Proxim offers four core service lines, each designed to scale with your business:

• Cybersecurity GRC Consulting — governance frameworks, risk assessments, AI/automation governance, and assurance roadmaps aligned to SOC 2, ISO 27001, NIST CSF, HIPAA, and PIPEDA.
• Assurance Readiness & Audit Prep — gap assessments, policy development, contract reviews, security questionnaire support, and evidence preparation.
• Business Advisory & Strategy — operational strategy, governance structures, investor-readiness, and digital transformation advisory.
• Risk Management Programmes — risk registers, third-party risk, business continuity, and incident response planning.

Every engagement is scoped to your business — we don't retrofit enterprise frameworks onto small teams.

A virtual CISO (vCISO) is a fractional Chief Information Security Officer — an experienced security leader who works with your business part-time, providing strategic security leadership without the cost of a full-time executive hire.

You likely benefit from a vCISO if your business is scaling, facing increased customer security expectations, preparing for a certification like SOC 2 or ISO 27001, or simply needs senior security guidance for board reporting and strategic decisions — but isn't yet at the size to justify a full-time CISO.

Proxim's vCISO engagements are flexible — typically a set number of advisory hours per month, covering security strategy, policy oversight, audit liaison, and executive reporting.

Enterprise customer security questionnaires can be one of the biggest hidden time costs for growing businesses — and getting them wrong can stall or lose deals. As part of our Assurance Readiness & Audit Prep service, Proxim helps you:

• Complete client security questionnaires accurately and efficiently
• Respond to enterprise due diligence requests with confidence
• Review customer and vendor agreements for hidden security obligations before you sign
• Build a reusable knowledge base of your security posture for future questionnaires

This directly improves win rates with enterprise customers by demonstrating credible, well-documented assurance.

Proxim offers three flexible engagement models so you only pay for what your business needs:

• Fixed-Scope Engagements — a defined deliverable, timeline, and fee. Ideal for gap assessments, policy suites, and audit prep projects.
• Ongoing Advisory (Retainer) — monthly advisory hours for businesses that need consistent access to a trusted GRC and assurance advisor.
• Virtual CISO (vCISO) — fractional security leadership for businesses that need strategic oversight without a full-time hire.

Many clients start with a fixed-scope project (such as a gap assessment) and transition into a retainer once priorities are clear.

SOC 2 is an attestation report (Type I or Type II) commonly required by North American customers, particularly SaaS companies. It evaluates your controls against the Trust Service Criteria — security, availability, processing integrity, confidentiality, and privacy — over a period of time (Type II) or at a point in time (Type I).

ISO 27001 is an internationally recognised certification for an Information Security Management System (ISMS). It's broader in scope, covering organisational risk management processes, and is often expected by customers in Europe, the Middle East, and global enterprises.

Many growing businesses pursue SOC 2 first (faster, lower cost, satisfies most North American enterprise customers) and add ISO 27001 later as they expand internationally. Proxim can help determine which — or both — your customer base actually requires before you invest.

HIPAA (Health Insurance Portability and Accountability Act) applies if your business creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of, or in connection with, US healthcare providers, health plans, or their business associates — even if your company is based in Canada.

If you're a Canadian healthtech company serving US clients, or a vendor to a US healthcare organisation, HIPAA's Privacy Rule, Security Rule, and Breach Notification Rule likely apply to you as a "business associate."

Proxim helps healthtech and adjacent businesses determine HIPAA applicability, implement required administrative, physical, and technical safeguards, and prepare Business Associate Agreements (BAAs).

PIPEDA (Personal Information Protection and Electronic Documents Act) is Canada's federal private-sector privacy law, governing how organisations collect, use, and disclose personal information in commercial activity. Quebec's Law 25 introduces stricter requirements similar to GDPR for businesses operating in or serving Quebec residents.

GDPR (EU) and CCPA (California) impose additional, often stricter obligations — including data subject access rights, breach notification timelines, and in GDPR's case, requirements around international data transfers.

If your business has any EU or California customers, users, or website visitors, GDPR/CCPA considerations likely apply in addition to PIPEDA — they aren't mutually exclusive. Proxim helps map your data flows against all applicable regimes and builds a single, unified privacy programme rather than separate compliance silos.

The NIST Cybersecurity Framework (CSF) 2.0 is a voluntary framework — not a certification — organised around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. It provides a common language for describing and improving your cybersecurity posture.

