The TGV criteria list dated 24 April 2026 moved the penetration test requirement to criterion S16.03 and reworded it: "Soumettre votre application à un test d'intrusion administré par un prestataire indépendant et reconnu par Santé Québec" ("Submit your application to a penetration test administered by an independent provider recognised by Santé Québec"). Behind that sentence, the Bureau de certification's orientation sets seven scope rules, accepts results "uniquement" (only) from a provider meeting six conditions and requires eight report elements. Its planning document sets the first evidence deposit at J+9 of verification, and the application form asks whether the product has had a recent penetration test, "moins de six mois" (under six months).
This checklist turns those documents into 60 numbered actions in eight phases, each with its source or a good-practice label, plus a one-page summary to print or paste into a ticketing system. Every requirement was re-read on 13 October 2026 from the documents linked on the bureau's Québec.ca pages. The rules themselves are explained in the TGV certification guide and the French guide to the TGV penetration test.
Where Stingrai fits: Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements. Stingrai performed the TGV-scoped penetration test for Bia Education, a Quebec healthtech platform, as part of its certification, and Stingrai Inc is one of four CREST Marketplace entries with a Canadian head office holding the firm-level Penetration Testing accreditation as of 13 October 2026 (how we counted).
Quick answer. To pass criterion S16.03, hire a provider that meets the bureau's six conditions and, because no public list of recognised firms exists, ask the bureau about it at certification@sante.quebec before signing. Scope a white box test of production or an equivalent environment that covers every role. Check that the report carries the orientation's eight elements, fix and retest on the clocks the bureau sets for certified suppliers, and have the report and, where applicable, the action plan ready for the first deposit at J+9 of verification. We recommend starting five to six months before verification and testing three to four months before it, since the application form asks whether the product had a test under six months old. Stingrai runs TGV-scoped tests to these conditions as a one-time annual engagement or within a continuous program, with retesting included.
Who this checklist is for and when to start
S16.03 is the supplier's obligation, so this list is written for whoever owns the evidence at a health software supplier preparing a first certification: usually the engineering, security or compliance lead. Four published figures set the calendar:
Under six months: the age of the test the application form asks about.
1 to 6 weeks: the bureau's preparation stage, depending on the product's maturity and the supplier's organisation.
30 business days: the external verification, numbered J0 to J+29 in the planning document, with the first evidence deposit at J+9.
2 calendar days: the fastest deadline in the government remediation matrix the bureau shares.
Working back, test three to four months before the planned start of verification and begin phase 1 two months earlier. That timing is our recommendation, not a bureau rule; it leaves room to fix and retest inside the six-month window. Testing late is costly: a refused supplier can reapply, at its own cost, only after "une période minimale de trois mois" (a minimum of three months), according to the MSSS guide.
Reading the tables. Each item has an ID to paste into a ticket, an action and its source, with a "good practice" label wherever the step is our advice rather than a bureau requirement. "Orientation" is the bureau's orientation on penetration tests (rules 1 to 7, conditions 1 to 6, report elements 1 to 8), "Form" the application form, "Planning" the verification planning document, and "Agreement", "Attestation" and "Self-declaration" Santé Québec's templates BC-D0002-01, BC-D0001-01 and BC-F0003-01. Criterion numbers come from the list of 24 April 2026.
Phase 1: Before you request quotes
Five to six months before verification, gather what a provider needs to scope and quote the test.
# | Action | Source |
|---|---|---|
1.1 | Fix the version to be evaluated (major.minor.extension), ready for production. | Form, section 3; Applications certifiées page |
1.2 | Pick the environment to test; if not production, document its equivalence (versions, configuration, controls). | Orientation, rule 2; criterion T25; documenting equivalence is good practice |
1.3 | Write the role matrix: every human or system actor, its intended context, web-reachable or not. | Orientation, rule 3 |
1.4 | Inventory personal information and map its flows, including any leaving Quebec. | Form, section 3; Law 25, sections 3.3 and 17 |
1.5 | For AI features, list every model call and its destination; for generative AI, plan the prompt injection report. | Criteria IA40 and IA12 |
1.6 | Produce the security architecture and the technology architecture showing every link to other systems. | Form, section 3; MSSS guide, step I.1.c |
1.7 | Describe every integration with health and social services systems, and check that any other product you interface with is certified or approved by the bureau, as attestation item 8 requires once certified. | Form, section 4 (Arrimage); Attestation, Annex 1, item 8 |
1.8 | Date the test backwards: under six months old when the form is filed, with the report and action plan ready for J+9. | Form, section 3; Planning; the dating is good practice |
For item 1.4, Quebec's private sector privacy act requires a privacy impact assessment "before communicating personal information outside Québec" (section 17); the Law 25 guide covers the statute.
