- Home
- Industries
- Government
Keep public services running,
and public trust intact.
Federal, provincial, municipal and Indigenous governments, agencies, Crown corporations and police services hold data citizens cannot opt out of giving. We watch around the clock, respond in minutes and help you account for every incident. Government agencies train with us.
Why attackers target the public sector.
Essential services, sensitive records and stretched IT teams make every level of government a target.
Ransomware on municipal services
Groups encrypt billing, permitting and records systems, knowing residents notice within hours and councils feel the pressure. Many now steal data before they encrypt.
State-sponsored espionage
Foreign intelligence services target policy files, negotiating positions and the people who hold them. They are patient and prefer access that lasts.
Citizen data theft
Tax, benefits, licensing and health records are permanent and valuable. One compromised system can expose a whole population.
Credential and identity attacks
Phishing, password spraying and stolen session tokens against cloud email and collaboration tools are the most common way in.
Police and justice systems
Case files, evidence and informant records carry risk to safety and to prosecutions. A breach can compromise investigations and court outcomes.
Shared services and suppliers
Shared IT providers, software vendors and inter-agency connections link many organizations. A breach at one can reach all of them.
The rules you answer to.
Federal policy first, then provincial and municipal privacy law, then the principles and statutes that apply to Indigenous governments and Crown corporations.
| Framework | Who it applies to | What we help with |
|---|---|---|
| TBS Policy on Government Security and Directive on Security Management | Federal departments and agencies | Security controls assessment, continuous monitoring, and incident handling that fits the Government of Canada Cyber Security Event Management Plan |
| Privacy Act and the TBS Policy on Privacy Protection | Federal government institutions | Breach investigation and the facts needed to report a material privacy breach to the OPC and TBS on time |
| Ontario FIPPA and MFIPPA | Ontario ministries, agencies and provincial institutions; municipalities, police services boards and local boards | Breach investigation to support notice to individuals and the IPC, safeguards assessment and documented incident records |
| Enhancing Digital Security and Trust Act, 2024 (Ontario) | Prescribed Ontario public sector entities | Cyber security maturity assessment, programme design and the incident facts needed to report critical incidents within 72 hours |
| Other provincial public sector privacy laws, such as BC's FIPPA and Alberta's Protection of Privacy Act | Provincial public bodies, municipalities and municipal police in each province | Harm assessment support for breach notification, privacy management programme input and safeguards review |
| Quebec Law 25 and the public sector access act | Quebec public bodies, including ministries and municipalities | Confidentiality incident investigation, the incident register and privacy impact assessment input |
| OCAP® principles (FNIGC) | First Nations governments and organizations that hold community data | Data governance and residency design that keeps ownership, control, access and possession with the Nation |
| Critical Cyber Systems Protection Act (Bill C-8, Royal Assent June 2026, not yet in force) | Operators of vital systems in federally regulated sectors, including Crown corporations, once designated by order | Cyber security programme design, supply-chain risk and incident reporting readiness |
Specialist work for public institutions.
Law enforcement training
Digital forensics, evidence handling and cybercrime investigation training for police services, taught by practitioners who work live cases. See law enforcement training.
Evidence that survives court
Forensic work and chain-of-custody documentation built for prosecutions, disclosure and access-to-information review, packaged on TYR.
Council and executive exercises
Tabletop exercises that walk elected officials and senior staff through a ransomware event, including public communication and service continuity decisions.
How we help governments and agencies.
MSOC
An autonomous SOC watching your networks and cloud tenants around the clock, containing threats in under two minutes, with senior analysts on top.
Learn more →IR retainer
Pre-agreed terms and guaranteed response from four hours down to one, so the team answers first when something goes wrong.
Learn more →SKULDLaw enforcement training
Forensics, evidence handling and cybercrime investigation training for police services and investigative agencies.
Learn more →BifrostDigital forensics
What was accessed, by whom and when, documented to a standard prosecutors, regulators and courts accept.
Learn more →ForsetiGRC & compliance
Ongoing control management and evidence for provincial security requirements and privacy obligations, kept current between reviews.
Learn more →Tabletop exercises & playbooks
Rehearse a public-facing incident with council, executives and communications before it happens.
Learn more →What buyers ask.
We are a municipality, not a federal department. Do we need a 24/7 SOC?
Attackers time ransomware for nights, weekends and long weekends because that is when nobody is watching. Your residents rely on your services around the clock, and detection should run the same way.
Will an autonomous SOC take systems offline without asking?
No. It acts inside boundaries you set, logs everything and takes nothing irreversible without senior sign-off. You can run it human-in-the-loop until you are comfortable.
Where does our data live?
100% Canadian-owned, with primary operations in Canada. We deploy to meet each client's data-residency requirements, and Canadian clients' data stays in Canada.
Will you negotiate with attackers if we are hit by ransomware?
Yes, when it helps. Our responders negotiate with threat actors after identification and sanctions screening, to buy time, gather intelligence and protect your options while we contain and recover. We never recommend paying a ransom.
Talk to someone who has worked with government.
Put a specialist on a call to scope monitoring, response or law enforcement training. No charge, no commitment.