# Compliance 101 for SMBs: frameworks, controls, evidence > What a law, a framework, a control and a piece of evidence mean, and how a small business can choose where to start. - URL: https://nextit.tech/blog/compliance-101-frameworks-controls-and-evidence/ - Language: English - Other language: https://nextit.tech/fr/blogue/conformite-101-cadres-controles-et-preuves/ - Publisher: NextIT (https://nextit.tech/) --- [Blog](https://nextit.tech/blog/) # Compliance 101 for SMBs: frameworks, controls and evidence in plain words NextIT Privacy Team Oct 15, 2026 6 min read A customer asks whether every employee signs in with multi-factor authentication (MFA). Your IT lead says yes, but nobody can show proof. This article explains the four words behind that question and shows where a small business should start. ## What the words mean A **law** is a rule set by a government. It says what you must achieve, not how to do it. Law 25 in Québec and PIPEDA, the federal private-sector privacy law, are examples. Breaking them can cost money. A **framework** is a structured list of controls, grouped by topic. It describes what good practice looks like. SOC 2, ISO/IEC 27001 and the NIST Cybersecurity Framework are frameworks. You choose to use one, usually because a customer asks or because you want an orderly plan. A **control** is one thing you do, again and again, to reduce a risk. For example: every person who signs in to email uses MFA. **Evidence** is the proof that a control runs. It is a dated export, a log or a signed record. An auditor does not accept your word alone. Think of a food inspection. The health rule says food must be safe. A food-safety guide lists the practices that keep food safe. Washing hands before cooking is a control. The temperature log, filled in each day, is the evidence. ## One running example: everyone uses MFA Follow one control through its three parts. - **The control:** every person who signs in to your email, file storage or finance tools uses MFA. An exception needs a written reason and a named owner. - **The evidence:** a dated export from your sign-in service that lists each account and whether MFA is on, with the list of exceptions attached. - **The auditor’s question:** “Show me that every account with access to customer data uses MFA, and tell me how you know no account was missed.” The last question matters most. The auditor does not ask for one screenshot. The auditor asks about every account, and about how you know the list is complete. A control without complete evidence is a promise, not proof. ## The map: six names on one page Six names come up most often. | Name | What it is | Who asks for it | Mandatory or voluntary | | --- | --- | --- | --- | | Law 25 | Québec privacy law for the private sector | The Commission d’accès à l’information du Québec (CAI) oversees it | Mandatory for every business that holds personal information about people in Québec | | PIPEDA | Federal private-sector privacy law for commercial activity | The Office of the Privacy Commissioner of Canada oversees it | Mandatory for commercial activity across Canada, except in provinces with a substantially similar law | | SOC 2 | Attestation report by an independent CPA (chartered professional accountant) firm, against the American Institute of CPAs (AICPA) Trust Services Criteria | Business customers, common in North American business-to-business (B2B) sales | Voluntary | | ISO/IEC 27001 | International standard for an information security management system, certified by an accredited body | Business customers and partners who want certification | Voluntary | | GDPR (RGPD) | General Data Protection Regulation, the European Union privacy law | Data protection authorities in the European Union | Mandatory when you offer goods or services to people in the EU or monitor their behaviour | | NIST CSF 2.0 | Six functions: Govern, Identify, Protect, Detect, Respond, Recover | Anyone who needs a common language for security | Voluntary | Law 25 and PIPEDA are laws. SOC 2, ISO/IEC 27001 and NIST CSF are frameworks that help you organize controls and show them. GDPR applies only when you offer goods or services to people in the European Union, or monitor their behaviour. SOC 2 comes in two types. Type I checks the design of your controls at one point in time. Type II tests whether the controls worked over a period, often three to 12 months. A framework audit does not prove, on its own, that you meet Law 25. Map each legal duty to a control first, then check those controls against the framework you choose. ## Why it matters for an SMB Law 25 sets serious