Phase 2: Choosing the provider
About five months out, choose a firm that meets all six of the bureau's conditions and ask the bureau about it before you sign.
The bureau "acceptera les résultats des tests d'intrusion ou tests de pénétration provenant uniquement d'un prestataire de service répondant minimalement aux exigences suivantes" ("will accept penetration test results only from a service provider meeting at minimum the following requirements"). One "no" disqualifies the firm.
# | Check (source) | Evidence | Yes / No |
|---|---|---|---|
2.1 | Legally authorised representatives in Canada, "représentants légalement autorisés au Canada" (condition 1) | Contracting entity, Canadian registration, signatory | |
2.2 | Cybersecurity and privacy specialist, testers with recognised certifications (condition 2) | Names and certifications of your testers | |
2.3 | Criminal background evidence for the testers, "preuves d'antécédents criminels" (condition 3) | How and when background evidence is provided | |
2.4 | Accountable for results, subcontractors or not (condition 4) | Accountability clause, subcontractor list | |
2.5 | Report in French to the bureau "sans frais" (at no cost), with your agreement (condition 5) | A contract clause | |
2.6 | Testing in production or an equivalent environment (condition 6) | A test plan with windows and safeguards | |
2.7 | Independent of the teams that build and host the product (criterion S16.03) | An independence statement | |
2.8 | Bureau asked about this firm before signing, and its answer kept (good practice) | The bureau's reply from certification@sante.quebec | |
2.9 | Statement of work covers the scope rules, the eight-element report and the French report (Orientation, rules 1 to 7, report elements 1 to 8, condition 5), plus the retest and delivery date (good practice) | The signed statement of work |
For item 2.8: none of the bureau's pages or documents lists recognised firms or describes a pre-approval of testing firms (checked 13 October 2026). Sending the evidence from items 2.1 to 2.6 to certification@sante.quebec, asking whether the bureau will accept this firm's results for S16.03 and keeping its answer is our advice, not a formal step. To build a shortlist first, our ranking of penetration testing companies for TGV certification compares what each firm publishes against these conditions.
Phase 3: Scoping the test
About four months out, turn the orientation's seven scope rules into the statement of work, with the role matrix as the test plan.
Rule 3 does most of the work: every role must be "identifiés et testés dans leur contexte d'utilisation prévue, et ce, qu'ils soient accessibles depuis le Web ou non" ("identified and tested in their intended context of use, whether or not they are reachable from the web"), which makes the test an authorisation test, role against role.
# | Action | Source |
|---|---|---|
3.1 | Name recognised standards in the methodology: NVD, OWASP, OSSTMM, NIST. | Orientation, rule 1 |
3.2 | State the environment, versions and configuration tested. | Orientation, rule 2 and condition 6 |
3.3 | Test every role in context and against every other role, web-reachable or not. | Orientation, rule 3; criteria S06.03, S06.04, S06.13 |
3.4 | Specify white box, "acceptée dans tous les cas" (accepted in all cases); grey box is accepted only for certain non-sensitive products with no provincial deployment planned; black box is "non acceptée". Before relying on grey box, ask the bureau. | Orientation, rule 3 a to c; asking the bureau is good practice |
3.5 | Include unapplied updates: frameworks, libraries, operating systems, managed services. | Orientation, rule 4; criteria S09.10, S13.01 |
3.6 | Test the real deployment mode: client-installed, your network, or cloud configuration and identities. | Orientation, rule 5 |
3.7 | Cover the possible entry points "en fonction des criticités du PST" (according to the product's criticality): web platform, mobile apps, infrastructure and networks, and the APIs and integrations behind them. | Orientation, rule 6 |
3.8 | Test multifactor authentication against AU3, the minimum for health information; SMS, voice, fax, email or mail one-time codes are prohibited at AU3. | MFA orientation, 19 December 2025 |
3.9 | For AI: prompt injection tests reported as IA12, role checks on AI features, personal information egress. | Criteria IA12, IA49, IA50, IA40; Orientation, rule 7 |
3.10 | Record exclusions and reasons for the report's context section. | Orientation, report element 1; recording exclusions is good practice |
Grey box is accepted only for "certains PST non sensibles et pour lesquels il n'est pas prévu un déploiement provincial" (certain non-sensitive products with no provincial deployment planned), so plan on white box. The French guide explains each rule; AI products should read the TGV guide for AI health tools.
