PREVENT · RECOVER
Cybersecurity & Disaster Recovery
Ransomware doesn't knock. It lands on an ordinary Tuesday, locks up everything you've built, and asks what it's worth to you.
We keep it out — and if something ever gets through, we get you trading again in hours, not weeks. Protecting Canadian businesses since 2003, from Montréal and the Laurentides to Toronto and Calgary.
The threat to Canadian businesses, in numbers
Not vendor marketing. Government of Canada data.
26%
Average yearly rise in Canadian ransomware incidents, 2021 to 2024
$1.2B
Canadian recovery costs from cyber incidents in 2023 — double 2021
13%
Of reported Canadian cyber incidents involved ransomware
​
336
Early warnings issued by the Cyber Centre in 2024–25, saving up to $18M
Sources: Canadian Centre for Cyber Security, Ransomware Threat Outlook 2025–2027 · Statistics Canada, Canadian Survey of Cyber Security and Cybercrime
Prevention and recovery: two jobs, one system
Attackers steal your data before they encrypt it. So a clean backup restores your business — but it does nothing about the copy they walked out with. You need the wall and the parachute.
01 · PREVENT
Keep them out
Layered defences across identity, endpoint, email and network — watched continuously, not installed and forgotten.
​
â—† Multi-factor authentication everywhere that matters
â—† Managed detection and response on every device
â—† Email filtering and phishing simulation
â—† Patching and vulnerability remediation
â—† Staff training that actually changes behaviour
01 · RECOVER
Get you back
Backups proven by restore, not by a green checkmark — with recovery targets written into your agreement.
​
â—† Immutable backups ransomware cannot touch
â—† Recovery point and recovery time objectives, agreed up front
â—† Scheduled restore tests with written results
â—† Offsite copies held in Canada
â—† A continuity plan your team has rehearsed
Managed cybersecurity services that keep attackers out
Most breaches don't involve a genius. They involve a stolen password and a machine nobody patched.
Identity & endpoint
Credentials are the front door. We lock it and we watch it.
​
â–¸ Multi-factor authentication rollout
â–¸ Conditional access policies
â–¸ Managed detection and response
â–¸ Device compliance and encryption
Email & phishing defence
Nine in ten attacks start in an inbox. We harden it and train the people behind it.
​
â–¸ Filtering and attachment sandboxing
â–¸ SPF, DKIM and DMARC done properly
â–¸ Simulated phishing campaigns
â–¸ One-click reporting for staff
Network & patching
One unpatched machine on a flat network becomes all of them by morning.
​
â–¸ Firewall configuration and review
â–¸ Network segmentation
â–¸ Automated patch management
â–¸ Vulnerability scanning and remediation
Disaster recovery that measures downtime in hours
A backup nobody has ever restored isn't a backup. It's a hope.
Backups we actually
test
Proven by restore, on a schedule, with results in writing.
​
​
â–¸ Servers, endpoints and Microsoft 365
â–¸ Immutable copies ransomware cannot delete
â–¸ Scheduled test restores
â–¸ Monitoring and failure alerting
Recovery targets in
writing
Know how much data you could lose and how long you'd be down — before it happens.
​
â–¸ Recovery point objective per system
â–¸ Recovery time objective agreed up front
â–¸ Priority order for restoration
â–¸ Reviewed annually
​
Business continuity planning
Technology restores the systems. A plan restores the business.
​
​
â–¸ Documented incident response
â–¸ Contact trees and escalation paths
â–¸ Rehearsed tabletop exercises
â–¸ Breach notification readiness
​
Business continuity and disaster recovery planning
You don't protect a shoe shop the way you protect a medical clinic. One loses a day of sales. The other has patients in the waiting room and regulatory clocks already running.
Any provider publishing one set of recovery times for every client is selling you their convenience, not your protection. So we don't sell tiers. We run a business continuity and disaster recovery planning engagement — a BCP/DRP — that establishes what your business actually needs, system by system. Then we build to those numbers, test them, and write them into your agreement.
PHASE 01
Business impact analysis
What actually stops when a given system goes down, who it affects, and what an hour of that costs you. This is a business conversation before it's a technical one.
PHASE 03
Targets set per system
Recovery time and recovery point objectives defined system by system, sized to real impact — not inherited from a package you were sold.
PHASE 02
Criticality ranking
Nothing comes back all at once. We agree the order of restoration with you in advance, so nobody is making that call under pressure at 2am.
PHASE 04
Documented, rehearsed, reviewed
A written plan your team has practised, with restore tests on a schedule and results in writing. Revisited as your business changes.
