An evidence-based approach to cybersecurity cost recovery in the General Tariff Application — a concise, executive-grade case up front, standing on an auditable evidence base with any level of detail retrievable on demand.
Rate proceedings reward clarity. A General Tariff Application that runs to thousands of pages — however complete, and however well-intentioned — asks the Commission and interveners to presume prudence rather than verify it. Volume is too easily mistaken for opacity, and nowhere is that risk greater than cybersecurity: costs that are sensitive, technical, and risk-based, with no meter to point to — yet essential to protecting Alberta's critical infrastructure. The question behind every information request is the same: is this spend calibrated to real risk — and can you show us?
Invert the structure of the filing: put a concise business case in front of the regulator, and stand it on a continuously maintained evidence base that can answer any question, at any depth, on demand. The information request process stops being a burden — it becomes the demonstration of transparency itself.
"Trust us" is not an argument a regulator can accept — and volumes of technical detail aren't one it can efficiently verify. International standards give both sides a shared yardstick: an objective way to show that cyber spending is neither excessive nor insufficient, but calibrated.
A formal, defensible risk assessment ranks the threats to critical infrastructure and quantifies exposure. Spending decisions flow from the assessment — which is the structural answer to any suggestion of gold plating.
The internationally certified benchmark for running a security program. Aligning the control environment to ISO 27001 demonstrates due diligence in a form auditors, boards, and regulators already trust.
Alberta's Critical Infrastructure Protection reliability standards are the baseline obligation for the transmission system. The same evidence base that supports the GTA demonstrates CIP alignment continuously — one record, every obligation it serves.
A filing that proves cyber diligence must never become a blueprint of the attack surface. The evidence base can reside entirely on your own infrastructure — including fully disconnected operation — so sensitive detail is disclosed on your terms: confidentially where warranted, at the depth each question requires, with the auditable record standing behind whatever level of summary is filed publicly.
A Calgary-based, NRC-IRAP-backed software company. RESTIV's converged platform runs the assessments, collects and versions the evidence, and holds the compliance record in one system — every conclusion traceable to a dated, auditable artifact. Canadian regulatory content is core product, maintained at full depth, with deployment options from cloud to fully disconnected on-premises.
A Canadian professional services firm connecting people, projects and processes since 2010. Taleo brings the program management and delivery discipline to stand the evidence program up inside your organization — the right structure, the right cadence, and the executive-grade business-case rigour the filing deserves.
The evidence base that supports the next filing is built between filings — which means the work starts quietly, now, alongside the process you already have well in hand. No disruption to current preparation; a stronger foundation under whatever comes next.