Phase 4: During the test
Three to four months out, give the testers what white box needs, keep the target stable, and start fixing as findings are confirmed.
# | Action | Source |
|---|---|---|
4.1 | Before day one, provide accounts for every role, administrator access, documentation and, where possible, source code. | Orientation, rule 3; white box is testing with "les mêmes accès qu'un administrateur du système"; documentation and source code are good practice |
4.2 | Freeze the tested version, or log every change, so the report matches the version on the form. | Form, section 3; criterion S09.07; the freeze is good practice |
4.3 | In production, agree test windows, rate limits, test data and a rollback contact. | Good practice, serving condition 6 (testing "en tenant compte des risques ou enjeux d'affaires du client") |
4.4 | Name a daily contact on each side and an escalation path for critical findings. | Good practice |
4.5 | Receive findings in a portal or encrypted channel, never as email attachments. | Good practice |
4.6 | Start fixing critical findings as they are confirmed. | Remediation orientation (2 calendar days at the top of the matrix) |
4.7 | Have the testers log every test, including those that found nothing, and every issue they could not exploit. | Orientation, report elements 3 and 6 |
Phase 5: Reviewing the report
When the draft arrives, check it against the eight elements before the verifier sees it. The report must let the bureau "appuyer ses décisions relatives à l'acceptation ou non du PST" (support its decision on whether to accept the product).
# | Element | Pass if the draft | Pass / Fail |
|---|---|---|---|
5.1 | Context: objectives and scope | States objectives, version, environment, roles, exclusions | |
5.2 | Risk and vulnerability methodology | Names the standards and severity rating | |
5.3 | Each test, "concluants ou non" (conclusive or not), with results | Lists tests that found nothing too | |
5.4 | Detailed documentation of each vulnerability and its risks | Gives location, reproduction, evidence, risk | |
5.5 | Strengths and weaknesses of the controls examined | Describes controls that held | |
5.6 | Potential vulnerabilities not exploited | Lists suspected issues and why unconfirmed | |
5.7 | Recommendations for major or critical vulnerabilities, plus general ones | Gives a fix per major or critical finding | |
5.8 | Management summary, complete and easy to read | Stands on its own | |
5.9 | S16.03 evidence | States the nature of the test and the results, with the action plan where applicable ("le cas échéant") | |
5.10 | Form details | Names the firm and the test date | |
5.11 | French version | Is available in French to the bureau at no cost, with your agreement |
Elements 3 and 6 are the two a scanner export never has, and they show the bureau what was covered. Stingrai's TGV reports are structured around all eight elements; for a general report layout, see our sample penetration testing report.
Phase 6: Remediation and retest
From the first confirmed finding, fix against the tightest applicable clock, retest, and keep the report that confirms the fixes. The bureau's documents name three clocks:
15 days. Self-declaration point 7: vulnerabilities fixed or mitigated "dans les quinze jours suivant le rapport de test" (within fifteen days of the test report). The current attestation (Annex 1, item 4) refers instead to "une échéance convenue avec le BC" (a deadline agreed with the bureau).
Three business days. Attestation item 4: tell the bureau of a critical vulnerability "dès qu'il en a été informé" (as soon as the supplier learns of it) and present a mitigation plan "dans les trois jours ouvrables suivants" (within the following three business days). Point 8 of the self-declaration counts "trois jours suivant l'identification" (three days from identification).
