Bécancour
IT services in Bécancour for industrial park suppliers
Sell to a large company and, more and more, the contract arrives with a security questionnaire attached. Forty questions, sometimes a hundred, each with an “attach evidence” box beside it. OKTO Solutions offers managed IT to Bécancour businesses from Trois-Rivières, 23 km away, and keeps that evidence on hand.
A Bécancour subcontractor who receives a large customer’s security questionnaire has to demonstrate its controls: multi-factor authentication, patching, tested backups, access management. OKTO Solutions, based in Trois-Rivières 23 km away, puts those measures in place, documents them and supplies dated evidence for each one.
How does a Bécancour supplier answer a large customer’s security questionnaire?
A Bécancour supplier answers a large customer’s security questionnaire by attaching evidence to every statement, and OKTO Solutions helps produce that evidence. The company works from its office in Trois-Rivières, 23 km away, with no address and no staff in Bécancour. It manages workstations, servers and Microsoft 365 remotely, then documents what the questionnaire checks: multi-factor authentication on all accounts, patches applied, backups restored in a test, encrypted devices, access removed when an employee leaves. Each control leaves a dated record drawn from the management tools instead of typed up by hand. When a measure is missing, OKTO says so and proposes a date for the fix, because an acknowledged gap is worth more than an answer nobody can demonstrate. OKTO holds no SOC 2 or ISO certification and issues none. An on-site visit takes place the same day or the next.
Shown here, an insurer’s form. A buyer’s form works the same way: a box, then the evidence next to it.
What comes with the contract
Why did this questionnaire land on your desk?
Large companies are seldom attacked head-on. Attackers go through the smallest link: the machine shop with a login to the ordering portal, the maintenance firm whose staff carry a badge, the carrier that gets shipping slips by email. Procurement knows it. So each supplier is asked to describe its security before the agreement is renewed.
The document ends up with the controller or the plant manager, rarely with someone who does this for a living. The questions are written in auditor language. It is tempting to tick “yes” all the way down and be done. Bad idea: those answers become part of the contract, and the customer can ask to see.
The mechanics
From the question asked to the file attached
Forms vary from one customer to the next, but the same subjects keep coming back. Each has a measure to put in place and a document that demonstrates it.
| What the questionnaire asks | The control in place | The evidence handed over |
|---|---|---|
| Are accounts protected by a second factor? | Multi-factor authentication required for everyone, management included | Export of the account list and each sign-in method |
| Are systems kept up to date? | Patches rolled out and tracked device by device | Dated patch compliance report |
| Can data be restored? | Daily backup with an off-site copy | Backup log and the write-up of the latest restore test |
| Who has access to what? | One account per person, rights reviewed at a fixed interval | Access register and signed offboarding procedure |
| Are devices known and encrypted? | Inventory kept by the management tool, disk encryption | Device list showing encryption status |
| What happens during an incident? | Written procedure, a named person in charge | The document itself, with its revision date |
Several of these questions overlap with what Quebec’s Law 25 asks of a small business, notably the person in charge and the incident register. Work done for one serves the other.
The most neglected evidence
What do you say when they ask for your logs?
This is the question that causes the most trouble. “Do you keep a history of sign-ins?” Plenty of small businesses answer yes in good faith, since Microsoft 365 does keep records. Except nobody reads them, and nobody could find them on a Friday at 4 p.m.
A log is only worth something if it is read. In a managed fleet, a sign-in from an unusual place stands out, someone checks it, and access is revoked if need be. The action is recorded. Six months later, when the customer asks how an incident was handled, you hand over the sequence: who, when, what.
An unusual sign-in is revoked, then the log records every step. That record is what goes in the file.
The steps
The questionnaire came in on Monday. Now what?
No point in rushing. A sloppy form comes back with follow-up questions, and that is where the weeks go.
- Read the whole form and sort each question: in place, in place but unproven, absent.
- Check the real state of the systems before writing a single “yes”. What people believe is switched on is not always on.
- Close the quick gaps, the ones fixed by a setting and not by a purchase.
- Gather the evidence in one folder, one item per question, each with its date.
- Write down the remaining gaps with a realistic deadline that management approves.
- Keep the folder alive. The same customer will ask again next year, and another will ask sooner.
The territory
A 70 km² industrial and port park on the St. Lawrence
Bécancour had 13,561 residents at the 2021 census. It is the seat of the Bécancour regional county municipality, in the Centre-du-Québec region. The Société du parc industriel et portuaire de Bécancour, created by the Quebec government in 1968, runs a 70 km² territory there along with a port that has five berths. The smaller firms that receive the questionnaires work around those large facilities.
Trois-Rivières
Our office is on the north shore, 23 km away. Visits to Bécancour start from there.
Nicolet
Further west, for small organizations where IT rests on one person.
Shawinigan
For businesses with a workshop beside the office and a production network to tidy up.
The other territories are on the service areas page. If you already have an IT person in-house, see co-managed IT services.
Questions and answers
Your questions about our services in Bécancour
A customer in the industrial park sent us a security questionnaire. Can you fill it in?
What do we do when the true answer is no?
What evidence do large customers ask for most often?
Is OKTO Solutions SOC 2 or ISO 27001 certified?
Do you have an address in Bécancour?
Do you come on site in Bécancour?
Have a questionnaire to hand in?
Send us the form and the due date. We will tell you which answers are already backed up, which need work and how much time to allow.
Reviewed by Antonio Pazzi, president of OKTO Solutions · updated