-
Small Organizations Aren’t Exempt From Cyber Risk (or NIST CSF)
Read more: Small Organizations Aren’t Exempt From Cyber Risk (or NIST CSF)Cyber attackers don’t care about organizational size. They care about opportunity. Small organizations often believe they’re “too small to be targeted,” but statistics show the opposite: small businesses are attacked more frequently because they are easier targets. This makes NIST CSF even more important — not less. Every NIST CSF outcome applies to small…
-
How to Identify the Highest‑Risk Cyber Gaps in Minutes
Read more: How to Identify the Highest‑Risk Cyber Gaps in MinutesIdentifying your highest‑risk cybersecurity gaps shouldn’t require weeks of analysis and a small army of consultants. The reality, though, is that most organizations struggle to see where their real exposure lies. They have reports, dashboards, and metrics—but not a clear, prioritized view of what actually needs attention first. That’s exactly what the CyberDynamX Matrix…
-
The Power of an Integrated Policy–Standard–Procedure Architecture
Read more: The Power of an Integrated Policy–Standard–Procedure ArchitectureMost organizations have cybersecurity documents — but very few have a cybersecurity architecture. Policies, standards, procedures, and baselines often exist in isolation, written at different times by different people with different assumptions. This creates confusion, inconsistency, and operational friction. The CyberDynamX Governance Enablement Program solves this by delivering a fully integrated governance architecture where…
-
NIST CSF Isn’t the Problem. Capacity Is.
Read more: NIST CSF Isn’t the Problem. Capacity Is.Small organizations often claim that NIST CSF “doesn’t fit” their environment. But when you look closely, the issue isn’t the framework — it’s capacity. NIST CSF defines what good cybersecurity looks like. It doesn’t prescribe how big your team must be, how sophisticated your tooling needs to become, or how complex your processes must…
-
Supply Chain Cyber Risk: The Most Neglected NIST Category
Read more: Supply Chain Cyber Risk: The Most Neglected NIST CategorySupply chain cyber risk is one of the most overlooked areas in cybersecurity — and one of the most dangerous. Organizations depend on vendors, partners, cloud providers, and third‑party services more than ever. Yet many have no formal process for evaluating or managing the cybersecurity risks those suppliers introduce. In the Curtis Company example,…
-
What a Cyber Maturity Score of 2.17 Tells You About Risk
Read more: What a Cyber Maturity Score of 2.17 Tells You About RiskA maturity score is more than a number — it’s a risk indicator. A score of 2.17, like the one shown in the Curtis Company example, tells a clear story: The organization has defined some cybersecurity practices, but many are still reactive, inconsistent, or incomplete. This creates elevated exposure to cyber risk. What 2.17…
-
Why Cybersecurity Fails Without Risk‑Based Prioritization
Read more: Why Cybersecurity Fails Without Risk‑Based PrioritizationMost cybersecurity programs fail for a simple reason: they try to fix everything at once. Without prioritization, organizations waste time, burn resources, and focus on the wrong problems. Cybersecurity must be risk‑based — not checklist‑based. That’s why the CyberDynamX Matrix uses a NOW / NEXT / LATER model. It ensures organizations address the highest‑risk…
-
Why Blaming the Framework Puts Small Organizations at Risk
Read more: Why Blaming the Framework Puts Small Organizations at RiskWhen small organizations feel overwhelmed by cybersecurity, they often blame the framework. “NIST CSF is too big.” “NIST CSF doesn’t fit us.” “NIST CSF is for enterprises.” But blaming the framework doesn’t reduce risk — it increases it. NIST CSF isn’t the problem. The problem is the assumption that small organizations must implement it…
-
Cybersecurity Is a Leadership Function — Not an IT Task
Read more: Cybersecurity Is a Leadership Function — Not an IT TaskCybersecurity has outgrown its origins as a technical discipline. Today, it’s a leadership function — one that shapes business continuity, customer trust, regulatory compliance, and organizational resilience. Yet many organizations still treat cybersecurity as an IT problem. This mindset creates blind spots, misaligned priorities, and stalled progress. Cybersecurity requires leadership engagement because the decisions…
-
Why NIST CSF 2.0 Is Becoming the Standard for Cyber Clarity
Read more: Why NIST CSF 2.0 Is Becoming the Standard for Cyber ClarityOrganizations everywhere are adopting NIST CSF 2.0 — not because it’s new, but because it’s practical. It provides a structured, comprehensive, and business‑friendly way to understand cybersecurity risk. And in a world where cyber threats evolve faster than budgets, clarity is everything. NIST CSF 2.0 organizes cybersecurity into six core functions: Govern, Identify, Protect,…
News & Updates
Buy my book
The Art and Science of Building a Simplified Digital Security Program
In CyberDynamX, I guide you through the process of creating a structured, resilient digital security program tailored to meet your organization’s unique needs. This approach helps integrate security seamlessly into daily operations, setting the foundation for a proactive cybersecurity culture.