What that looks like in practice
Same three questions. Completely different answers — and completely different builds.
PROFILE A
Neighbourhood retailer
â—† Downtime. Several hours is survivable. Sales pause, staff work around it, the day is recoverable.
â—† Data loss. A day of transactions, largely reconcilable from processor records.
â—† So we build. Nightly backup, next-day restore, modest
retention.
PROFILE B
Medical clinic
â—† Downtime. Minutes. Appointments stall and records have to be available on demand.
â—† Data loss. Effectively none. A missing chart entry is a clinical and a regulatory problem.
â—† So we build. Frequent replication, rapid failover, long retention, strict access logging.
What you receive
â—† A business impact analysis across your critical systems
â—† Recovery time and recovery point objectives, agreed per system
â—† A documented restoration sequence
â—† An incident response runbook with contacts and escalation paths
â—† A restore test schedule, with written results
â—† Annual review as your systems and obligations change
Law 25 and PIPEDA compliance for Canadian businesses
Most businesses cannot say where their data physically lives. That's the gap — and it's the part we close.
What the law
asks of you
Quebec's Law 25 and the federal PIPEDA both require you to protect personal information, and to notify the people affected when a confidentiality incident creates a risk of serious injury.
​
Law 25 goes further. Before personal information collected in Quebec is communicated outside the province — including to another Canadian province — you need a documented privacy impact assessment showing the information will be adequately protected.
Where your data actually lives
Your backups always go to a Canadian data centre. That is a decision we make deliberately on every engagement, not a default we inherited from a vendor.
​
Live data is less simple, and any provider claiming otherwise is guessing. Some services — web hosting and certain cloud platforms in particular — may hold data in the United States or Europe. We document which ones, so you learn it from us and not from an auditor.
What we can and can't do
We give you the factual foundation an assessment needs: what data exists, where it physically resides, who can reach it, and how it is protected.
​
We don't perform the assessment itself. That obligation is yours, and parts of it need legal advice. We'll tell you plainly when you've reached that line — that's usually the most useful thing a technology provider can say.
​​
​
​
Why Canadian businesses choose Art Systems Canada
23 years, one
market
Independent since 2003, working with Canadian SMBs the entire time. We know what a twelve-person firm can realistically maintain — and what's just shelfware.
​We build it, so we can advise on it
We run the migrations, stand up the servers and hold the backups. That hands-on depth is what makes our advice worth taking.
​
Plain pricing, plain language
No hidden fees, no acronym fog. You'll be told what you have, what it costs, and what it doesn't cover.
​
​
Cybersecurity and disaster recovery: your questions answered
We already have backups. Isn't that disaster recovery?
No. Backup is a copy of your data. Disaster recovery is a tested process for getting your business running again — with an agreed maximum data loss, an agreed maximum downtime, and a rehearsed order of restoration. Most businesses have the first and assume it covers the second.
If our backups are solid, can we stop worrying about ransomware?
No. Attackers now steal data before encrypting it and threaten to publish it, so a clean restore brings your systems back but does nothing about the disclosure. The Canadian Centre for Cyber Security notes this shift removed backups as a standalone defence. Prevention and recovery have to run together.
We're small. Are we really a target?
Yes. Most ransomware is opportunistic — attackers scan for weaknesses and take whoever they find. The Cyber Centre lists "we're too small to be a target" as a misconception outright, and notes recovery costs can decide whether a small business survives at all.
Where is our backup data stored?
In a Canadian data centre. We select one deliberately on every engagement rather than accepting whatever a vendor defaults to. Live data can be different — some services, web hosting in particular, may hold data in the United States or Europe. We document where each system's data resides, so you know before a client or a regulator asks.
How fast could we be back online?
That depends entirely on your business, which is why we won't quote you a number before we understand it. A retailer and a medical clinic have completely different tolerances for downtime and data loss. Our BCP/DRP planning engagement establishes your recovery time and recovery point objectives system by system — then we build to them, test them, and write them into your agreement.
What is a BCP/DRP engagement, and do we need one?
​A business continuity and disaster recovery plan identifies what breaks when a system goes down, what that costs you per hour, which systems come back first, and how fast each one has to return. If you have never had that conversation, your recovery targets are currently whatever your backup software happened to default to. Most businesses are surprised by what turns out to be critical.
Do you help with Law 25 and PIPEDA?
We handle the technical side: access controls, encryption, logging, retention, and the tested recovery and documentation you need to respond to a confidentiality incident in time. We're not a law firm, and we'll say so when something needs a lawyer.
