Index
Tools and frameworks used for assessment / compliance standards.
Methods for mapping network topology, identifying active services, and determining OS versions to establish a baseline for analysis.
Resources for OSINT, CVE lookup, and CVSS calculation to quantify the exploitability and impact of identified security flaws.
Standards for data integrity, hardware lifecycles, and the mathematical calculation of RPO/RTO to ensure business continuity.
Preparation Tools
The PHIPA-PIPEDA Readiness Checklist (Google Sheets) For self assessment
Assessment Frameworks:
gfxtm Assessment Spreadsheet (Google Sheets) For active engagements
External Resources:
Regulatory & Compliance Standards
Ontario Information and Privacy Commissioner (IPC) guidelines.
PIPEDA Fair Information Principles The 10 principles governing data privacy in Canada
IP discovery and network tools
Fast Windows-native Network Scanning. (Ideal for rapid identification of Windows-based workstations, shared folders, and RDP availability within a LAN.)
Angry IP Scanner | |
Lightweight Cross-Platform Discovery. (A fast, Java-based scanner used to ping and resolve hostnames across heterogeneous networks.)
NMAP | |
IP Discovery & Port Scanning. (for identify active services and detect unauthorized open ports.)
Network Simulation & Architecture Modeling. (for validate infrastructure design and test DRP scenarios.)
Wireshark | |
Packet Sniffing & Traffic Analysis. (for verify data-in-transit encryption and troubleshoot protocol failures.)
How to
Checking IP and network profile
Cisco Packet Tracer Learning Collection
Checking OS and version
Linux version
using this command
` cat /etc/os-release `
Vulnerability Assessment & Penetration Tools
Open-Source Intelligence (OSINT) tools
OSINT is the systematic collection of publicly available data to identify security gaps from an “outside-in” perspective.
Link Analysis & Data Visualization. (Used to map complex relationships between people, domains, and infrastructure to find hidden attack surfaces.)
Search Engine for Internet-Connected Devices. (Identifies exposed servers, IoT devices, and medical hardware that may be inadvertently accessible from the public internet.)
Email & Subdomain Gathering. (Scans public sources to find leaked employee credentials and forgotten subdomains that pose a risk to the primary network.)
sherlock-linux Full custom linux tools
Footprint Analysis. (Locates social media and web profiles associated with specific usernames to assess the digital footprint and impersonation risks.)
Understand OSINT
Finding niche resources for specific data types like IP addresses, Metadata, or Public Records. (It represents the logic of an investigation’s starting from a known point and expanding outward.)
Seeing how much of an employee’s professional identity is exposed across non-work platforms.
Architecture & Enterprise Modeling
Archi | |
For creating “Blueprints” of the entire IT landscape. It visualizes the relationship between business processes, software applications, and technical hardware.
Essential for PHIPA/PIPEDA Impact Analysis. It shows exactly which business roles have access to which data servers, making it easy to spot compliance gaps in a diagram rather than a spreadsheet.
Common Vulnerability Scoring System (CVSS)
Common Vulnerability Scoring System Version 4.0 Calculator
CVSS 4.0 is the most advanced version by first.org, that addresses long-standing flaws in 3.1 by adding “Supplemental Metrics” (like Automatable, Recovery, and Value Density) and refining the “Base” score to be more granular.
Common Vulnerability Scoring System Version 3.1 Calculator
This is the largest implementation of the standard and currently by NIST, almost every existing CVE (Common Vulnerabilities and Exposures) is scored using CVSS 3.1. Most scanners (Nessus, OpenVAS) and automated tools still report in 3.1.
Common Vulnerabilities and Exposures (CVE).
CVE.org The official international registry of Common Vulnerabilities and Exposures (CVEs).
CVE Details for historical trend analysis and mapping the security track record of specific vendors and products.
CISA KEV Catalog A prioritized list of vulnerabilities known to be actively exploited in the wild, ensuring that critical risks are patched first.
Analysis & Exploitation
Metasploit contains a massive database of “Exploits” (code that takes advantage of a bug) and “Payloads” (what happens once you get in, like opening a command shell).
Burpsuite is custom linux tools that captures every request and response, allowing you to modify data (like changing a user ID or a price) before it reaches the server.
Disaster Recovery Planning (DRP) Reference.
Data Integrity & Verification
Hashdeep For Recursive Hashing & Audit, for create a “digital fingerprint” of every file in a system. Essential for verifying that restored data is 100% identical to the original.
Rclone Check | | For Cloud-to-Local Verification. Efficiently compares a backup source with a restored destination to ensure no data was lost or corrupted during the transfer.
Meld | | For Visual File & Folder Comparison. A visual tool to compare restored configuration files or databases against originals to identify specific line-by-line differences.
DRP Resilience Score Reference
NIST SP 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems.
ISO/IEC 27031:2025 Cybersecurity — Information and communication technology readiness for business continuity
ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements
Backup Recovery Time Calculator
Standards for data integrity, hardware lifecycles, and the mathematical calculation of RPO/RTO to ensure business continuity. What is RTO and RPO?
Inventive HQ Calculator show the financial impact of downtime. It calculates “Hourly Cost of Downtime” based on employee wages and overhead.
RTO & Downtime Cost Calculator
Datto RTO Calculator Comparing different recovery scenarios (e.g., “What if we restore from the local NAS vs. the Remote Backup?”).