Most small companies do not need a security operations centre. They need written policies, a tested plan for the day something goes wrong, a clear list of what data they hold, and honest answers to the security questionnaires that customers, insurers and marketplaces now send. We build that, with you, for a fixed price.
Online retailers, professional services, clinics, contractors, agencies and software teams that hold customer or employee data but have no security staff.
Amazon SP-API developers and service providers asked for an incident response plan, data retention and credential controls under Amazon’s Data Protection Policy.
A customer sent a SIG or CAIQ-style form, an insurer asked about MFA and backups, or a contract requires a documented incident plan.
PCI DSS 4.0.1 expectations now apply in full. We help you work out your scope and the right self-assessment, and cut your exposure.
Both packages are delivered by a person who works with you, not a template emailed and forgotten. All prices are in US dollars (USD).
The written foundation: know your data, set the rules, and have a plan for the worst day.
Everything in Essentials, plus proof: tested plan, questionnaire answers and compliance mapping.
| Deliverable | Essentials $2,500 USD | Complete $5,000 USD |
|---|---|---|
| Asset & data inventory | ✓ | ✓ |
| Risk register | ✓ (top risks) | ✓ (expanded, with CSF map) |
| Core policy pack (8 policies) | ✓ | ✓ |
| Incident Response Plan | ✓ 3 playbooks | ✓ 5 playbooks |
| Breach notification templates | ✓ | ✓ |
| 30/60/90-day roadmap | ✓ | ✓ |
| Staff training | 1 session | 2 sessions + phishing kit |
| Tabletop exercise + after-action report | – | ✓ |
| Customer questionnaire answer pack | – | ✓ + 2 completed |
| Amazon SPN / Data Protection pack | – | ✓ |
| NIST CSF 2.0 gap map | – | ✓ |
| Vendor risk review (up to 10) | – | ✓ |
| PCI DSS 4.0.1 scope memo | – | ✓ |
| SOC 2 / ISO 27001 readiness map | – | ✓ |
| Cyber-insurance checklist | – | ✓ |
| Support after delivery | 30 days | 90 days + review call |
| Revision rounds | 1 | 2 |
Full detail on every item is on the Deliverables page, and an outline of each response playbook is on the IR Playbooks page.
Timelines depend on how quickly you can answer questions and review drafts. Typical delivery is three to five weeks for Essentials and four to six for Complete. We will state the real dates in your written quote.
Marketplaces, customers and insurers ask for it by name. Amazon’s Data Protection Policy, for example, expects notice to Amazon within 24 hours of a security incident and a plan reviewed at least every six months.
Under PIPEDA and Alberta PIPA you must report breaches that create a real risk of significant harm, notify affected people, and (under PIPEDA) keep breach records for 24 months.
NIST’s small-business guidance puts MFA, tested backups, patching, encryption and staff training first. Insurers ask about the same list.
Customers send SIG-style or CAIQ-style forms. Answering them from a single, consistent source saves days each time.
More on why now, with sources →
Masks.Health - Original Medical Masks Made Before COVID-19 is a Calgary, Alberta business, an online seller since 1999. We run our own e-commerce and Amazon seller operations and have written and published our own security and incident-response plan and data protection practices for the Amazon Solution Provider programme. Our sister company, WestNet, is a Calgary internet and network provider with a security practice at cybersecurity.westnet.ca and a VPN service at vpn.westnet.ca.
Yes, for the scope listed. If your company is much larger or more complex than the typical small company (for example many locations, regulated health data, or dozens of systems), we say so in the written quote before you pay anything. We do not add surprise charges mid-project.
No. Neither package is an audit or certification. The Complete package includes a readiness map that shows which policies and controls you already have and which an auditor would expect, so that a later audit starts from a stronger position.
We cannot promise that. The Complete package gives you written, accurate answers about incident response, data retention, encryption, credentials and network protection, aligned to Amazon’s Data Protection Policy. Amazon decides on approval, and your answers must reflect controls you actually have. We help you put those controls in place first.
A list of the tools you use, who has access to what, where customer data lives, and about four to six hours of staff time across the project, plus prompt review of drafts.
The plan and roadmap tell you exactly what to fix and in what order. Hands-on configuration is outside the fixed price, but we can quote it separately or work with your IT provider.
Email us. In the support window we help you follow your plan, decide who to notify, and use the templates. Actual forensic investigation or recovery work is a separate engagement (CyberSecurity by WestNet can discuss that).
You do. You receive editable copies and may adapt them for your company.
We keep only what is needed to do the work, protect it, and delete it on request after the support period, subject to any legal retention needs. Details are in our privacy notice.
Canada’s PIPEDA, Alberta’s PIPA, general guidance for US state breach-notification laws, and contractual notice to Amazon. We tell you which apply to you; confirm with counsel.
Tell us your company size, the tools you use, and what prompted the request (a customer questionnaire, an insurer, an Amazon application, or just wanting a plan). We reply with a short scoping note and a written confirmation of price and scope before any work starts.
Email sales@abdouexpress.com Masks.Health - Original Medical Masks Made Before COVID-19 contact form WestNet contact · 403-774-7470
Masks.Health - Original Medical Masks Made Before COVID-19 · Calgary, Alberta, Canada. Independent service provider. Related: CyberSecurity by WestNet · WestNet VPN · Amazon Services · Computer Repair · Customer Satisfaction.
