Free GRC Resources
Practical guides, templates and webinars to help you build your GRC program, whether you use CapGRC or not.
All resources
Search our guides, articles, datasheets, webinars and templates
Serious injury test
Four questions to see whether an incident points toward notice to the Commission. Every incident still goes in the register.
30-day deadline
The date by which to answer an access, correction or portability request.
Which privacy law applies
Private sector, public body or PIPEDA, based on the licence and where the activity takes place.
Control weight calculator
Calculate CapGRC control weight (type, scope, protected assets, objectives) with editable static variables.
Return on investment calculator
Estimate the time and money savings CapGRC can generate for your organization.
How a Canadian company prepares a SOC 2 report
Scope, criteria, Type I and Type II. Buyers usually keep a Type II, often over 12 months.
OSFI B-13 and B-10: what a federal financial institution shows
B-13 since 1 January 2024, B-10 since 1 May 2024. A caisse or an AMF insurer follows another regime.
AMF and ICT risk: what a Quebec financial institution shows
Guideline of February 2020, to be taken up by 27 February 2021. Insurers, deposit institutions and trust companies under the AMF.
NIST CSF 2.0: the six functions without a second program
Since February 2024 the framework has six functions, including Govern. It organizes controls already kept for ISO 27001 or SOC 2.
Law 25 or PIPEDA: which privacy law applies to your organization
Inside Quebec, the provincial act applies. PIPEDA covers commercial flows across provinces and outside Canada.
Law 25 fines: what an organization can actually face
For the most serious offences, a fine can reach 25 million dollars or 4 percent of worldwide turnover.
Privacy officer under Law 25: role and how to appoint one
If nobody has been published since 22 September 2022, the person with the highest authority is responsible.
Law 25 privacy policy template
A policy to complete: purposes, retention, rights, and technologies that identify or profile.
Confidentiality incident register template
The register fields, including incidents that are not reported to the Commission, kept for at least five years.
Law 25 subcontractor clause template
The written commitments before a supplier handles personal information.
Template: privacy assessment for a transfer outside Quebec
The written assessment before information leaves Quebec, including to another province.
Consent under Law 25: forms, newsletters and profiling
Consent is requested for a specific purpose. Sensitive information needs express consent.
When to report a privacy incident to the Quebec Commission
The notice covers a risk of serious injury. Every other incident still goes in the register.
Biometrics under Quebec law: consent, alternative and Commission filing
You cannot require a fingerprint or a face to confirm identity. File with the Commission at least 60 days before a database.
Automated decisions under Law 25: what to tell the person
A decision made exclusively by automation comes with a notice and a review by a staff member.
Law 25 for a municipality, a clinic or a nonprofit
A municipality follows the public-sector act. A private clinic and a nonprofit that runs an enterprise follow the private-sector act.
Answering access, correction and portability requests
The 30-day deadline, identity checks, and the limits of the portability right in force since 22 September 2024.
Keeping personal information: set a period, then destroy it
Law 25 does not set one retention period for everything. How to write a rule per category and record destruction.
What to check on a vendor before you sign
Tier your vendors, require a written contract, and review critical files instead of forgetting them after onboarding.
How to write a Law 25 privacy policy
The sections to write, the ones to remove, and where to publish the text so it matches real activities.
Communicating personal information outside Quebec
Hosting in Ontario or in Europe is already outside Quebec. The written assessment and what the agreement has to cover.
How to run an internal audit engagement
Mandate, evidence, finding and closure. The report closes when the recommendation has been carried out.
Zero Trust: why zero-trust architecture is becoming essential in Canada
The network perimeter is no longer enough. Remote work, cloud and third-party access mean every request has to be checked.
Security incident management under Law 25: obligations and best practices
Since September 2023, a privacy incident that is not reported on time exposes the organization.
ISO 27001 vs SOC 2: which certification should your Canadian organization choose?
ISO 27001 and SOC 2 pursue similar goals for different buyers. How to choose for a Canadian organization.
How to map your information assets in compliance with Law 25
Information asset mapping shows that you know which personal information you hold, as Law 25 expects.
DORA: how Canadian companies with European operations must prepare
DORA has been in force since 17 January 2025. Canadian institutions linked to European entities are in scope.
The 10 essential risk indicators for your CISO dashboard
Ten indicators that support a decision, instead of a crowded dashboard, for the executive committee.
