general liability and errors and omissions coverage, and ask to see the certificate rather than a claim on a web page.

Vendor certifications held by individual technicians are real qualifications, but they are issued by the vendors whose products they cover, not by a regulator, and they say nothing about whether the company will answer the phone on a Friday afternoon. Treat them as evidence of product knowledge and nothing more.

The more useful question is what security baseline the provider works to internally and will apply to you. The Canadian Centre for Cyber Security publishes baseline controls aimed at organizations with fewer than 499 employees, covering incident response planning, patching, malware protection, secure device configuration, strong authentication, employee training, backups, mobility, perimeter defences, cloud security, website security, access control and portable media. A support company that can walk you through that list and say where you currently stand is demonstrating something a certificate cannot.

Sources: PIPEDA Fair Information Principle 1 – Accountability (Office of the Privacy Commissioner of Canada) · PIPEDA Fair Information Principle 7 – Safeguards (Office of the Privacy Commissioner of Canada) · What you need to know about mandatory reporting of breaches of security safeguards (Office of the Privacy Commissioner of Canada) · Personal Information Protection and Electronic Documents Act, section 10.3 (records of breaches) · Cyber security best practices: Contracting with managed service providers (Canadian Centre for Cyber Security) · Baseline cyber security controls for small and medium organizations (Canadian Centre for Cyber Security) · Incidents de confidentialité et mesures de sécurité – entreprises (Commission d'accès à l'information du Québec) (in French) · Breach reporting under PIPA (Office of the Information and Privacy Commissioner of Alberta)