Ask a software vendor about the controls your work needs

Replace a broad security promise with questions tied to the information and workflow.

ContractCanvas insights

Start with the consequence

Determine what happens if an account is compromised, a file is lost or one client can see another’s records. Those consequences help prioritize access, recovery and separation tests. The same controls may not be sufficient for every type of consulting information.

Request usable evidence

Ask how access is approved and removed, how backups are restored and how incidents are handled. Request a relevant test or documented procedure, with its date and scope. A logo or certification claim should be checked for the actual service covered.

Use a baseline thoughtfully

The Canadian Centre for Cyber Security publishes baseline controls for smaller organizations. They provide a starting point for planning, including incident response and recovery. Apply the guidance to the actual systems and risks rather than presenting a checklist as certification.

Evaluate the local release honestly

ContractCanvas’s role selector organizes the demonstration. It does not authenticate users or isolate tenants. Local recovery tests establish limited behaviour, not production security. A customer considering a hosted service should require the controls and responsibilities to be implemented and tested for that service.

Sources checked

Canadian Centre for Cyber Security baseline controls · checked 16 October 2026