NIS2 and the Canadian public sector: anticipating new digital resilience requirements
NIS2 has applied since October 2024. What changes for a Canadian partner of a European entity.
Artificial intelligence and GRC internal audit: opportunities and risks for Canadian organizations
AI helps review large volumes of evidence. It also adds risks that internal audit has to cover.
Complete Guide to Law 25: Obligations and Compliance
Everything you need to know about Quebec's Law 25: obligations, timelines and practical steps to bring your organization into compliance.
How to Conduct a Risk Assessment for an SME
Practical method to identify, assess and treat security risks in a small or medium-sized enterprise.
DPIA: Practical Guide for Privacy Officers
How to conduct a Privacy Impact Assessment compliant with Law 25, step by step.
5 Common Mistakes in GRC Internal Auditing
The most frequent pitfalls in internal audit programs and how to avoid them to gain efficiency.
Managing Multiple GRC Frameworks Simultaneously
Strategies to align ISO 27001, Law 25 and PCI-DSS in a unified GRC program without duplicating efforts.
Structure an ISO 27001 project in 6 months
A realistic plan to frame your ISO 27001 project with CapGRC: risks, controls, SoA and internal audits.
PCI-DSS v4.0: What You Need to Know
Analysis of the major changes in PCI-DSS version 4.0 and their impact on Canadian organizations.
Understanding DORA: The European Digital Resilience Regulation
Complete guide to the Digital Operational Resilience Act (DORA): scope, obligations and impact on Canadian financial institutions.
Understanding PIPEDA: Canada's Federal Privacy Law
Complete guide to the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.
Law 25, Phase 3: what changes in September 2024
Analysis of phase 3 obligations and action plan for your organization.
How to choose your first GRC framework
Decision guide: ISO 27001, SOC 2, or start with Law 25?
Articles and guides
Serious injury test
Four questions to see whether an incident points toward notice to the Commission. Every incident still goes in the register.
Tool de lecture
30-day deadline
The date by which to answer an access, correction or portability request.
Tool de lecture
Which privacy law applies
Private sector, public body or PIPEDA, based on the licence and where the activity takes place.
Tool de lecture
Control weight calculator
Calculate CapGRC control weight (type, scope, protected assets, objectives) with editable static variables.
Tool de lecture
Return on investment calculator
Estimate the time and money savings CapGRC can generate for your organization.
Tool de lecture
How a Canadian company prepares a SOC 2 report
Scope, criteria, Type I and Type II. Buyers usually keep a Type II, often over 12 months.
8 min de lecture
OSFI B-13 and B-10: what a federal financial institution shows
B-13 since 1 January 2024, B-10 since 1 May 2024. A caisse or an AMF insurer follows another regime.
8 min de lecture
AMF and ICT risk: what a Quebec financial institution shows
Guideline of February 2020, to be taken up by 27 February 2021. Insurers, deposit institutions and trust companies under the AMF.
8 min de lecture
NIST CSF 2.0: the six functions without a second program
Since February 2024 the framework has six functions, including Govern. It organizes controls already kept for ISO 27001 or SOC 2.
8 min de lecture
Law 25 or PIPEDA: which privacy law applies to your organization
Inside Quebec, the provincial act applies. PIPEDA covers commercial flows across provinces and outside Canada.
8 min de lecture
Law 25 fines: what an organization can actually face
For the most serious offences, a fine can reach 25 million dollars or 4 percent of worldwide turnover.
7 min de lecture
Privacy officer under Law 25: role and how to appoint one
If nobody has been published since 22 September 2022, the person with the highest authority is responsible.
7 min de lecture
Law 25 privacy policy template
A policy to complete: purposes, retention, rights, and technologies that identify or profile.
8 min de lecture
Confidentiality incident register template
The register fields, including incidents that are not reported to the Commission, kept for at least five years.
7 min de lecture
Law 25 subcontractor clause template
The written commitments before a supplier handles personal information.
7 min de lecture
Template: privacy assessment for a transfer outside Quebec
The written assessment before information leaves Quebec, including to another province.
8 min de lecture
Consent under Law 25: forms, newsletters and profiling
Consent is requested for a specific purpose. Sensitive information needs express consent.
8 min de lecture
When to report a privacy incident to the Quebec Commission
The notice covers a risk of serious injury. Every other incident still goes in the register.
