An OEM customer, an enterprise client or a quality-system audit wants answers about your IT security, usually with a deadline. Send us the questionnaire and we take a free first look: which questions you can answer today, which need evidence, and a gap list for the rest. We also run recurring quarterly external scans for suppliers who are asked for them.
Tell us who is asking and when it is due. We'll reply so you can send the questionnaire securely.
We won't sell your data or send you marketing you didn't ask for.
For many Ontario businesses the toughest security reviewer is not a regulator. It is a customer: an OEM checking its supply chain, an enterprise client's vendor-risk team, or a quality-system audit that now looks at IT controls alongside ISO 9001 or IATF 16949-type supplier requirements.
Manufacturers are asked for things like recurring external vulnerability scans, MFA on remote access, backup and recovery evidence and an incident response plan. Professional firms get the same questions from enterprise clients, often as a condition of keeping the work.
The free first look suits anyone holding a questionnaire they are not sure how to answer accurately. If you need formal certification or an independent audit opinion, that comes from an auditor, not an IT provider, and we will say so.
Related: IT compliance in Ontario, free external vulnerability scan, managed IT for manufacturers and cyber insurance questionnaire review.
IT Compliance in OntarioEvery questionnaire is worded differently, but the same controls come up again and again. This is how they typically appear.
Typical requirements, not a universal list. Your customer's document is what counts, so we read it rather than assume. Where you cannot yet answer yes, we tell you which gaps block the business and which can wait.
We read the questionnaire the way your customer's reviewer will, and sort every question by how ready you are to answer it.
Controls already in place, with a note on what evidence would back up each answer.
Controls you probably have but cannot yet show: a policy, a report, a log or a screenshot.
Controls that are not in place, sorted by whether they are likely to block the contract or the audit.
What can realistically be closed before the due date, and how to answer honestly about the rest.
Where a customer asks for recurring scans, we can run quarterly external vulnerability scans as an ongoing service.
If we support your IT, our SOC 2 Type 2 bridge letter is available without an NDA, and the full report under NDA.
Where a question could be read two ways, the clarification worth asking your customer before you answer.
Answers organized so next year's questionnaire, or the next customer's, is a collation exercise rather than a scramble.
There is no upload on this page. Tell us who is asking and when it is due, and we reply with a secure way to send the questionnaire.
The customer, OEM or auditor, the deadline, and a contact.
We reply with a secure way to share the questionnaire and any earlier answers you have.
Every question sorted into ready, needs evidence or gap, usually within a few business days.
We go through the gaps against your deadline. Help closing them is available, but never assumed.
If the deadline is close, tell us the date. We will be honest about what is achievable and what should be answered as in progress.
Every question marked ready, needs evidence or gap.
Gaps ordered by how likely they are to block the contract or the audit.
What a reviewer will usually accept as proof for each answer.
Where an answer should say in progress rather than yes, and how to phrase it accurately.
If your customer wants quarterly external scans, a clear description of what that service involves.
Some suppliers take the gap list to their own IT team. That is a fine outcome too.
A questionnaire answered too optimistically becomes a commitment you cannot meet. We would rather tell you which answers are really a no while there is still time to fix them.
Yes. We run recurring quarterly external vulnerability scans as a service and give you reviewed results you can share with your customer. If you want to see what a scan looks at first, start with our free external scan on one public IP.
No. Those are quality-management standards assessed by registrars and your customers, not by an IT provider. What we can do is help with the IT security controls and evidence that supplier requirements and audits increasingly ask for.
There is no upload on this page. Tell us who is asking and the deadline, and we will reply with a secure way to send it.
The paperwork usually is. Whether every answer can honestly be yes depends on what is already in place. We will tell you which gaps can be closed in time and which should be answered accurately as in progress.
We help you answer the technical sections accurately and can suggest wording, but the answers are yours to submit. We will never suggest saying yes to a control that is not in place.
No. The first look is free and has no obligation. If another provider runs your IT, we can work alongside them.
Yes. There is no charge for the first look or the gap list, and no card details are collected. Work to close the gaps is quoted separately, and only if you ask.
Tell us who is asking and when it is due. We'll reply so you can send the questionnaire securely. NetFusion Designs is SOC 2 Type 2 audited, with offices in Markham, Toronto, Kitchener, Mississauga, Pickering and Montreal.
%20(1).avif){kind=logo}
%201.avif)