2 to 90 calendar days. The ministère de la Cybersécurité et du Numérique's matrix, shared "à titre indicatif" (for information) and counted "en jours civils et non en jours ouvrables" (in calendar days, not business days).
Asset | Very high impact, very high probability | Very high impact, low probability | Low impact |
|---|---|---|---|
Internet-exposed, fix available | 2 days | 8 days | 60 days |
Internet-exposed, no fix available | 8 days | 45 days | 90 days |
Not internet-exposed | 8 days | 45 days | 90 days |
The first two clocks bind a certified supplier; before certification, S16.03 asks for the action plan and the form asks whether anomalies were corrected and whether any remain. We recommend running the first test on the same clocks.
# | Action | Source |
|---|---|---|
6.1 | Critical vulnerability: mitigation plan within three business days (a certified supplier must also tell the bureau at once; recommended for the first test). | Attestation, Annex 1, item 4 (certified suppliers); Self-declaration, point 8 (three days from identification) |
6.2 | Fix or mitigate within 15 days of the report, or by the deadline agreed with the bureau (certified suppliers; recommended for the first test). Keep the agreed deadline in writing. | Self-declaration, point 7; Attestation, Annex 1, item 4; writing it down is good practice |
6.3 | Check each finding against the government matrix and agree precise deadlines with the bureau; planning to the earlier of the matrix and 15-day dates is our advice. | Remediation orientation ("convenir des échéances précises avec le BC"); the earlier date is good practice |
6.4 | Keep documentary proof of each fix, such as the ticket, change, date and verifier. | MSSS guide, step I.2 (documentary proof); Self-declaration, point 9; the fields are good practice |
6.5 | Retest and obtain the report confirming the fixes or mitigations (certified suppliers; recommended for the first test). | Self-declaration, point 9 |
6.6 | Write the action plan, where applicable, for anything still open, with owners and dates. | Criterion S16.03; Form, section 3; owners and dates are good practice |
Phase 7: Submission and verification
Answer the form's test questions, file the S16.03 evidence by J+9, and keep the tested environment open to the verifier until the decision. The form warns that "aucune pièce jointe contenant des informations sensibles ne doit être envoyée par courriel" (no attachment containing sensitive information should be sent by email); secure access is set up when the application arrives.
# | Action | When | Source |
|---|---|---|---|
7.1 | Answer the form's six test questions: date, firm, scope, anomalies corrected, anomalies remaining, consent to send the report. | Application | Form, section 3 |
7.2 | Send nothing sensitive by email; use the bureau's secure access. | Throughout | Form |
7.3 | File the report, the nature of the test and, where applicable, the action plan with the criteria grid. | J+9 | Criterion S16.03; Planning |
7.4 | Keep the tested environment and its infrastructure available to the verifier. | Until the decision | Agreement, clause 3.1.8 |
7.5 | Answer follow-up requests (with the retest report, for example), then take part in the online audit of half a day to one day. | J+17, J+22 | Planning |
7.6 | Comment on the verification report within two days; the decision, certified or not, follows. | J+25 to J+27, J+29 | Planning |
Annex 2 of the agreement template runs the same stages slightly longer, with the online audit at J+23 and the bureau's answer at J+32; plan on the earlier dates.
Why S16.03 stalls. The documents make these the predictable failure points: a black box test; a firm missing a condition, typically Canadian representation or the French report; roles left out, especially those not reachable from the web; a test environment that is not equivalent to production; a report without element 3 or 6; open findings with no action plan or retest; and a test older than the six months the form asks about.
Phase 8: After certification
Once certified, the test becomes annual and major changes go back to the bureau before production.
# | Action | Source |
|---|---|---|
8.1 | At least one penetration test a year with an independent firm; results and proof of mitigation by the self-declaration. | Attestation, Annex 1, item 3 |
8.2 | Self-declaration at least 15 days before the anniversary, with the report confirming the fixes. | Attestation, item 9; Self-declaration, points 6 to 9 |
8.3 | Major changes to the bureau at least 20 days before production (15 in the attestation); retest when the attack surface changes. | Applications certifiées page, 30 September 2026; Attestation, item 2; good practice |
New versions "ne seront pas considérées de facto comme certifiées" (will not be considered certified de facto), per the bureau's orientations page. The renewal guide covers the annual cycle.
