TGV: lessons from the Performance group

Vendors preparing a TGV certification put their energy into the security and privacy streams, and get to the Performance group last, often the week of submission. It is the shortest group in the kit and the one where we see the most answers returned for the same reason: an assertion in place of a measurement.

What the sources say

The document Certification, Trousse globale de vérification (TGV), published by Quebec's ministère de la Santé et des Services sociaux in 2024 (publication 24-715-38W), defines the certification as an attestation that a version of a technological product or service (PST) complies with the requirements of the health and social services sector for security, privacy, performance and technology. It is carried out by the Bureau de certification et d'homologation (BCH) with external partners, and a penetration test has been mandatory since January 2022.

The same document describes what the BCH expects even before submission: for every applicable criterion, the vendor must be able to provide documentary evidence (documents, screenshots, copies of contracts). Once certification is granted, the contract runs three years, renewable annually under conditions: an annual self-declaration, at least one penetration test per year by a firm recognized by the BCH, fixes within a maximum of fifteen business days after receipt of the test report, declaration of any major change at least twenty business days before it goes to production, and a disaster recovery exercise every two years. A refusal can be followed by a new application, at the vendor's expense, after a minimum period of three months.

The Quebec government's page of orientations and documents gathers the verification criteria grid, the standard clause for tenders, the application and renewal forms, and the orientations on penetration testing, cloud computing and multi-factor authentication. Our TGV controls guide covers the seven criteria of the Performance group, PF01 to PF07, one per page.

Why it matters

The Performance group asks for seven documents: minimum technical specifications per user tier (PF01), maximum tolerated latency (PF02), minimum bandwidth (PF03), share of traffic induced on a point of service link (PF04), response times under the best and worst conditions (PF05), handling of lost, reordered or expired packets (PF06) and retention and reconnection delays (PF07).

These seven criteria have one thing in common: they describe how the product behaves on a real network, the one of facilities in the regions, of links shared between several clinical applications and of tablets switching from Wi-Fi to cellular. A verifier cannot accept "the application is fast"; they must be able to read a threshold, a method and a date.

Three lessons keep coming back in the files we support.

Evidence is a measurement, not a sentence. The PF01 load test report, the PF02 latency test report, the PF03 consumption measurement: the verifier asks for the methodology and the test conditions. A technical sheet with no report behind it is an estimate.

The seven figures must hold together. The PF02 latency threshold must be consistent with the PF05 worst conditions; the PF03 bandwidth with the PF04 traffic share calculation; the PF06 tolerated loss rate with the PF07 reconnection delay. An inconsistency between two sheets is the first thing the verifier flags.

The document must be as old as the version. The BCH certifies a version. A performance sheet dated from an earlier version, with no mention of a major change, invalidates the evidence.

What we think at Sentrix

The Performance group is the easiest to pass on the first attempt, provided it is treated as a measurement campaign and not as a writing exercise.

1. Plan a single test campaign that produces the seven measurements: load per user tier, increasing simulated latency, consumption per user and per site, simulated packet loss rate, disconnection during an active transaction.
2. Document the method before the result: tool, conditions, version tested, date. That is what the verifier reads first.
3. Keep a consistency table of the seven thresholds, reviewed by a single person, so that PF02, PF05, PF06 and PF07 tell the same story.
4. Tie each sheet to the PST version and record it in the change register the vendor commits to keeping after certification.
5. Reuse the campaign at the annual renewal: the vendor that has automated its performance tests answers the self-declaration in a day.
6. Have the sheets reviewed by the network team of a partner facility when possible: they spot unrealistic assumptions about link size before the verifier does.

For vendors already certified to ISO 27001, this campaign fits under controls 8.6 (capacity management) and 8.14 (redundancy of information processing facilities). Our TGV compliance service structures the evidence file control by control; the TGV framework page summarizes the framework.

The next step

Before applying for certification, open your product's seven performance sheets and ask one question per sheet: which measurement supports it, and how old is it. If two sheets have no answer, the test campaign is the first task on the calendar, not the last.