HSM IT ServicesGuides for running safer IT.
Plain-language guides for Alberta business owners and office managers: privacy rules, everyday security, keeping the lights on, and the people side of security.
Privacy and compliance
What Alberta's PIPA means for your IT
Alberta's Personal Information Protection Act sets rules for how private-sector organizations collect, use, secure and dispose of personal information. Here is what that means in practical terms for your computers, accounts, backups and service providers.
ReadResponding to a privacy breach under PIPA
When personal information is lost, stolen or exposed, Alberta's PIPA may require you to notify the Information and Privacy Commissioner. This guide walks through the first hours, the real risk of significant harm test and what to document.
ReadHIA basics for clinic IT
Alberta's Health Information Act places specific duties on custodians such as physicians, pharmacists and other regulated health professionals. This guide explains what the HIA means for the computers, systems and IT vendors that support a clinic.
ReadPrivacy law changes for Alberta public bodies
In 2025 Alberta replaced FOIP with two new statutes: the Access to Information Act and the Protection of Privacy Act. Here is what municipalities, school authorities and other public bodies should review in their IT environment.
ReadCRA record keeping and your electronic records
The Canada Revenue Agency expects businesses to keep books and records for a set period and to be able to produce them on request. This guide covers what that means for accounting software, scanned receipts, backups and old computers.
ReadCyber insurance questionnaires decoded
Cyber insurance applications ask detailed questions about your security controls, and inaccurate answers can create problems at claim time. This guide explains what the common questions mean and how to answer them honestly.
ReadWriting an acceptable use policy
An acceptable use policy tells staff how they may use company computers, accounts and data. A short, clear policy supports your privacy obligations, reduces risk and gives managers something concrete to point to when problems arise.
ReadStoring business data outside Canada
Most cloud services store at least some data outside Canada. This guide explains what Alberta and federal privacy law expect when personal information leaves the country, and how to make informed decisions about data residency.
ReadIT management
How to choose a managed IT provider in Alberta
Choosing a managed IT provider is a long-term decision that affects security, productivity and cost. This guide covers the questions to ask, the warning signs to watch for and how to compare proposals fairly.
ReadBuilding an IT budget
A realistic IT budget helps you avoid surprise expenses, plan hardware replacements and invest in security before something goes wrong. This guide breaks down the main categories and offers a practical way to build your first budget.
ReadOnboarding and offboarding checklist
Consistent onboarding gets new staff productive on day one, and consistent offboarding closes access before it becomes a security or privacy problem. Use this checklist as a starting point for your own process.
ReadMicrosoft 365 licensing explained
Microsoft 365 comes in many plans with overlapping features, which makes it easy to pay for the wrong thing. This guide explains the main business plans, what the differences mean for security and how to review your licences.
ReadWhen to replace business computers
Keeping computers too long costs money in lost time and security risk, while replacing them too early wastes budget. This guide explains the signs that a computer is due for replacement and how to plan a sensible refresh cycle.
ReadRemote work security for Alberta teams
Remote and hybrid work is now routine for many Alberta organizations, from Calgary offices to staff in small towns and acreages. This guide covers the practical controls that keep remote work productive and secure.
ReadChoosing between cloud and on-premises servers
Many small organizations still run a server in a back room, while others have moved everything to the cloud. This guide compares the two approaches on cost, reliability, security and connectivity so you can choose what fits your situation.
ReadDocumenting your IT environment
Good IT documentation lets anyone supporting your organization find passwords, configurations and vendor contacts quickly. This guide covers what to record, where to keep it and how to stop it going out of date.
ReadBusiness continuity
Planning for wildfire evacuation as a business
Wildfire evacuations have affected communities across Alberta, sometimes with very little notice. This guide explains how to prepare your people, data and systems so your business can keep operating if you have to leave.
ReadInternet options for rural Alberta offices
Offices outside Alberta's larger centres often have fewer internet choices and longer repair times. This guide compares fibre, fixed wireless, cellular and satellite options and explains how to build a reliable connection with a backup.
ReadPreparing your office for winter outages
Alberta winters bring power interruptions, blizzards that close roads and cold snaps that stress buildings and equipment. This guide covers the practical IT steps that keep your office running, or recovering quickly, through the worst of the season.
ReadFlood preparedness for business IT
Floods have caused serious damage to businesses in Alberta, most notably during the 2013 southern Alberta floods. This guide explains how to reduce flood risk to your IT systems and recover faster if water reaches your office.
ReadWriting a business continuity plan
A business continuity plan describes how your organization keeps critical work going during a disruption and recovers afterward. This guide shows small and mid-sized organizations how to write a practical plan without a large consulting project.