Unlike SOC 2 or ISO 27001, there's no formal "NIST CSF certificate" to obtain. Instead, organisations use it as a maturity model — assessing current state against target state across the six functions, then prioritising investment accordingly.

NIST CSF is particularly useful as a foundational layer before pursuing SOC 2 or ISO 27001, since its functions map cleanly onto the control families those frameworks expect.

Audit preparation typically follows this path:

• Gap assessment — comparing your current controls against the target framework's requirements
• Policy & procedure development — documenting information security, acceptable use, access control, incident response, and related policies
• Control implementation — closing identified gaps (e.g. MFA enforcement, access reviews, vendor risk assessments)
• Evidence collection — gathering proof that controls have been operating (especially critical for SOC 2 Type II, which covers a period of time, not a point in time)
• Readiness review — a final check before engaging an external auditor

For SOC 2 Type II, expect an observation period of 3–12 months where controls must demonstrably operate before the audit can be completed. ISO 27001 timelines vary similarly depending on organisational maturity. Proxim manages this entire process end-to-end — including liaising with your external auditor.

Yes — AI and automation governance is part of our Cybersecurity GRC Consulting service. As businesses adopt AI tools (from internal copilots to customer-facing AI features), they introduce new categories of risk: data leakage to third-party models, unvetted AI use cases, lack of human oversight on automated decisions, and emerging regulatory expectations.

Proxim helps you build an AI governance programme that includes:

• An inventory of AI use cases and tools currently in use across your organisation
• Risk classification of each use case (e.g. low-risk internal productivity vs. high-risk customer-facing decisions)
• Acceptable Use policies for AI tools, including data handling rules
• Human oversight and review controls for AI-assisted decisions
• Vendor due diligence for third-party AI tools and model providers

This positions your organisation to respond confidently to customer questions about AI use — increasingly a standard part of security questionnaires — and prepares you for emerging regulation.

AI governance isn't a separate silo — it integrates into your existing GRC structure. For example:

• Risk management — AI use cases are added to your risk register, with appropriate treatment plans
• Vendor / third-party risk — AI model providers (OpenAI, Anthropic, Google, etc.) go through the same vendor due diligence as any other processor of your data
• Access control & data classification — existing policies are extended to cover what data can be input into AI tools
• Change management — deploying new AI-driven features follows the same change control process as other system changes

SOC 2 and ISO 27001 auditors are increasingly asking about AI tool usage as part of standard control testing — having a documented AI governance approach demonstrates maturity and reduces audit friction.

Enterprise customers are increasingly including questions such as:

• "Do you use AI/ML in your product, and if so, how is customer data used in model training?"
• "What third-party AI tools do your employees have access to, and what data can be shared with them?"
• "Is there human review of any automated or AI-driven decisions affecting our data or account?"
• "Do you have an AI usage policy, and how is it enforced?"

If you can't answer these clearly and consistently, it can stall enterprise deals — exactly the kind of gap our Assurance Readiness & Audit Prep service is designed to close, working hand-in-hand with AI governance policy development.

Most startups don't need to "boil the ocean" — the right starting point depends on what's driving the need. Common triggers include an enterprise customer requiring SOC 2, a healthcare client requiring HIPAA alignment, or simply wanting to build good governance habits early before they become expensive to retrofit.

A typical first step is a lightweight current-state assessment — understanding what data you handle, what tools and vendors you use, and what your customers or industry actually require. From there, Proxim recommends a prioritised roadmap rather than attempting every framework at once.

Book a free 30-minute discovery call and we'll give you a clear, honest read on what matters most for your situation — no obligation.

It depends on scope and your starting maturity:

• Gap assessment — typically 2–4 weeks
• Policy suite development — typically 4–8 weeks
• SOC 2 Type II readiness (including the observation period before audit) — typically 3–6 months to readiness, plus a 3–12 month observation window
• ISO 27001 readiness — typically 3–9 months depending on organisational complexity
• Ongoing retainer / vCISO — open-ended, reviewed quarterly

We'll give you a realistic timeline during your discovery call based on your specific situation — not a generic estimate.

Booking is simple — head to our Contact page and fill in the discovery call form, or email us directly at hello@proximadvisory.ca or call 250-258-7187.

Your free 30-minute discovery call includes a review of your current assurance and risk posture, identification of your most pressing gaps, and recommended next steps — with absolutely no obligation. We typically respond within 1 business day.