IT Security & Confidentiality · West Vancouver, BC
IT security in West Vancouver carries a confidentiality dimension that most municipalities never see. Wealth managers, multi-family offices, boutique law and accounting practices, and HNW-adjacent advisory firms hold information whose loss is not merely a regulatory event, it is an existential one for the firm and the client. Hexafusion delivers risk assessments, security audits, written policy, and readiness work for PIPEDA, BC PIPA, PCI DSS, and SOC 2, layered with a confidentiality-control overlay built for West Van's professional services. Led by a former PCI DSS Internal Security Assessor.
Initial Assessment
Documented written report within 10 to 15 business days.
Frameworks Used
NIST CSF 2.0, CIS Critical Security Controls, CCCS Baseline.
Compliance Scope
PIPEDA, BC PIPA, PCI DSS, SOC 2 Type I & II readiness.
Coverage Areas
Ambleside, Dundarave, British Properties, Park Royal, Caulfeild, Horseshoe Bay, Eagle Harbour, Cypress Park, Lions Bay
IT security is the work that produces evidence: written reports, signed policies, completed questionnaires, and tested procedures. For a West Van wealth manager or boutique firm, the evidence has to satisfy a regulator, a cyber insurer, and a client whose discretion expectations are sometimes higher than the regulator's.
A written report of your current posture against the CIS Critical Security Controls and the CCCS baseline, with an HNW-confidentiality overlay: mailbox audit logging, ethical walls, principal-only document scopes, and registered-rep activity capture where relevant.
Targeted audits against PCI DSS (Park Royal retail and hospitality), SOC 2, ISO 27001 readiness, or a customer-driven questionnaire. We test the controls that exist, document the ones that do not, and rank fixes by effort and effect.
Acceptable Use, Access Control, Incident Response, Data Classification, Vendor Management, Business Continuity, Ethical Walls. Drafted for two-to-twelve-partner West Van practices, sized to match the firm's actual governance structure.
Mapping your data flows, documenting consent and retention, building the breach-notification procedure, and producing the safeguards documentation the Office of the Privacy Commissioner of Canada and the BC OIPC look for in recent breach decisions.
Cardholder-data-environment scoping for Park Royal retail, Ambleside hospitality, and Horseshoe Bay marine-services tenants. Led by a former PCI DSS Internal Security Assessor working alongside your QSA, not in place of them.
Trust Service Criteria mapping, control design, evidence collection, and auditor liaison. SOC 2 Type I prep typically takes 3 to 6 months; Type II adds 6 to 12 months of operating-effectiveness evidence on top.
West Vancouver hosts a confidentiality-heavy mix. A portfolio manager in Ambleside has IIROC-adjacent obligations. A family office in British Properties has client expectations that exceed any regulator. A Park Royal retail tenant has PCI scope. We tune the assessment to the reality, not to a template.
Ethical-wall controls, mailbox audit logging, principal-only document scopes, and a breach-notification path the firm's IIROC compliance contact can sign off on. Built for Ambleside and British Properties practices.
Law Society of BC and CPABC aware policy packages, conflict-check workflow review, matter-folder access models, and trust-account wire-fraud controls for Dundarave and Ambleside practices.
BCFSA-aware client data handling, transaction-management platform review, and wire-fraud BEC controls for brokerages along Marine Drive and around Park Royal.
PCI DSS scoping, network segmentation review, and POS hardening for tenants of Park Royal North and South, one of Canada's first malls.
BC PIPA-aligned access controls, EMR audit logging, and breach-notification procedure for small clinics in Ambleside and Park Royal medical adjacencies.
Seasonal-load risk modelling, off-season vulnerability remediation windows, and supply-chain security review for marine-services and Horseshoe Bay tenants.
Every West Vancouver business we onboard receives a documented security baseline aligned to the Canadian Centre for Cyber Security baseline controls and the requirements your cyber insurance carrier is asking about on renewal questionnaires. For wealth managers and HNW-adjacent practices, an additional confidentiality overlay is applied: mailbox audit logging, ethical-wall segregation, and registered-rep activity capture where relevant.
Hexafusion operates as a Dell authorized reseller and full-service IT supplier for West Vancouver businesses, with access to authorized Canadian distribution channels for Lenovo, Apple, Microsoft Surface, and networking gear from Cisco Meraki, Fortinet, SonicWall, Ubiquiti, Aruba, and Juniper. Secure procurement is part of the security program, not a sales transaction. Devices are shipped pre-imaged to the Ambleside office or the principal's British Properties home, EDR active, MFA enforced before the user touches the device.
At end-of-life we handle decommissioning to a standard your auditor and cyber insurer will accept. Drive sanitisation follows NIST Special Publication 800-88 guidelines (cryptographic erasure for SSDs, multi-pass wipe for spinning drives), every retired device generates a serial-numbered certificate of destruction for your PIPEDA breach-notification record-keeping, and devices beyond economic refurbishment are recycled through programs accredited by the Electronic Products Recycling Association (EPRA Canada).
Hexafusion is led by founder Alex Barari, a former PCI DSS Internal Security Assessor (ISA) with 15+ years in enterprise IT and cybersecurity. Risk assessments and compliance engagements with West Van firms are led by people who have sat on both sides of an audit. We do not subcontract policy work to a template generator. Every assessment is written for the firm's environment, signed off by leadership who can answer follow-up questions in the partners' meeting.
Our quarterly business review (QBR) is a real strategic report, not a generic newsletter: engagement health score, financial recap, onboarding progress, renewal calendar, and an AI-summarised executive paragraph delivered as a PDF to every client at the end of every calendar quarter. See the QBR page for a worked example.
We also serve: See all service areas →
Tell us about your practice, your regulatory exposure, and what is driving the timing. We respond within one business day with a scoped quote and timeline.
Assessment delivery times are targets and depend on the speed of data collection from your team and any third-party vendors. Policy templates are starting points; final adoption requires partner review and sign-off. Statement-of-controls timing aligns with your cyber-insurance renewal date. Tabletop exercises are documented and stored in your governance repository for auditor and regulator review.
Sibling West Vancouver pages and deep-dive cluster pages on assessment, governance, and compliance topics referenced above.