ReadTesting your backups
Most organizations have backups, but far fewer know whether those backups will actually work when needed. This guide explains how to structure backups, protect them from ransomware and test restores on a regular schedule.
ReadSecurity how-to
Setting up MFA across your business
Multi-factor authentication blocks most password-based break-ins, but only if it covers every account that matters. This guide walks through planning, choosing methods, rolling it out to staff and closing the gaps attackers look for.
ReadWhat to do in the first hour of a ransomware attack
The decisions made in the first hour of a ransomware incident shape how long recovery takes and how much evidence survives. Here is a calm, practical sequence for business owners and office managers to follow.
ReadPassword managers for teams
A business password manager lets staff use long, unique passwords without writing them down, and gives the organization control over shared credentials. This guide covers choosing one, rolling it out and the habits that make it work.
ReadSecuring Microsoft 365: the first ten settings
Microsoft 365 ships with useful security features, but many are not configured for you. These ten settings give a small or mid-sized business a much stronger starting point without buying additional products.
ReadBackups that survive ransomware: the 3-2-1-1 rule
Ransomware groups now target backups before they encrypt anything else. The 3-2-1-1 rule adds an immutable or offline copy to the classic approach, giving your business a recovery path attackers cannot easily destroy.
ReadSecuring your office Wi-Fi
Office Wi-Fi is often set up once and forgotten, with old passwords and guests on the same network as company systems. These steps separate traffic, strengthen encryption and keep the network under control.
ReadPatch management without the pain
Unpatched software is one of the most common ways attackers get in, yet updates are often delayed because they interrupt work. A simple, predictable patch routine keeps systems current without frustrating staff.
ReadWhy admin rights matter
When everyday users have administrator rights, a single bad click can give an attacker control of the whole computer, or worse. Removing those rights is a low-cost change that blocks a large share of common attacks.
ReadEmail authentication: SPF, DKIM and DMARC
SPF, DKIM and DMARC help prove that email from your domain is really from you and tell receiving servers what to do with fakes. Setting them up correctly protects your clients and improves delivery of legitimate mail.
ReadMobile device security
Phones and tablets now carry company email, files, MFA apps and client conversations. This guide explains how to protect business data on mobile devices, whether the business owns them or staff use their own.
ReadHow to read a penetration test report
A penetration test report can run to dozens of pages of technical findings. This guide helps business owners and managers understand the structure, judge what matters and turn the results into a practical action plan.
ReadVendor and supply chain risk
Your IT provider, software vendors and service partners can all become a path into your business. This guide shows how small and mid-sized organizations can assess and manage vendor risk without a large compliance team.
ReadLayer 8
How to spot a phishing email
Phishing emails are designed to look routine, so spotting them depends on noticing small details and pausing at the right moment. This guide covers the warning signs, the common lures and what staff should do next.
ReadHow to run a tabletop exercise
A tabletop exercise is a guided discussion where your team works through a realistic incident on paper. It reveals gaps in plans, contacts and decision-making before a real crisis does, and it costs very little to run.
ReadStopping invoice and e-transfer fraud
Invoice and payment redirection fraud can cost a business a large sum in a single transaction. Clear verification rules, strong email security and well-trained finance staff are the best defences.
ReadProtecting against gift card scams
Gift card scams trick staff into buying cards and sending the codes to someone posing as a boss or official. A clear policy and a few simple habits can stop these requests before any money is lost.
ReadSecuring a home office
Remote and hybrid work is now routine, but home offices are rarely set up with security in mind. These practical steps help staff protect business data at home without turning their household upside down.
ReadBuilding a security culture in a small team
In a small team, security depends less on policies and more on everyday habits and how people feel about speaking up. This guide covers practical ways to make secure behaviour normal, without fear or heavy process.
ReadPhishing simulations that don't punish people
Phishing simulations can build real skill, or they can breed resentment and fear. This guide explains how to design a simulation program that teaches, encourages reporting and improves resilience without shaming staff.
ReadTravel security for staff
Business travel puts devices and data in unfamiliar places, from airports and hotels to border crossings. These practical steps help staff protect company information before, during and after a trip.
ReadDeepfake voice and video fraud
Criminals can now imitate a familiar voice or face convincingly using AI tools. This guide explains how deepfake fraud targets businesses and the simple verification habits that defeat it.
ReadOffboarding departing staff securely
When someone leaves, their accounts, devices and knowledge can stay behind in risky ways. A consistent offboarding checklist protects company data and keeps the departure respectful for everyone involved.
Read