penalties. Administrative monetary penalties can reach 10 million dollars or 2% of worldwide turnover for the previous fiscal year, whichever is greater. Penal fines can reach 25 million dollars or 4% of worldwide turnover, whichever is greater. People can also sue you for damages, and punitive damages apply to intentional or grossly negligent breaches. GDPR fines can reach 20 million euros or 4% of worldwide annual turnover, if the law applies to you. PIPEDA adds a duty to report. A breach of security safeguards that creates a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada and to the people affected. Every breach must be recorded, and the record kept for 24 months. A lost deal is a concrete risk too. Large customers ask for proof of compliance before they sign, and a questionnaire with no evidence behind it slows the sale. ## How a small business picks where to start Start with the laws that bind you. Add a framework only when a real request needs one. 1. **List the laws that apply.** A Québec business starts with Law 25. If you serve people in the European Union, look at GDPR too. Ask your adviser how PIPEDA applies to your data flows. 2. **Ask your largest customers which proof they request.** Their answer shows whether SOC 2, ISO/IEC 27001 or another report matters for your sales. 3. **Fix the basics first.** A good first set of controls covers multi-factor authentication, least privilege (each person gets only the access the job needs), patching, backups that you have restored at least once, and an incident response plan. Add security awareness training for every employee. 4. **Give each control an owner and a place for its evidence.** A control without an owner does not run. Evidence without a place gets lost. 5. **Set a review date for each control.** Evidence goes out of date. A review date tells you when to collect it again. ## Common mistakes - **Collecting evidence nobody maps.** A folder of screenshots with no control name on each file. When the auditor asks about MFA, nobody knows which file answers. - **Buying a certificate before the basics.** A certificate covers the scope the auditor tested. Shared passwords and backups nobody has restored can stay open beside it. - **Writing policies nobody follows.** A policy works as a control only when people do what it says, and you can show it. - **Adopting a whole framework at once.** Start with the controls your laws and your customers need, then extend the list. **Good to know:** This article is general information, not legal advice. For your own obligations, speak with a qualified lawyer. ## How NextIT helps NextIT brings this work into one place for businesses in Québec and Canada. The [compliance assessment](https://nextit.tech/docs/compliance-assessment/) covers Law 25, PIPEDA, ISO/IEC 27001, SOC 2 and other frameworks. `Control Management` and `Evidence Repository` keep each control with the proof for it. The `Compliance Report` exports your results as a PDF or a CSV file. To see how this works with your own controls, [book a demo](https://nextit.tech/book-a-demo/). Free posture report ### Is your business exposed? Find out in 5 minutes. Enter your domain. Confirm ownership by email, then get your free security posture & compliance report. [Book a strategic meeting](https://nextit.tech/book-a-demo/) - No card required - Hosted in Canada NextIT Privacy Team Security, Law 25 compliance and IT governance for SMBs. ### About the author The NextIT Privacy Team helps Québec and Canadian SMBs meet Law 25 and PIPEDA without a dedicated compliance department, from the first checklist to the audit. ### More articles from NextIT - [ISO/IEC 27001 explained for SMBs: the standard, the controls and the audit Oct 27, 2026](https://nextit.tech/blog/iso-27001-explained-for-smbs/) - [Law 25 explained: what Québec’s privacy law asks of SMBs Oct 27, 2026](https://nextit.tech/blog/law-25-explained-what-quebecs-privacy-law-asks-of-smbs/) - [The NIST Cybersecurity Framework 2.0, explained for small businesses Oct 27, 2026](https://nextit.tech/blog/nist-csf-2-explained-for-smbs/) - [SOC 2 explained for SMBs: what the report covers and how to prepare Oct 27, 2026](https://nextit.tech/blog/soc-2-explained-for-smbs/) - [Data subject requests under Law 25: how to answer within 30 days Oct 15, 2026](https://nextit.tech/blog/data-subject-requests-under-law-25/) ## Scan your company. Or let's talk strategy. Get your free posture report in 5 minutes — or book a strategic meeting with our team. [Book a strategic meeting](https://nextit.tech/book-a-demo/) No credit card required · Bilingual FR / EN · Hosted in Canada