TRA for Ontario founders and operators. A TRA is what a government buyer, a prime contractor, or an enterprise vendor-risk team asks for when they want proof you have assessed your risk and can show your work. We test the environment first, with our offensive-security partner, then write the assessment, so every risk rating traces back to something we actually found instead of a template with your logo on it.
Ontario is the centre of gravity for Canadian tech. The Toronto to Waterloo corridor holds the largest concentration of B2B SaaS, FinTech, and AI companies in the country, and Ottawa adds a completely different buyer: federal departments, defence primes, and the cybersecurity supply chain selling into them. The compliance ask changes with the buyer. Toronto and Waterloo companies get SOC 2 questionnaires from US enterprise procurement. Ottawa vendors get asked about ITSG-33 and CPCSC instead.
This is our home province. We are based in Toronto, so Ontario engagements get the tightest feedback loop we offer, in person when it helps and async when it does not. On the federal side, one thing worth saying before you sign rather than after: we deliver CPCSC Level 1 only, the self-assessed entry tier against ITSP.10.171. If a prime is asking you for a higher, third-party-assessed level, we will tell you that up front.
A TRA is what a government buyer, a prime contractor, or an enterprise vendor-risk team asks for when they want proof you have assessed your risk and can show your work. We test the environment first, with our offensive-security partner, then write the assessment, so every risk rating traces back to something we actually found instead of a template with your logo on it.
For the full service detail, see the Threat and Risk Assessment page. For fixed-price productized engagements, see pricing.
Book a free 30-minute discovery call. We’ll tell you whether this engagement fits, what it would cost, and when we could start.
Book a call