# IT Sincennes Inc. / Sincennes TI Inc.

> Canadian-owned, bilingual (English/French) cybersecurity and IT consultancy founded in 2023, based in Gatineau (Aylmer sector) and serving SMBs across Ottawa-Gatineau and Canada. Led by Patrick Sincennes, Microsoft Cybersecurity Architect Expert (SC-100). Engagements are delivered remotely over access the client grants and controls; no site visit is required. IT work is delivered as defined, fixed-fee projects — no in-place IT support, no helpdesk, no monthly managed-IT plans. Security monitoring is sold as the platform, not as staffed hours: Microsoft Sentinel and Defender XDR are implemented and tuned in the client's own tenant, with automation running 24/7 and human review in business hours — this is not a 24/7 SOC and not an MDR service. Client data is kept in Canadian cloud regions. Every page below has a French equivalent (the second link on each line).

Contact: info@sincennes.ca · (819) 329-0018 · [Contact form](https://sincennes.ca/#contact)

## Services

- [Cybersecurity assessments](https://sincennes.ca/services/cybersecurity-assessments): A risk assessment of your whole security posture, with a prioritized plan. ([FR : Évaluations de cybersécurité](https://sincennes.ca/fr/services/evaluations-cybersecurite))
- [Penetration testing](https://sincennes.ca/services/penetration-testing): Authorized, real-world testing that finds weaknesses before attackers do. ([FR : Tests d’intrusion](https://sincennes.ca/fr/services/test-intrusion))
- [Vulnerability management](https://sincennes.ca/services/vulnerability-management): Continuous scanning, risk-based prioritization and remediation tracking. ([FR : Gestion des vulnérabilités](https://sincennes.ca/fr/services/gestion-des-vulnerabilites))
- [Microsoft Sentinel implementation](https://sincennes.ca/services/microsoft-sentinel): Sentinel & Defender XDR designed, implemented and tuned — detections, automated response, cost control. ([FR : Implantation de Microsoft Sentinel](https://sincennes.ca/fr/services/microsoft-sentinel))
- [Incident response](https://sincennes.ca/services/incident-response): Response plans, tabletop exercises and ransomware readiness. ([FR : Réponse aux incidents](https://sincennes.ca/fr/services/reponse-aux-incidents))
- [Security awareness training](https://sincennes.ca/services/security-awareness-training): Bilingual phishing simulations and security awareness training. ([FR : Formation de sensibilisation](https://sincennes.ca/fr/services/formation-sensibilisation-securite))
- [Backup & disaster recovery](https://sincennes.ca/services/backup-disaster-recovery): Immutable backups, tested restores and a recovery plan — resilient to ransomware. ([FR : Sauvegarde et reprise après sinistre](https://sincennes.ca/fr/services/sauvegarde-reprise-apres-sinistre))
- [SIEM & log management](https://sincennes.ca/services/siem-logging): Centralized logging and SIEM — detect threats and keep the evidence. ([FR : SIEM et journalisation](https://sincennes.ca/fr/services/siem-journalisation))
- [Compliance & audit readiness](https://sincennes.ca/services/compliance): Which framework, in what order — audit-ready and beyond, with Drata. ([FR : Conformité et préparation à l’audit](https://sincennes.ca/fr/services/conformite))
- [SOC 2 readiness](https://sincennes.ca/services/soc-2-compliance): From gap assessment to your CPA firm’s Type 1 and Type 2 audits. ([FR : Préparation SOC 2](https://sincennes.ca/fr/services/conformite-soc-2))
- [ISO 27001 (ISMS & certification)](https://sincennes.ca/services/iso-27001): ISMS scoping, Statement of Applicability, Stage 1 & 2 readiness. ([FR : ISO 27001 (SMSI et certification)](https://sincennes.ca/fr/services/iso-27001))
- [Quebec Law 25](https://sincennes.ca/services/quebec-law-25-compliance): Quebec Law 25 made practical — privacy officer, privacy impact assessments, governance. ([FR : Conformité Loi 25](https://sincennes.ca/fr/services/conformite-loi-25))
- [Canadian Data Sovereignty](https://sincennes.ca/services/canadian-data-sovereignty): Canadian-owned, with your data kept in Canada. ([FR : Souveraineté des données](https://sincennes.ca/fr/services/souverainete-des-donnees))
- [IT projects & modernization](https://sincennes.ca/services/managed-it): Defined IT projects for SMBs — migrations, upgrades and rollouts, scoped and priced up front. ([FR : Projets TI et modernisation](https://sincennes.ca/fr/services/ti-gerees))
- [Microsoft 365 security](https://sincennes.ca/services/microsoft-365-security): Lock down Microsoft 365 — Entra, Defender, Purview, Secure Score. ([FR : Sécurité Microsoft 365](https://sincennes.ca/fr/services/securite-microsoft-365))
- [Entra ID & identity (IAM)](https://sincennes.ca/services/entra-id-consulting): Conditional access, phishing-resistant MFA and identity governance. ([FR : Entra ID et identité (GIA)](https://sincennes.ca/fr/services/consultant-entra-id))
- [Virtual CISO (vCISO)](https://sincennes.ca/services/vciso): Executive security leadership, part-time and accountable. ([FR : RSSI virtuel (vCISO)](https://sincennes.ca/fr/services/vciso))
- [Azure architecture & advisory](https://sincennes.ca/services/azure-architect-consulting): Cloud design, migration planning, cost optimization and Well-Architected reviews — data kept in Canada. ([FR : Architecture Azure et conseil](https://sincennes.ca/fr/services/architecte-solutions-azure))
- [Cloud hosting](https://sincennes.ca/services/cloud-hosting): Azure, AWS and Google Cloud — migrated, secured and hosted, with data kept in Canada. ([FR : Hébergement infonuagique](https://sincennes.ca/fr/services/hebergement-infonuagique))
- [Hardware, licensing & procurement](https://sincennes.ca/services/hardware-licensing): Lenovo and other hardware, plus Windows Server, SQL Server and Microsoft 365 licensing — right-sized, sourced and configured. ([FR : Matériel, licences et approvisionnement](https://sincennes.ca/fr/services/materiel-et-licences))
- [Domain & DNS management](https://sincennes.ca/services/domains-dns): Domains registered, locked and renewed — with DNS and email authentication (SPF, DKIM, DMARC) kept correct. ([FR : Gestion des domaines et du DNS](https://sincennes.ca/fr/services/domaines-et-dns))
- [Cloud desktops (AVD & Windows 365)](https://sincennes.ca/services/cloud-desktops): Azure Virtual Desktop and Windows 365 Cloud PCs — secure, work-from-anywhere desktops. ([FR : Bureaux virtuels (AVD & Windows 365)](https://sincennes.ca/fr/services/bureaux-virtuels))
- [AI enablement & prompt engineering](https://sincennes.ca/services/ai-enablement): Adopt Copilot and AI safely — prompt engineering, training and governance. ([FR : Adoption de l’IA et prompts](https://sincennes.ca/fr/services/adoption-ia))

