IT Compliance That Does Not Expire Annually
Most BC businesses do compliance once during an audit and then forget about it for a year. We treat it as a continuous program: policies, evidence, training, and quarterly review baked into the managed service.
Most businesses treat compliance as an event: something done during an audit, an insurance renewal, or when a major client requires it, then forgotten for a year. By the time the next review comes around, policies are out of date, evidence is missing, and controls that were in place have drifted.
North Star, based in Prince George, BC, treats compliance as a continuous programme: policies, evidence, training, and controls maintained year-round and reviewed quarterly, baked into your managed service, not bolted on once a year when the deadline arrives.
We serve businesses across British Columbia, Alberta, and Yukon with ongoing compliance management covering PIPEDA, CASL, SOC 2 readiness, and cyber insurance requirements.
What Is Included
PIPEDA, Privacy Compliance Done Right
Data inventory documenting what personal information you collect, where it is stored, how long it is retained, and who has access. Retention schedule and consent capture aligned to PIPEDA requirements. Breach response plan documented and tested. Privacy officer support on an ongoing basis. Reviewed annually to reflect changes to your data practices.
CASL, Email and SMS Compliance
Consent management for email and SMS marketing. Opt-out mechanisms and suppression lists implemented and tested. Audit trail for consent maintained. Compliance reviewed against CRTC guidance. Your marketing team compliant with CASL without needing to be CASL lawyers.
SOC 2 Readiness
For organisations with enterprise contracts or customers that require SOC 2 attestation. Trust services criteria (security, availability, confidentiality, processing integrity, privacy) mapped to your current control environment. Gap analysis produced. Evidence collection automated where possible. Auditor-friendly artifact library maintained. North Star prepares the readiness work; you engage an independent auditor for the formal attestation.
Cyber Insurance Baseline
The controls cyber insurers require, MFA, EDR, immutable backup, incident response plan, and documented security awareness training, implemented, documented, and demonstrable. Annual questionnaire prep handled by North Star. Not just checking boxes: these controls reduce your actual risk.
How It Works
Step 1, Gap Assessment
Current state mapped against PIPEDA, CASL, SOC 2, ISO 27001, and cyber insurance baselines as relevant to your business. Priority gaps identified and a remediation roadmap produced.
Step 2, Remediate
Controls and policies implemented in priority order. Phased so you can absorb the changes operationally. Evidence collection configured. Staff training delivered.
Step 3, Document
Living policy library maintained and updated as your environment and regulatory requirements evolve. Evidence repository for audit and insurance purposes. Artifact set reviewed and updated quarterly.
Step 4, Review
Quarterly internal audit cadence. Annual external audit support for SOC 2 and ISO 27001. Cyber insurance renewal prep handled by North Star. Changes to regulation or your business reflected in the programme without waiting for the next annual review.
Who This Is For
- BC, Alberta, or Yukon businesses handling personal information subject to PIPEDA, which is most businesses
- Organisations doing email or SMS marketing subject to CASL
- Businesses pursuing enterprise contracts where SOC 2 attestation or ISO 27001 certification is required
- Any business renewing cyber insurance whose questionnaire has become more demanding year over year
What buyers ask before they sign
Does PIPEDA apply to our business?
PIPEDA applies to most private-sector organisations in Canada that collect, use, or disclose personal information in the course of commercial activities. If you have customers, collect payment information, or have employees, PIPEDA almost certainly applies to some aspect of your operations.
What is the difference between SOC 2 readiness and SOC 2 certification?
North Star prepares you for SOC 2 by implementing and documenting the required controls, automating evidence collection, and maintaining an audit-ready artifact library. The formal SOC 2 Type II report is issued by an independent CPA firm that conducts the audit. We do the preparation work; you engage the auditor for the official attestation.
How do you handle compliance for businesses in regulated industries?
For healthcare (PHIPA, PIPEDA), financial services, and legal, we map your specific regulatory obligations and build the compliance programme around those requirements. Regulated-industry compliance engagements are scoped after an initial assessment of your specific obligations.
How long does it take to get to a defensible compliance posture?
Initial gap remediation for most SMBs takes two to four months, depending on how far the current state is from the target. Ongoing compliance maintenance then continues indefinitely as part of the managed service.
Why North Star
North Star is a Prince George-based MSP serving businesses across Northern BC, BC, Alberta, and Yukon. Compliance is part of our managed service, the controls required for PIPEDA, cyber insurance, and SOC 2 are the same security controls we deploy and manage for every client. You are not buying compliance documentation separate from your security posture; the two are managed together.
Get a quote on managed compliance.
Tell us a bit about your environment and we'll come back with a scoped proposal in two business days. No obligation, no pressure.
Request a Quote Back to Managed Services