A strong local cybersecurity sector does not secure your own office. In Fredericton the priorities are usually supplier security terms if you sell to government or the university, protecting research data and source code, and the basics: multi-factor authentication, tested backups and access reviews. Public bodies fall under RTIPPA, New Brunswick health custodians under PHIPAA, and most other private businesses look to federal PIPEDA.
Why Fredericton is a different security conversation
Fredericton is New Brunswick's capital, and it is also the home of the main campus of the University of New Brunswick. It has a cybersecurity story that no other Atlantic city can quite match, which cuts both ways for a small business.
The University of New Brunswick says its Canadian Institute for Cybersecurity opened at the Fredericton campus in January 2017, and that its precursor, the Information Security Centre of Excellence, operated there from 2007. UNB describes the local sector as growing out of Q1 Labs, a Fredericton company bought by IBM in 2012, followed by startups such as Sentrant Security and Beauceron Security. A 2022 UNB post says the provincial ecosystem is a network of more than 50 organizations (see UNB on the ecosystem). The National Research Council and UNB have also partnered on a cybersecurity innovation hub in Fredericton, according to BetaKit.
What that means for you:
- Talent and tools are nearby, but they are not your IT department. A research institute or a startup is not a managed service provider, and a ten-person office does not get a security analyst because one works down the street.
- Attackers read the same headlines. A city known for security will not be skipped by phishing campaigns. Public bodies and their suppliers are routinely targeted, wherever they are.
- Customers may ask harder questions. If you sell to government, the university or research partners, expect security questions in procurement.
The sectors that shape Fredericton's risks
We deliberately do not publish a Fredericton employer ranking, because we could not verify one from a neutral source. What we can say from the sources we read:
- Government and public bodies. As the provincial capital, Fredericton hosts provincial government offices and agencies. Many private firms in the city sell services to them.
- Universities and research. UNB and its research partners produce valuable data: grant applications, unpublished results, student records and intellectual property.
- Technology and cybersecurity firms. Startups and spin-offs hold source code, customer environments and investor data.
- Health care and professional services. Clinics, dental offices, law and accounting practices handle sensitive records in a small office setting.
- Retail and local services. Typical small-office risks: shared logins, payment fraud, outdated devices.
If you supply a government body or the university
Public bodies in New Brunswick, including municipalities, are covered by the Right to Information and Protection of Privacy Act (RTIPPA), in force since September 1, 2010. Government guidance says a privacy breach is unauthorized access, use, disclosure or disposal of personal information, that public bodies must inform affected individuals when a breach poses a risk of significant harm, and that the Ombud must be notified in those cases (see government guidance on handling privacy breaches).
That law binds the public body. It does not automatically list your obligations as a supplier, which come from your contract. Read the security and breach clauses, and ask your customer what they expect. Questions we hear from small suppliers:
- How fast must we tell you about a suspected incident?
- Where may the data be stored, and who may access it?
- Do you require multi-factor authentication, encryption or logging?
- May we use subcontractors or cloud tools?
- What happens to the data at the end of the contract?
A managed provider can help implement and document controls such as patching, access control, logging and backups. It cannot grant you eligibility for a contract. Rely on your contract wording, not a general guide, including this one.
Protecting research and intellectual property
Technology startups, spin-offs and research-partnered firms often have more valuable data than staff. The most useful steps are plain ones:
- Separate who can see what. Give people access to the folders and repositories they need, and review it every quarter.
- Protect source code and credentials. Use multi-factor authentication on code hosting, rotate any key that has been pasted into chat or a ticket, and keep secrets out of repositories.
- Control the laptop. Encrypt devices, enforce screen locks, and be able to wipe a lost machine.
- Treat departing staff and student interns as a process. Remove access the same day, and collect devices.
- Write down your incident plan. Who decides, who calls the customer or funder, and who talks to the press. Our incident response checklist is a starting point.
- Back up what you cannot recreate. Experiment data and design files belong under the 3-2-1 backup rule, with a restore test.
If you work with research partners or funding bodies, they may set their own security terms. Those come from the agreement, so read it. We can help you implement and document controls; we cannot certify you to a partner's standard.
A 10 minute Fredericton checklist
| Check | Why it matters here | Done |
|---|---|---|
| Multi-factor authentication on email, code hosting and finance | Account takeover is the common starting point | ☐ |
| Admin accounts separate from daily accounts | Limits damage from one phished login | ☐ |
| Contract security clauses read and filed | Public-body and research customers set their own terms | ☐ |
| Encrypted laptops with remote wipe | Travel to conferences, shared workspaces | ☐ |
| A restore test of the most valuable data | Backups that never get tested often fail | ☐ |
| Access review for students, interns, contractors | High turnover is normal in a university city | ☐ |
| One page: who to call in an incident | Speed matters in the first hour | ☐ |
Health and professional practices
Health care custodians in New Brunswick are governed by the Personal Health Information Privacy and Access Act (PHIPAA). A federal order exempts those custodians from Part 1 of PIPEDA for personal health information that is collected, used and disclosed in New Brunswick (SOR/2011-265; we read the proposed order as published in the Canada Gazette on March 12, 2011, so verify the registered text). The Office of the Ombud publishes a breach notification form for PHIPAA custodians, which describes notifying affected individuals and the Ombud. Law, accounting and other professional practices that are not health custodians generally look to federal PIPEDA for customer information, plus their regulator's own rules. None of this is legal advice. Our New Brunswick privacy law guide lays out a which-law-applies flow.
What the work looks like
We start with an assessment of accounts, devices, data and current controls, and return a prioritized list. Ongoing protection typically combines endpoint detection and response, multi-factor authentication, email filtering, patching, backups and a monthly report. We do not publish a Fredericton rate card. For cost ranges and what is billed separately, see managed IT services in New Brunswick and the cost article.
Delivery is remote. TechCare Canada publishes independent guidance and routes hands-on work through IT Cares, a Quebec-based partner. We have no Fredericton office or staff. Onsite attendance at a Fredericton address is confirmed case by case in writing, and we do not promise response times here.
Related reading
- Other New Brunswick cities: Moncton and Saint John
- Province articles: which law applies, cyberattack lessons
- National guides: small business cybersecurity, managed IT services in Canada, what is zero trust security
Frequently asked questions
Does Fredericton's cybersecurity sector mean small businesses are safer?
Not by itself. The University of New Brunswick runs the Canadian Institute for Cybersecurity in Fredericton, but research institutes and startups are not managed service providers. Small offices still need their own multi-factor authentication, patching, backups and an incident plan.
I supply a New Brunswick public body. What privacy law applies?
Public bodies, including municipalities, are covered by RTIPPA. Your own obligations as a supplier come mainly from your contract, so read its security and breach clauses and ask the customer what it expects. This is not legal advice.
Are New Brunswick health practices covered by PIPEDA?
For personal health information collected, used and disclosed in New Brunswick, custodians fall under PHIPAA, and a federal order exempts them from Part 1 of PIPEDA. Verify the registered order and your status as a custodian.
Can you certify us to a research partner's security standard?
No. We can help implement and document controls such as encryption, access governance, logging and backups, but certification or eligibility comes from the partner or the relevant authority.
Do you have a Fredericton office?
No. Service is delivered remotely, with hands-on work fulfilled by IT Cares in Quebec. Onsite attendance is confirmed case by case in writing.
Get a security review for your Fredericton business
Tell us your sector, who you sell to and the systems you rely on. We reply with a prioritized plan and confirm in writing what can be done remotely and whether onsite is possible.
No payment, no obligation. Hands-on work is fulfilled by IT Cares.