GRC Articles & Analysis
Practical advice, regulatory analysis and expert guides for Canadian GRC professionals.
Recent articles
NIST CSF 2.0: the six functions without a second program
Since February 2024 the framework has six functions, including Govern. It organizes controls already kept for ISO 27001 or SOC 2.
How a Canadian company prepares a SOC 2 report
Scope, criteria, Type I and Type II. Buyers usually keep a Type II, often over 12 months.
OSFI B-13 and B-10: what a federal financial institution shows
B-13 since 1 January 2024, B-10 since 1 May 2024. A caisse or an AMF insurer follows another regime.
All articles
(31)Biometrics under Quebec law: consent, alternative and Commission filing
You cannot require a fingerprint or a face to confirm identity. File with the Commission at least 60 days before a database.
Automated decisions under Law 25: what to tell the person
A decision made exclusively by automation comes with a notice and a review by a staff member.
Law 25 for a municipality, a clinic or a nonprofit
A municipality follows the public-sector act. A private clinic and a nonprofit that runs an enterprise follow the private-sector act.
Consent under Law 25: forms, newsletters and profiling
Consent is requested for a specific purpose. Sensitive information needs express consent.
When to report a privacy incident to the Quebec Commission
The notice covers a risk of serious injury. Every other incident still goes in the register.
Law 25 or PIPEDA: which privacy law applies to your organization
Inside Quebec, the provincial act applies. PIPEDA covers commercial flows across provinces and outside Canada.
Law 25 fines: what an organization can actually face
For the most serious offences, a fine can reach 25 million dollars or 4 percent of worldwide turnover.
Privacy officer under Law 25: role and how to appoint one
If nobody has been published since 22 September 2022, the person with the highest authority is responsible.
Answering access, correction and portability requests
The 30-day deadline, identity checks, and the limits of the portability right in force since 22 September 2024.
Keeping personal information: set a period, then destroy it
Law 25 does not set one retention period for everything. How to write a rule per category and record destruction.
What to check on a vendor before you sign
Tier your vendors, require a written contract, and review critical files instead of forgetting them after onboarding.
How to write a Law 25 privacy policy
The sections to write, the ones to remove, and where to publish the text so it matches real activities.
Communicating personal information outside Quebec
Hosting in Ontario or in Europe is already outside Quebec. The written assessment and what the agreement has to cover.
How to run an internal audit engagement
Mandate, evidence, finding and closure. The report closes when the recommendation has been carried out.
Zero Trust: why zero-trust architecture is becoming essential in Canada
The network perimeter is no longer enough. Remote work, cloud and third-party access mean every request has to be checked.
Security incident management under Law 25: obligations and best practices
Since September 2023, a privacy incident that is not reported on time exposes the organization.
ISO 27001 vs SOC 2: which certification should your Canadian organization choose?
ISO 27001 and SOC 2 pursue similar goals for different buyers. How to choose for a Canadian organization.
How to map your information assets in compliance with Law 25
Information asset mapping shows that you know which personal information you hold, as Law 25 expects.
DORA: how Canadian companies with European operations must prepare
DORA has been in force since 17 January 2025. Canadian institutions linked to European entities are in scope.
The 10 essential risk indicators for your CISO dashboard
Ten indicators that support a decision, instead of a crowded dashboard, for the executive committee.
NIS2 and the Canadian public sector: anticipating new digital resilience requirements
NIS2 has applied since October 2024. What changes for a Canadian partner of a European entity.
Artificial intelligence and GRC internal audit: opportunities and risks for Canadian organizations
AI helps review large volumes of evidence. It also adds risks that internal audit has to cover.
Complete Guide to Law 25: Obligations and Compliance
Everything you need to know about Quebec's Law 25: obligations, timelines and practical steps to bring your organization into compliance.
How to Conduct a Risk Assessment for an SME
Practical method to identify, assess and treat security risks in a small or medium-sized enterprise.
DPIA: Practical Guide for Privacy Officers
How to conduct a Privacy Impact Assessment compliant with Law 25, step by step.
5 Common Mistakes in GRC Internal Auditing
The most frequent pitfalls in internal audit programs and how to avoid them to gain efficiency.
Managing Multiple GRC Frameworks Simultaneously
Strategies to align ISO 27001, Law 25 and PCI-DSS in a unified GRC program without duplicating efforts.
How to structure an ISO 27001 certification project in 6 months
A realistic plan to frame risks, controls, SoA and internal audits with CapGRC.
PCI-DSS v4.0: What You Need to Know
Analysis of the major changes in PCI-DSS version 4.0 and their impact on Canadian organizations.
Understanding DORA: The European Digital Resilience Regulation
Complete guide to the Digital Operational Resilience Act (DORA): scope, obligations and impact on Canadian financial institutions.
Understanding PIPEDA: Canada's Federal Privacy Law
Complete guide to the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.
Go further with CapGRC
Discover all our guides, templates and webinars to structure your GRC program.