## Pricing

The Microsoft 365 security assessment is sold at a published fixed fee, agreed before work starts. One Microsoft 365 tenant, one price. Figures are Canadian dollars, plus applicable taxes.

- Up to 25 users: assessment and report $1,800; assessment plus hands-on hardening $5,400
- 26–100 users: assessment and report $3,200; assessment plus hands-on hardening $9,600
- 101–250 users: assessment and report $4,800; assessment plus hands-on hardening $15,000

The assessment measures the tenant against Microsoft's security baselines and the CIS Microsoft 365 Benchmark and returns a prioritized fix list plus a report written for leadership and cyber-insurers. Hardening adds conditional access, MFA, Intune device baselines, and Defender and Purview policies. The work mostly uses licences the client already holds, so the fixed fee is typically the whole cost.

More than 250 users, or more than one tenant, is scoped on a call. The virtual CISO retainer is the other published price, at $2,500 to $8,000 a month depending on scope. Every other service is scoped first and then quoted as a fixed fee; the ranges quoted on those service pages are published market ranges, labelled as such, not this firm's prices.

On penetration testing specifically, a retest of the reported issues is part of every engagement — once the client's team has remediated, the findings are re-verified. The published market ranges, what moves them, and how to compare quotes are set out in full on the penetration-testing service page and in How Much Does a Penetration Test Cost in Canada?; those figures are market ranges, not this firm's prices.

