Is TGV certification mandatory?

Establishments acquiring certain technology products (equipment, software or applications) must ensure they are certified. A standard clause is suggested for inclusion in the request for proposals leading to the product’s acquisition, so a vendor without certification can find itself excluded from a procurement in Quebec’s health and social services network.

How long does a TGV certification last?

The certification contract runs three years but is renewable annually, conditional on the vendor’s compliance with its ongoing commitments: an annual self-declaration, at least one penetration test per year, vulnerability remediation within the set delays, and reporting of major changes made to the certified technology product or service.

What happens if a new version fails a control?

The vendor is notified that its PST does not meet the TGV requirements. It may reapply, at its own expense, after a minimum three-month period, once the expected corrections have been made. That is why it pays to prepare the evidence file control by control and to track remediation ahead of the certifier’s visit.

TGV guide

TGV controls guide: the Performance group

The Trousse globale de vérification (TGV) certifies products for Quebec’s health network. This guide explains the seven Performance controls, one page each.

What the TGV certifies

The Trousse globale de vérification (TGV) is how the Bureau de certification et d’homologation (BCH) verifies that a technology product or service (PST) meets the requirements of Quebec’s health and social services network for security, privacy, performance and technology.

The TGV is a point-in-time attestation, renewed annually, that a given version of a PST conforms to the health and social services sector’s requirements across four dimensions:

security;
protection of personal information;
performance;
technology.

A mandatory penetration test comes on top of these four dimensions. Certification is issued by the BCH with an independent auditing partner. Sentrix offers TGV certification support to vendors preparing their file; the TGV framework page summarizes the framework.

How to read this guide

Every control has its own page, with its number, the description of the criterion, what it corresponds to, why it matters, how to implement it and how to verify it is in place. The pages are written for PST vendors preparing their file and for facility IT leads receiving these products. Groups are added as they are published; the Performance group is the first.

The Performance group

This group documents the technical capacity, latency, bandwidth and connection-resilience characteristics a product must support.

Certifying a product for Quebec’s health network?

Sentrix helps vendors preparing for TGV certification structure their evidence file control by control and track remediation ahead of the certifier’s visit, from gap analysis to attestation. See the TGV certification support service or contact us.

Frequently asked questions

Is TGV certification mandatory?: Establishments acquiring certain technology products (equipment, software or applications) must ensure they are certified. A standard clause is suggested for inclusion in the request for proposals leading to the product’s acquisition, so a vendor without certification can find itself excluded from a procurement in Quebec’s health and social services network.
How long does a TGV certification last?: The certification contract runs three years but is renewable annually, conditional on the vendor’s compliance with its ongoing commitments: an annual self-declaration, at least one penetration test per year, vulnerability remediation within the set delays, and reporting of major changes made to the certified technology product or service.
What happens if a new version fails a control?: The vendor is notified that its PST does not meet the TGV requirements. It may reapply, at its own expense, after a minimum three-month period, once the expected corrections have been made. That is why it pays to prepare the evidence file control by control and to track remediation ahead of the certifier’s visit.

Let's talk about your compliance program.

Contact us