- Master risk management and build a risk-aware culture.
- Classify and secure essential data assets.
- Design a governance framework with robust security architecture.
- Establish clear policies, standards, and control measures.
- Implement resilient strategies without relying on “quick fixes.”
He always demonstrates professionalism in every facet of business and has a proven record of success as a leader…
Director, National Solutions Delivery
TELUS
Much of your work regarding IT Security Governance has remained as the foundation for effective operations. And it provided an excellent foundation that we could expand upon. Your great work, and its cumulative impacts, set us up for future success in a lot of regards. Also, our Enterprise Architect is a big fan.
Director of Information, Risk & Compliance
NorQuest College
I’ve had the privilege of working with Curtis on some really cool things this past year. He’s a trusted source, whip smart, super humble, and an all-around great guy. If you’re employed in any cyber security role regardless if you’re just starting out or have a few battle scars, his book is probably something you want to add to your library.
Director, Cybersecurity & CISO
MacEwan University
I have been consistently impressed by Curtis' professional competency and solid knowledge in the IT security, compliance and governance disciplines.
Sr. Manager
Alberta Blue Cross
I wish that I’d had this book when I was starting out in cyber security. It would have saved me from making many common and uncommon mistakes, leaving me free to find new and creative mistakes of my own to make.
Chief Information Security Officer
University of Northern BC
…you speak with humility, something that makes you very approachable, especially to people who may not have the confidence of those more established in the field. Cybersecurity needs more people like you.
Chief Information Security Officer
University of Northern BC
He is a visionary…
CTO
ATB Financial
Curtis’ leadership and guidance in advancing cybersecurity programs within Canada’s higher education sector highlight his deep expertise in risk management and his commitment to high standards.
Chief Information Security Officer
British Columbia Institute of Technology
I've never worked with a person with more integrity.
Information Security Analyst
AIMCo
I believe the book is well positioned to be a thought-leader and practical guide for organizations looking to establish a solid security posture. I love how the book transcends the commercial and not-for-profit sectors, and is applicable to companies in Canada, the US, and internationally. Highly recommended and worth every penny!
CISO
MRNET
I'm a practical person, and I don't like to fall into excessive praising, but I chose my words lightly when I say you were very inspiring.
Sr. Consultant/Manager
KPMG
Curtis is one of the most creative mind I know, and taught me to think outside of the box…
Senior Security Consultant
TELUS
Curtis is a leader, humble, creative, and has a tremendous amount of integrity.
Team Manager
Alberta Blue Cross
Curtis has proven to be a strong and highly knowledgeable professional who has served our organization very well…
CIO
Alberta Blue Cross
Curtis is a strategic 21st Century thinker and doer and he has a vision that captures the imagination. Curtis is a highly regarded leader in the security community.
CSO / Canadian Security Director of the Year
TELUS
Curtis is the definition of professionalism. He is one of the most knowledgeable professionals it is my pleasure to know in the areas of Security and Compliance.
Your work has been sooo helpful!
Director, Information Technology
Olds College
Curtis is a pragmatic strategist who emphasizes risk reduction and digital resilience by implementing effective controls in key areas to thwart one's adversaries.
Field CTO Cybersecurity
Cisco Canada
If you’re looking for someone with that rare combination of character, vision and leadership, who can still roll up their sleeves to get things done, meet Curtis Blais.
President
SC Canada Services Inc.
I still have the materials and lessons learned from the leadership program you did for us!
Manager Server Infrastructure & Operations
Alberta Blue Cross