## Free self-check tools (2 minutes, in-browser, no signup)

- [Law 25 readiness self-check](https://sincennes.ca/tools/law-25-self-check) ([FR](https://sincennes.ca/fr/outils/bilan-loi-25))
- [SOC 2 readiness self-check](https://sincennes.ca/tools/soc-2-readiness) ([FR](https://sincennes.ca/fr/outils/preparation-soc-2))
- [NIST CSF 2.0 self-assessment](https://sincennes.ca/tools/nist-csf-assessment) ([FR](https://sincennes.ca/fr/outils/evaluation-nist-csf))
- [Cyber-insurance readiness self-check](https://sincennes.ca/tools/cyber-insurance-readiness) ([FR](https://sincennes.ca/fr/outils/admissibilite-cyberassurance))

## Where we work

Engagements are delivered remotely across all of Canada — every province and territory — over access the client grants and controls, so no site visit is required and no travel is billed. That includes Ontario, Quebec, British Columbia, Alberta, Saskatchewan, Manitoba, New Brunswick, Nova Scotia, Prince Edward Island, Newfoundland and Labrador, Yukon, the Northwest Territories and Nunavut. Work is scheduled in the client's own time zone; the firm operates on Eastern time from Gatineau, Quebec (Aylmer sector) in the Ottawa-Gatineau region, which is the only place it holds a local presence. Service is bilingual, in English or French, everywhere.

Regional pages below. The first group is the home region; the second is a per-city page for markets served remotely, each carrying the privacy statute, regulator and time-zone overlap that actually applies there — the facts differ by jurisdiction, which is what the pages are for.

- [Cybersecurity in Ottawa](https://sincennes.ca/cybersecurity-ottawa) ([FR](https://sincennes.ca/fr/cybersecurite-ottawa))
- [Cybersecurity in Gatineau](https://sincennes.ca/cybersecurity-gatineau) ([FR](https://sincennes.ca/fr/cybersecurite-gatineau))
- [Penetration testing in the Outaouais](https://sincennes.ca/penetration-testing-outaouais) ([FR](https://sincennes.ca/fr/test-intrusion-outaouais))
- [Virtual CISO in the Outaouais](https://sincennes.ca/virtual-ciso-outaouais) ([FR](https://sincennes.ca/fr/rssi-virtuel-outaouais))
- [Law 25 compliance in the Outaouais](https://sincennes.ca/law-25-compliance-outaouais) ([FR](https://sincennes.ca/fr/conformite-loi-25-outaouais))
- [IT services in Gatineau](https://sincennes.ca/it-services-gatineau) ([FR : Services TI à Gatineau](https://sincennes.ca/fr/services-ti-gatineau))

- [Cybersecurity in Calgary, Alberta](https://sincennes.ca/cybersecurity-calgary): private-sector privacy law Alberta PIPA; regulator Office of the Information and Privacy Commissioner of Alberta. Delivered remotely; no local office. ([FR](https://sincennes.ca/fr/cybersecurite-calgary))
- [Cybersecurity in Vancouver, British Columbia](https://sincennes.ca/cybersecurity-vancouver): private-sector privacy law British Columbia PIPA; regulator Office of the Information and Privacy Commissioner for British Columbia. Delivered remotely; no local office. ([FR](https://sincennes.ca/fr/cybersecurite-vancouver))
- [Cybersecurity in Victoria, British Columbia](https://sincennes.ca/cybersecurity-victoria): private-sector privacy law British Columbia PIPA; regulator Office of the Information and Privacy Commissioner for British Columbia. Delivered remotely; no local office. ([FR](https://sincennes.ca/fr/cybersecurite-victoria))
- [Cybersecurity in Toronto, Ontario](https://sincennes.ca/cybersecurity-toronto): private-sector privacy law federal PIPEDA; regulator Office of the Privacy Commissioner of Canada. Delivered remotely; no local office. ([FR](https://sincennes.ca/fr/cybersecurite-toronto))
- [Cybersecurity in Whitehorse, Yukon](https://sincennes.ca/cybersecurity-whitehorse): private-sector privacy law federal PIPEDA; regulator Office of the Privacy Commissioner of Canada. Delivered remotely; no local office. ([FR](https://sincennes.ca/fr/cybersecurite-whitehorse))
- [Cybersecurity in Yellowknife, Northwest Territories](https://sincennes.ca/cybersecurity-yellowknife): private-sector privacy law federal PIPEDA; regulator Office of the Privacy Commissioner of Canada. Delivered remotely; no local office. ([FR](https://sincennes.ca/fr/cybersecurite-yellowknife))
- [Cybersecurity in Iqaluit, Nunavut](https://sincennes.ca/cybersecurity-iqaluit): private-sector privacy law federal PIPEDA; regulator Office of the Privacy Commissioner of Canada. Delivered remotely; no local office. ([FR](https://sincennes.ca/fr/cybersecurite-iqaluit))