8 min de lecture
Biometrics under Quebec law: consent, alternative and Commission filing
You cannot require a fingerprint or a face to confirm identity. File with the Commission at least 60 days before a database.
8 min de lecture
Automated decisions under Law 25: what to tell the person
A decision made exclusively by automation comes with a notice and a review by a staff member.
7 min de lecture
Law 25 for a municipality, a clinic or a nonprofit
A municipality follows the public-sector act. A private clinic and a nonprofit that runs an enterprise follow the private-sector act.
8 min de lecture
Answering access, correction and portability requests
The 30-day deadline, identity checks, and the limits of the portability right in force since 22 September 2024.
8 min de lecture
Keeping personal information: set a period, then destroy it
Law 25 does not set one retention period for everything. How to write a rule per category and record destruction.
7 min de lecture
What to check on a vendor before you sign
Tier your vendors, require a written contract, and review critical files instead of forgetting them after onboarding.
8 min de lecture
How to write a Law 25 privacy policy
The sections to write, the ones to remove, and where to publish the text so it matches real activities.
10 min de lecture
Communicating personal information outside Quebec
Hosting in Ontario or in Europe is already outside Quebec. The written assessment and what the agreement has to cover.
9 min de lecture
How to run an internal audit engagement
Mandate, evidence, finding and closure. The report closes when the recommendation has been carried out.
9 min de lecture
Zero Trust: why zero-trust architecture is becoming essential in Canada
The network perimeter is no longer enough. Remote work, cloud and third-party access mean every request has to be checked.
9 min de lecture
Security incident management under Law 25: obligations and best practices
Since September 2023, a privacy incident that is not reported on time exposes the organization.
10 min de lecture
ISO 27001 vs SOC 2: which certification should your Canadian organization choose?
ISO 27001 and SOC 2 pursue similar goals for different buyers. How to choose for a Canadian organization.
11 min de lecture
How to map your information assets in compliance with Law 25
Information asset mapping shows that you know which personal information you hold, as Law 25 expects.
8 min de lecture
DORA: how Canadian companies with European operations must prepare
DORA has been in force since 17 January 2025. Canadian institutions linked to European entities are in scope.
10 min de lecture
The 10 essential risk indicators for your CISO dashboard
Ten indicators that support a decision, instead of a crowded dashboard, for the executive committee.
7 min de lecture
NIS2 and the Canadian public sector: anticipating new digital resilience requirements
NIS2 has applied since October 2024. What changes for a Canadian partner of a European entity.
9 min de lecture
Artificial intelligence and GRC internal audit: opportunities and risks for Canadian organizations
AI helps review large volumes of evidence. It also adds risks that internal audit has to cover.
11 min de lecture
Complete Guide to Law 25: Obligations and Compliance
Everything you need to know about Quebec's Law 25: obligations, timelines and practical steps to bring your organization into compliance.
12 min de lecture
How to Conduct a Risk Assessment for an SME
Practical method to identify, assess and treat security risks in a small or medium-sized enterprise.
8 min de lecture
DPIA: Practical Guide for Privacy Officers
How to conduct a Privacy Impact Assessment compliant with Law 25, step by step.
10 min de lecture
5 Common Mistakes in GRC Internal Auditing
The most frequent pitfalls in internal audit programs and how to avoid them to gain efficiency.
7 min de lecture
Managing Multiple GRC Frameworks Simultaneously
Strategies to align ISO 27001, Law 25 and PCI-DSS in a unified GRC program without duplicating efforts.
9 min de lecture
Structure an ISO 27001 project in 6 months
A realistic plan to frame your ISO 27001 project with CapGRC: risks, controls, SoA and internal audits.
11 min de lecture
PCI-DSS v4.0: What You Need to Know
Analysis of the major changes in PCI-DSS version 4.0 and their impact on Canadian organizations.
8 min de lecture
Understanding DORA: The European Digital Resilience Regulation
Complete guide to the Digital Operational Resilience Act (DORA): scope, obligations and impact on Canadian financial institutions.
14 min de lecture
Understanding PIPEDA: Canada's Federal Privacy Law
Complete guide to the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.
12 min de lecture
Technical datasheets
CapGRC module overviews. Choose the French or English version, then provide your details to receive the download link.
Templates
Provide your details to receive the download link.
Want to go further?
See how CapGRC can help you structure your GRC program and automate your compliance.