HSM IT ServicesGovernment and Public Sector
Municipalities, agencies, boards and other public bodies in Alberta deliver essential services while managing personal information under provincial access and privacy law. HSM IT Services helps public sector organizations keep systems reliable, protect records and respond to growing cyber threats with limited staff.
Smaller public bodies in Alberta, such as towns, villages, counties, regional service commissions, agencies and boards, often have broad responsibilities and very small IT teams, or none at all. They run utility billing, property tax, permitting, payroll, records management and public-facing websites, along with systems for public works and emergency services. Staff may work from a town office, a public works shop, a recreation centre and the field, all of which need dependable, secure technology.
Public bodies are frequent targets for ransomware and fraud. Attackers know that disruption to public services creates pressure to pay, and that small organizations may lack strong controls. Payment redirection schemes aimed at vendor and contractor payments are common. Water, wastewater and other utility systems may rely on control systems that need to be kept separate from office networks, and remote access to those systems requires careful management. Regular staff training and clear payment verification steps reduce these risks considerably.
In 2025, Alberta's Access to Information Act and Protection of Privacy Act replaced the Freedom of Information and Protection of Privacy Act. Public bodies must protect personal information with reasonable security arrangements and respond to access requests within legislated timelines, which depends on well organized, retrievable records. Councils and boards also expect clear reporting on risk. A structured approach to security, backups, records and incident response helps public bodies meet these responsibilities and maintain public trust.
Risks we see most
Ransomware
An attack can halt utility billing, permitting and other public services, and expose records about residents and staff.
Vendor payment fraud
Criminals impersonate contractors and suppliers to redirect payments for capital projects and ongoing services.
Utility control system exposure
Water and wastewater systems connected to office networks or remote access tools can be reached by attackers if not properly separated.
Records that are hard to find or protect
Information scattered across email, shared drives and personal devices makes access requests difficult and increases privacy risk.
Limited internal IT capacity
Small teams struggle to keep up with updates, monitoring and planning, leaving known weaknesses unaddressed.
How HSM IT Services helps
- Managed or co-managed IT that supports existing staff rather than replacing them
- Security monitoring, multi-factor authentication and endpoint protection across all sites
- Network separation and secure remote access for utility and control systems
- Microsoft 365 and records management setup that supports access requests and retention
- Backups and disaster recovery planning for essential public services
- Security reporting and policy development suitable for council or board review
Rules and standards that apply
- Alberta Protection of Privacy Act
- Alberta Access to Information Act
- Municipal Government Act (Alberta) for municipalities
- Records retention bylaws and schedules
This is general information, not legal advice. Confirm your obligations with your lawyer or regulator.
Services for this sector
Co-Managed IT
Our Co-Managed IT partners with your internal IT staff, adding help desk capacity, enterprise tools, security operations and specialist skills where you need them. You keep control of your environment and priorities while gaining the depth of a full team, backup coverage and access to cybersecurity expertise.
Learn moreManaged Detection and Response
Our Managed Detection and Response combines security tooling with analysts who watch your endpoints, identities, email and network for signs of attack. When a real threat appears, we investigate, contain it and guide your recovery, so small teams get enterprise-grade defence without building a security operations centre.
Learn moreCompliance and Privacy (PIPA and HIA)
Our Compliance and Privacy services help Alberta organizations understand and meet their obligations under PIPA, the Health Information Act, the public-sector privacy legislation and PIPEDA. We assess your safeguards, build practical policies and map controls to frameworks such as CIS Controls v8.1, NIST CSF 2.0, ISO/IEC 27001:2022 and SOC 2.
Learn moreVirtual CISO
Our Virtual CISO gives your organization an experienced security leader on a part-time basis. We set strategy, manage risk, guide compliance with PIPA, HIA and recognized frameworks, report to leadership and boards, and make sure security spending goes where it reduces the most risk.
Learn moreQuestions we hear
We have one IT person. Can you work with them?
Yes. Co-managed IT is common for public bodies. We provide monitoring, security tools, after-hours coverage and project help, while your staff member keeps local knowledge and day-to-day relationships. Responsibilities are documented so everyone knows who handles what, and your team gets backup during vacations, emergencies and busy periods.
How does the new Alberta privacy legislation affect our IT?
The Protection of Privacy Act requires public bodies to protect personal information with reasonable security arrangements, and the Access to Information Act depends on records being organized and retrievable. We help with the technical side, including access controls, encryption, logging, backups and records storage. Your access and privacy coordinator, or legal advisor, should guide interpretation of the legislation itself.
Can you report to council or our board?
Yes. We can prepare plain-language reports on your security posture, risks, progress and recommendations, and present them if requested. This helps elected officials and board members understand where funding is needed and supports informed decisions about priorities without requiring technical background.