## Insights (articles)

- [The CLOUD Act and Canadian Data: What It Means](https://sincennes.ca/insights/cloud-act-canada-data): A US-controlled provider answers to US law wherever your data sits. What that means for your M365 or AWS tenant — and what actually mitigates it. ([FR : Le CLOUD Act et vos données canadiennes](https://sincennes.ca/fr/perspectives/cloud-act-donnees-canadiennes))
- [Quebec’s EFVP: Privacy Impact Assessments (Law 25)](https://sincennes.ca/insights/quebec-efvp-explained): When Law 25 requires a privacy impact assessment, and how to run one that holds up — explained in English, step by step, at SMB scale. ([FR : Réaliser une EFVP : guide pratique pour PME](https://sincennes.ca/fr/perspectives/realiser-une-efvp-guide-pme))
- [How Much Does a Penetration Test Cost in Canada?](https://sincennes.ca/insights/penetration-testing-cost-canada): Real CAD ranges by test type, what moves the price up or down, and the red flags in quotes that look too cheap to be true. ([FR : Combien coûte un test d’intrusion au Québec?](https://sincennes.ca/fr/perspectives/cout-test-intrusion-quebec))
- [What Cyber Insurers Require: The Controls You Need](https://sincennes.ca/insights/cyber-insurance-requirements-canada): Insurers now ask for MFA, EDR and tested backups before they’ll quote. What underwriters check — and how to walk into renewal ready. ([FR : Cyberassurance : les contrôles exigés de votre PME](https://sincennes.ca/fr/perspectives/exigences-cyberassurance-pme))
- [What a Virtual CISO Costs in Canada](https://sincennes.ca/insights/virtual-ciso-cost-canada): No two vCISO quotes look alike. Real Canadian ranges, what moves the fee up or down, and how to compare providers fairly. ([FR : Combien coûte un RSSI virtuel au Canada?](https://sincennes.ca/fr/perspectives/cout-rssi-virtuel-canada))
- [Quebec Law 25, Explained for SMBs](https://sincennes.ca/insights/quebec-law-25-explained-for-smbs): What Quebec’s Law 25 actually requires of a small or mid-sized business — in plain language, from a local bilingual firm. ([FR : La Loi 25, c’est quoi pour une PME?](https://sincennes.ca/fr/perspectives/loi-25-expliquee-pour-les-pme))
- [Data Residency vs. Data Sovereignty](https://sincennes.ca/insights/data-residency-vs-data-sovereignty-canada): They sound interchangeable — but the difference decides whether a US law can reach your Canadian data. ([FR : Résidence ou souveraineté des données?](https://sincennes.ca/fr/perspectives/residence-vs-souverainete-des-donnees))
- [SOC 2 or ISO 27001 for SMBs?](https://sincennes.ca/insights/soc-2-vs-iso-27001-for-smbs): Two security frameworks, different buyers. How to pick the right one for a growing SMB. ([FR : SOC 2 ou ISO 27001 pour une PME?](https://sincennes.ca/fr/perspectives/soc-2-ou-iso-27001-pour-pme))
- [How to Choose a Cybersecurity Consultant in Ottawa-Gatineau](https://sincennes.ca/insights/how-to-choose-a-cybersecurity-consultant): Stop paying for automated scans dressed up as penetration tests. What to look for, questions to ask, and how to assess your baseline first. ([FR : Comment choisir un consultant en cybersécurité en Outaouais](https://sincennes.ca/fr/perspectives/comment-choisir-consultant-cyber-outaouais))

## Glossary

- [Cybersecurity glossary, in plain language](https://sincennes.ca/glossary): 32 terms with per-term anchors ([FR : Lexique](https://sincennes.ca/fr/glossaire))

## Optional

- [llms-full.txt](https://sincennes.ca/llms-full.txt): this index plus firm facts, the home-page FAQ and full glossary definitions, for assistants that want the content inline
- [How we work](https://sincennes.ca/how-we-work) ([FR](https://sincennes.ca/fr/comment-nous-travaillons))
- [About the firm](https://sincennes.ca/About) ([FR](https://sincennes.ca/fr/a-propos))
- [Security policy](https://sincennes.ca/security) ([FR](https://sincennes.ca/fr/securite))
- [Privacy](https://sincennes.ca/Privacy) ([FR](https://sincennes.ca/fr/confidentialite))
- [Sitemap](https://sincennes.ca/sitemap.xml) · [Atom feed](https://sincennes.ca/feed.xml) ([FR](https://sincennes.ca/fr/feed.xml))