TGV Technology group: the 26 criteria explained

What the group covers

The Technology group of the Trousse globale de vérification (TGV) checks the technical choices behind a technology product or service (PST): architecture, hosting, integration with Santé Québec identity directories, access mode, operations, backup and recovery. It has 26 criteria, numbered T01 to T26, in a single category, Technology, out of the grid's 382 criteria in 7 groups. Some criteria only target PSTs connected to shared information assets (actifs informationnels d'intérêt commun), web applications or client-server PSTs; others scale the requirement to the solution's classification. The official grid exists only in French: the criteria and instructions quoted here are our translations of the version of April 24, 2026. The theme groupings, advice and suggested evidence are Sentrix's interpretation.

The categories one by one

The grid does not subdivide the group. To make it easier to read, we group its 26 criteria by theme: these themes are a Sentrix reading aid, not official categories.

Architecture and classification (T04, T18)

T04 asks the vendor to describe the technology architecture that supports installing and using the PST; the instruction links to the Quebec government's cloud broker page. T18 requires the detailed architecture to match the solution's classification: “If availability is moderate, make sure the technology architecture is redundant, in order to meet an RTO of 4 h.”

Cloud hosting (T10, T16, T17, T24)

T10 asks the vendor to show that the PST can run properly on virtualized, cloud infrastructure, preferably as SaaS; T16 asks to favour SaaS and T24 makes cloud hosting the priority. T17 sets the location: Santé Québec spaces or a cloud space approved by the MCN (ministère de la Cybersécurité et du Numérique). The instructions refer to directive MSSS-DIR06 (T10, T16) and to AEG 4.0 (T24). The cloud computing orientation published with the certification documents adds a temporary process: prior TGV certification and a favourable security opinion from the MSSS.

Identity and access (T02, T03, T12, T20)

Under T20, practitioner accounts must come from Santé Québec's central directory: “Do not create access accounts in the solution; use our practitioners' single account instead.” When the PST connects to shared information assets, T02 targets Santé Québec's Entra ID, under a directive GIA SanteQc-DIR-012 that is “not yet published”, and T03 the identity federation service (SFID) for users without an account in Santé Québec directories, such as external health partners. The T03 instruction states that SFID will be replaced by Entra ID once it is operational and available. In the same case, T12 asks the vendor to show the PST uses the Active Directory or LDAP of a local, regional or provincial facility inside the RITM, through a structuring document or a screenshot. The MFA orientation also names the provincial Azure AD and SFID as the official identity sources to favour.

Web application and accessibility (T01, T08, T13, T14)

T01 asks the vendor to meet the web accessibility standards of Quebec's Conseil du Trésor, listing the WCAG 2.2 (W3C) requirements met and the level reached (AA or AAA); the instruction also links to Act E-20.1. For a web application, T08 asks for use in a browser, over HTTPS, with centralized updates, and T13 for remote access through a web interface, referring to the website accessibility standard (SGQRI 008 3.0). T14 adds that in web mode, the application must not require installing any component.

Client-server and workstation (T09, T15)

A client-server PST must be deployable through a Citrix, Terminal Service or Remote Desktop Protocol presentation server (T09). T15 asks that the PST be able to call the cryptographic library of the Windows workstation, or of the Citrix or TS session, for signing, hashing and encryption. Neither criterion has an instruction: the vendor chooses how to demonstrate it.

Data, performance and monitoring (T05, T06, T07, T22)

T06 asks for a scalable, high performing and highly available database, with evidence: the definition and results of load tests (e.g. transactions per second) and high availability mechanisms such as replication and redundancy. T05 covers exception and alert handling: performance and capacity thresholds, key alerts (e.g. response time above a threshold), escalation and reporting. T22 asks for monitoring aligned with the classification, the business needs and the hosting site's standards, with logging properly configured for this monitoring (the instruction mentions the SIEM). T07 requires the PST to logically or physically segregate clinical-administrative and clinical data; the instruction notes that with Santé Québec, the 30 facilities become 1 facility, and refers to Bill 15.

Environments, updates and APIs (T11, T19, T23, T25)

T11 asks for an operating system, a database management system and components that are recent and supported by their manufacturer; T19 requires the PST to always be up to date. Their instructions refer to “15 minimum measures” (T11) and to “15 measures and 12 minimum requirements” (T19). T25 requires separate, isolated environments (Development, Testing, Pre-production, Production), in cloud spaces dedicated to Santé Québec. T23 asks the vendor to use APIs from the government catalogue or APIs recognized by the MCN.

Backup and recovery (T21, T26)

T21 asks for backups of the application and data that match the classification, the business needs and the hosting site's standards, following the 3-2-1 rule: 3 copies, on 2 types of media, with 1 off site. T26 asks for a recovery plan, or alignment with the mechanisms of the Secrétariat du Conseil du Trésor, for solutions whose availability ranges from moderate to very high; the instruction links to the Secrétariat's IT recovery guide. The annual follow-up points the same way: the self-declaration asks for a recovery exercise in a separate centre within the last 2 years.

Evidence to prepare

Here are the items we suggest gathering:

• The architecture document (components, flows, hosting, redundancy), tied to the classification and the target RTO (T04, T18).
• A hosting sheet: SaaS, virtualization, approved hosting location (T10, T16, T17, T24).
• The list of WCAG 2.2 requirements met and the level, AA or AAA (T01).
• Depending on the case, proof of HTTPS, centralized updates and no installation (T08, T13, T14), or the Citrix, Terminal Service or RDP deployment procedure (T09), plus use of the Windows cryptographic library (T15).
• The identity integration diagram (Entra ID, SFID, Active Directory or LDAP) with screenshots, and proof that no local accounts are created for practitioners (T02, T03, T12, T20).
• Database load test reports and high availability configuration (T06).
• Documentation of alerts, thresholds, escalation, reporting, logging and SIEM (T05, T22).
• A description of data segregation (T07).
• The inventory of versions and their support status, the update process and the list of APIs used (T11, T19, T23).
• A diagram of the isolated environments dedicated to Santé Québec (T25).
• The 3-2-1 backup policy, the recovery plan and the report of the latest recovery exercise (T21, T26).

Points to watch

• Conditional criteria: T02, T03 and T12 target connection to shared information assets, T08, T13 and T14 web applications, T09 client-server PSTs. When a criterion does not apply, explain why.
• The classification changes the requirement: redundancy for an RTO of 4 h when availability is moderate (T18), a recovery plan for moderate to very high availability (T26), backup and monitoring aligned with it (T21, T22).
• Incomplete references: T02 refers to a directive that is “not yet published”, T11 and T19 cite minimum measures without naming the document, and the legal references column is empty for all 26 criteria. Have the Bureau de certification confirm which reference it expects.
• Identity in transition: SFID is to be replaced by Entra ID, while T12 still speaks of a facility's Active Directory or LDAP. Plan an architecture that can follow this change.
• T25 asks for more than separate environments: the instruction requires cloud spaces dedicated to Santé Québec for each one.

Need help with this group?

Sentrix helps PST vendors prepare the Technology group (reading the criteria, reviewing the architecture, building the evidence), while certification itself rests with Santé Québec's Bureau de certification. To discuss it, book a meeting or see our TGV certification support service.

Next in the guide

For the overview of the certification and the other groups, see the full TGV guide and the TGV framework page.