Movahedi Solutions
Cybersecurity Self-Assessment: NIST Cybersecurity Framework
This document is a self-assessment by 1000823315 ONTARIO INC., operating as Movahedi Solutions. It is not a certification, not an audit, and not a third-party verification. It describes, in the structure of the NIST Cybersecurity Framework, what Movahedi Solutions does for its public site and for engagements, backed only by what is verified. It does not describe a penetration test, and no section claims one.
This document is a self-assessment. It is not a certification, not an audit, and not a third-party verification. 9 main sections: NIST Cybersecurity Framework Govern, Identify, Protect, Detect, Respond, Recover, public site and engagements, HTTPS through Cloudflare, GitHub build and deploy, Security Headers header scan A+ on October 28, 2026, at 00:59 UTC, labelled as a header scan only.
This document is a self-assessment by 1000823315 ONTARIO INC., operating as Movahedi Solutions. It is not a certification, not an audit, and not a third-party verification. It describes, in the structure of the NIST Cybersecurity Framework, what Movahedi Solutions does for its public site and for engagements, backed only by what is verified. It does not describe a penetration test, and no section below claims one.
Date: October 28, 2026 Company: 1000823315 ONTARIO INC., operating as Movahedi Solutions Location: Mississauga, Ontario, Canada Contact: mohammad@movahedi.ca Public site: https://www.movahedi.ca
1. Status and scope
This self-assessment covers two areas: the public site at movahedi.ca, and the handling of client material in engagements. It does not cover a client system. A client system keeps its own controls, and those controls are confirmed per engagement where Movahedi Solutions is asked to review them.
Movahedi Solutions is an independent privacy and AI governance consultancy. Its founder holds, as personal credentials, ISC2 CC, CIPP/C, and Lean Six Sigma coursework (LinkedIn Learning, 2022). Those are personal credentials. They are not company certifications.
2. Systems in scope
Public site: movahedi.ca, served over HTTPS through Cloudflare, built and deployed from GitHub.
Engagements: advisory work listed in Section 1 of the companion privacy and AI governance self-assessments, namely AI Governance, Privacy and Data Governance, Cookie and Script Governance, Process Excellence, Custom AI and Data Solutions, and Fractional Advisory.
Client data rules for engagements: client data is used only for its engagement, access is limited, and client data is removed at the end of the engagement, or returned or deleted on client instruction. There is no sale of client data and no use of client data for model training. A client is not named publicly without written permission.
Website Privacy Policy last updated: October 29, 2026.
3. Govern: roles, rules, and oversight
Govern means setting the roles and rules for cybersecurity, and keeping them current.
What Movahedi Solutions does:
- The founder is accountable for the public site and for engagement handling rules stated in Section 2.
- Engagement handling rules are stated in writing for each engagement: use only for that engagement, limited access, and removal, return, or deletion at the end or on client instruction.
- The public site publishes a Website Privacy Policy, last updated October 29, 2026, and a contact point, mohammad@movahedi.ca, for questions about the site and about engagements.
- Registrations recorded October 27, 2026, are listed in Section 9, so a buyer can check the same registrations on the named platforms.
What is confirmed per engagement: the handling rules for that engagement, the contact for security questions, and any client rules that Movahedi Solutions must follow while working with client material.
4. Identify: what is in scope, and what matters most
Identify means knowing what assets and risks are in scope, so protection can focus on the right places.
What Movahedi Solutions does:
- Keeps the public site scope clear: one public site, movahedi.ca, built and deployed from GitHub, so the source for the live site is held in version control.
- Keeps engagement scope clear: each engagement names its systems, data flows, and deliverables in writing before work that depends on them begins.
- Uses inventories, risk assessments, and privacy advisory work to help a client identify its own assets and risks, where that is the service engaged.
What is confirmed per engagement: the assets, data flows, and deliverables in scope for that engagement.
5. Protect: safeguards for the site and for client material
Protect means safeguards that limit access and keep material safe.
What is verified for the public site:
- The site is served over HTTPS through Cloudflare.
