# Charity Security Practice — RedactLabs

> Source: https://redactlabs.ca/practices/charities/
> Machine-readable Markdown of this page (also served at this URL under `Accept: text/markdown`).

# A five-tier practice for the Canadian nonprofit sector.

Tight budgets. Donor-data sensitivity. Board oversight. PIPEDA, Quebec Law 25, and PHIPA. The work is packaged into five board-defensible tiers — from a Sentinel Exposure Review™ to embedded leadership.

## THE FIT

- **Tiers right-sized** to charity budgets and risk profiles.
- **Board-ready output.** Plain-language reports trustees and funders can act on, delivered as the Sentinel Brief™.
- **Compliance fluency.** PIPEDA, Quebec Law 25, PHIPA, CyberSecure Canada.
- **Donor-data first.** Privacy sits at the centre of every recommendation.

## From exposure review to embedded leadership.

- TIER 0: Sentinel Exposure Review™ · A point-in-time review of your exposure, with findings prioritized for your board. The right place to start. · Fixed fee, by headcount · point-in-time exposure review · prioritized findings · board-ready summary
- TIER 1: Remediation · The highest-risk findings from the review, closed first. · Project · quoted from the Exposure Review
- TIER 2: Managed Security Essentials · Foundational managed security, reported monthly. · Monthly, per user · endpoint detection and response (EDR) · Microsoft 365 or Google Workspace posture monitoring · patching of operating systems and apps · Sentinel Watch™ external exposure monitoring · the monthly Sentinel Brief™
- TIER 3: Managed Security Professional · A security program: awareness training, vulnerability scans, an incident response plan and quarterly reporting. · Monthly, per user · everything in Security Essentials · awareness training and phishing simulation · quarterly vulnerability scans · an incident response plan and annual tabletop · 8 prepaid incident hours a year · cyber-insurance questionnaire support · a quarterly leadership report
- TIER 4: Managed IT Assured + Sentinel Advisory™ · Fully managed IT with a security program, an annual penetration test and an embedded vCISO. · Monthly, per user, plus the vCISO retainer · everything in Security Professional · an annual external penetration test · a business-hours service desk · Microsoft 365 or Google Workspace administration · device management and backup · staff onboarding and offboarding · procurement coordination · network, firewall and domain monitoring · a quarterly vCIO review · privacy-officer support · an embedded vCISO through Sentinel Advisory™

Every tier is a plan our commercial clients buy. Registered charities and places of worship receive 20% off any recurring plan.

## Compliance, written in.

- PIPEDA · Federal
- Quebec Law 25
- PHIPA · Ontario health
- CyberSecure Canada · National

## READY WHEN YOU ARE