Canadian · Senior-led · English & French
Dynamic Shield Consulting helps organizations protect what matters, meet their security and privacy obligations, and adopt AI with confidence. You work directly with a senior practitioner, from the first call to the final deliverable.
Our capabilities
Risk, technology and business questions rarely stay in separate boxes. We cover the full range, so you get one consistent view instead of several partial ones.
Security direction your leadership team can act on, from roadmap to board briefing.
Understand your risks and meet the expectations of clients, auditors and regulators without overbuilding.
Handle personal information in a way regulators, clients and your own people can trust.
Adopt AI with clear rules, sound controls and the right level of oversight.
Design and verify the technical controls that actually protect your systems, in IT and OT.
Keep operating through an incident, recover on a tested plan, and help your people spot threats.
Signature expertise
These are the engagements we are asked for most often, with a proven approach behind each one.
Governance · Compliance · Due diligence
No one owns cybersecurity at leadership level, yet clients, insurers and regulators expect it to be managed.
Clear ownership of cybersecurity, with priorities, decisions and progress visible to leadership.
Defence supply chain · Canada and U.S.
Canada's CPCSC and the U.S. CMMC program each set their own levels, requirements and assessment process.
A clear view of what each program requires, and one plan that covers both where they overlap.
ISO/IEC 42001 · NIST AI RMF
Teams already use AI assistants, agents and connectors, and clients ask how AI is governed.
AI adopted under clear rules and controls, rather than banned or left unmanaged.
Need something that is not listed here? Many engagements combine several areas. Tell us what you are dealing with.
How we work
Every engagement starts with a free conversation to understand your situation. You then receive a clear proposal with scope and timeline before any work begins.
01
A defined scope and deliverable, such as an assessment, a certification readiness program or a policy set.
02
Targeted expert input on a decision, a contract requirement, a vendor choice or an incident.
03
A virtual CISO or privacy officer a few days a month, working with your leadership team.
04
A steady partner to keep your program, controls and evidence current over time.
Who we are
Our principal consultant has led cyber risk work at a Big Four firm and audited critical infrastructure in Europe. Today that experience goes straight to your project, in English or French.
15+Years in cybersecurity, risk and compliance
Independent: no vendor affiliations
Pragmatic: sized to your risk and resources
End to end: from strategy to implementation
Recent engagements
What we did and what it changed for the client.
Part-time CISO: scoped controlled information, ran a readiness gap assessment against NIST SP 800-171 and steered remediation.
Remediation plan and system security plan in place ahead of the formal CMMC assessment.
Set up AI governance, reviewed AI use cases and risks, secured how staff use AI assistants and connectors, implemented an AI gateway.
AI used at scale through a controlled gateway, with approved use cases and visibility on data.
Ran the privacy program for a platform handling sensitive personal data: HIPAA and GDPR obligations, privacy assessments, review of 100+ vendors.
Documented compliance, vendor risks under control, clear risk decisions for leadership.
AI readiness and risk assessment, then a responsible-use framework aligned with ISO/IEC 42001 and NIST AI RMF.
Roadmap and guardrails to adopt AI while meeting accountability and privacy duties.
Gap assessment of security and privacy practices against legal and contractual requirements, priorities set within a fixed budget, staff trained.
Prioritized action plan, updated policies, staff able to spot and report threats.
Redesigned vulnerability management across IT and OT: asset coverage, risk-based prioritization, remediation timelines, reporting.
Critical vulnerabilities fixed first and on time, with KPIs for management.
Built business continuity and disaster recovery programs: business impact analysis, recovery strategies, DR plans, crisis exercises.
Tested recovery plans aligned with ISO 22301 and regulators' expectations.
Client names are kept confidential.
FAQ
Dynamic Shield Consulting is a Canadian cybersecurity firm. We help organizations manage cyber risk, meet security and privacy requirements, and adopt AI with the right controls in place. Our services span strategy and leadership (including fractional CISO), governance, risk and compliance, privacy, AI security and governance, security architecture, and resilience.
A fractional or virtual CISO is a senior security leader who works with your organization part time, typically a few days a month. They own the security priorities and roadmap, lead compliance efforts such as SOC 2 or ISO/IEC 27001, report to leadership and oversee vendors, without the cost of a full-time executive.
CMMC is the U.S. Department of Defense program that requires defence contractors to protect controlled information. CPCSC is Canada's equivalent program for the Canadian defence supply chain. Both build on largely the same security requirements but set their own levels and assessment process. We help suppliers understand what each program requires and build one plan that covers both where they overlap.
Start with an inventory of the AI tools, assistants and agents in use, then set a use policy with an approval process, assess the risks and privacy impact of each use case, and put controls on AI agents and connectors such as MCP servers. ISO/IEC 42001 and the NIST AI Risk Management Framework provide the structure.
Yes. Engagements are sized to your risk and resources, from a single assessment to ongoing fractional leadership, for small businesses as well as larger organizations.
We are based in British Columbia, Canada, and serve clients across Canada and the United States, in English and French.
With a free initial conversation to understand your situation. You then receive a clear proposal with scope and timeline before any work begins.
For consulting firms
Consulting and technology firms bring us in for vCISO, CMMC, ISO, privacy or AI governance expertise on their client engagements, as a discreet extension of their team.
Contact
Tell us briefly what you are facing. We will reply within one business day to set up a call, and you will leave it with a clearer view of your options.