- The site is built and deployed from GitHub.
- Header scan: Security Headers header scan, result A+, October 28, 2026, 00:59 UTC, at https://securityheaders.com/?q=https://movahedi.ca&followRedirects=on. Header scan, not a penetration test.
What Movahedi Solutions does for client material in engagements:
- Uses client data only for its engagement.
- Limits access to client data.
- Removes client data at the end of the engagement, or returns or deletes it on client instruction.
- Does not sell client data and does not use client data for model training.
- Does not name a client publicly without written permission.
What is confirmed per engagement: the access limits, handling steps, and end-of-engagement step for that engagement.
6. Detect: noticing a problem
Detect means noticing when something is wrong, so it can be checked promptly.
What Movahedi Solutions does:
- For the public site, the GitHub source gives a record of what was deployed, so a change to the live site can be traced to its source.
- For engagements, the engagement record gives a clear scope, so material outside that scope can be spotted and raised with the client.
- Security questions and reports about the public site or an engagement can be sent to mohammad@movahedi.ca.
What is confirmed per engagement: the contact for raising a concern, and the record the engagement will keep.
This section states only what is verified above. It does not claim a monitoring platform, a detection tool, or a response time.
7. Respond: acting when a problem is confirmed
Respond means acting in a planned way when a problem is confirmed.
What Movahedi Solutions does:
- For the public site, a confirmed problem is handled through the site source in GitHub and redeployment of the corrected site, with the contact in Section 1 as the point for reports.
- For an engagement, a confirmed problem with client material is raised with the client promptly, and the handling step is agreed with the client for that engagement, including return or deletion where the client instructs it.
- For breach readiness in a client program, where that is the service engaged, Movahedi Solutions provides breach response tools and advisory support, including the breach clock, triggers, who to notify, and the incident register a client needs to keep.
What is confirmed per engagement: the response contact, the notification owner on the client side where applicable, and the record to be kept.
This section does not claim a response time, a response team size, or a client incident outcome.
8. Recover: restoring service and closing the loop
Recover means restoring normal work after a problem, and recording what was learned.
What Movahedi Solutions does:
- For the public site, the GitHub source supports redeployment of the site after a correction, so recovery does not depend on a single live copy.
- For an engagement, recovery is closed with the client: the agreed handling step for client material is completed, and the engagement record is updated.
- For a client program, where that is the service engaged, Movahedi Solutions helps the client record the incident, the actions taken, and the next review point.
What is confirmed per engagement: the recovery step, the record update, and the next review point for that engagement.
This section does not claim a recovery time or an availability figure.
9. Evidence, limits, and contact
Evidence cited in this document:
- Public site served over HTTPS through Cloudflare, built and deployed from GitHub.
- Header scan: Security Headers header scan, result A+, October 28, 2026, 00:59 UTC, at https://securityheaders.com/?q=https://movahedi.ca&followRedirects=on. Header scan, not a penetration test.
- Public site checked on October 28, 2026, at https://www.movahedi.ca
- Website Privacy Policy last updated October 29, 2026.
- Client data rules, Section 2, as stated by Movahedi Solutions for its engagements.
Limits: this self-assessment does not claim a company certification, insurance, or clearance. It does not claim a penetration test, a monitoring platform, a response time, or an availability figure. It does not cover a client system.
Registrations and third-party listings recorded October 27, 2026: UNGM Basic; MERX Basic Free; CanadaBuys / SAP Ariba; CPSS ePortal; Ontario Tenders Portal; LinkedIn Services; Catalant; Clutch, https://clutch.co/profile/movahedi 0 reviews; Trustpilot, https://www.trustpilot.com/review/movahedi.ca 0 reviews / 0.0.
Contact: mohammad@movahedi.ca. A buyer who needs a document for a specific procurement can request it through that contact, and Movahedi Solutions will confirm what it can provide for that procurement.
Related pages
Scope and limits, stated briefly
Where a matter is to be confirmed per engagement, it is stated as such, and it is confirmed in writing for that engagement before work starts. Contact: mohammad@movahedi.ca.