Printable summary
Phase | Do this | Source | Done |
|---|---|---|---|
1. Before quotes | Version, environment, role matrix | Form; Orientation, rules 2 and 3 | |
1. Before quotes | Data flows, architectures, integrations described; other products certified or approved | Form, sections 3 and 4; Attestation, item 8 | |
1. Before quotes | Test under six months old when the form is filed; report and action plan ready for J+9 | Form; Planning | |
2. Provider | Six conditions all "yes" | Orientation | |
2. Provider | Bureau asked before signing, answer kept | Good practice | |
3. Scope | Standards; production or equivalent; every role against every other | Orientation, rules 1 to 3 | |
3. Scope | White box; updates; deployment mode; entry points by criticality | Orientation, rules 3 to 6 | |
3. Scope | MFA at AU3; AI criteria IA12, IA49, IA50, IA40 | MFA orientation; criteria | |
4. Test | Accounts and administrator access on day one; version frozen | Orientation, rule 3; Form | |
5. Report | Eight elements pass | Orientation | |
5. Report | Nature of the test, results, action plan where applicable; French version available | S16.03; condition 5 | |
6. Fix | Critical: plan within three business days (certified suppliers; recommended for the first test) | Attestation, item 4 | |
6. Fix | Others within 15 days or the deadline agreed with the bureau (certified suppliers; recommended for the first test) | Self-declaration, point 7; Attestation, item 4 | |
6. Fix | Retest report confirming the fixes (certified suppliers; recommended for the first test) | Self-declaration, point 9 | |
7. Verification | Evidence at J+9; environment open to the verifier; nothing by email | Planning; Agreement 3.1.8; Form | |
8. After | Annual test; self-declaration 15 days ahead; major changes 20 days ahead | Attestation; Applications certifiées page |
How Stingrai runs a TGV penetration test
Stingrai holds firm-level CREST accreditation as a penetration testing service provider (CREST Marketplace profile) and is headquartered in Toronto, which matters for the bureau's first condition. In its published case study, Bia Education's stated goal for the December 2025 to January 2026 engagement was "penetration testing to certify our app for a cybersecurity requirement"; Stingrai identified six vulnerabilities, shared each on a platform with a way to reproduce it and a channel for retesting, and delivered a report with general recommendations. In the client's words: "We can show that we don't have any known vulnerabilities left and that we've fixed them in a time-efficient fashion."
Stingrai's TGV engagements are scoped to the bureau's conditions: Canadian-based delivery, certified testers, background-checked personnel, testing in production or a production-equivalent environment, full role-matrix coverage, and a report structured around the eight elements the bureau lists, provided in French to the bureau at no cost with the client's agreement. Firm recognition itself is confirmed by the supplier with the bureau before the engagement begins, and Stingrai provides whatever the bureau asks for to support that confirmation.
Two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team, test every role against every other across the web application and its APIs, mobile clients, the cloud environment and AI features as scoped. On one-time and continuous engagements alike, every confirmed finding, of any severity, is posted to the PTaaS platform the same day it is confirmed, with a working proof of concept and remediation guidance, so phase 6 starts inside the test window. Retesting is included, and human-led and hybrid engagements close with an attestation letter, Stingrai's own document and not the bureau's attestation form. Stingrai delivers one-time annual tests timed to the anniversary as well as continuous programs that test every release; in a hybrid engagement, Snipe, its autonomous AI agent for web applications, works alongside the penetration testers on the web application, while mobile, cloud, network and AI-layer testing is done by the penetration testers.
Published pricing: the Autonomous Pentest is US$3,000 per assessment or US$650 per month, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month, both covering one web application and associated APIs. The Autonomous Pentest includes no penetration testers, so a TGV scope is normally quoted as human-led or hybrid. The bureau's fee is separate: C$15,000 excluding applicable taxes in Santé Québec's agreement template, payable within 30 days of invoice.
Frequently Asked Questions
What is on a TGV penetration test checklist?
Eight phases: gathering the version, environments, role matrix, data flows and integrations; choosing a provider that meets the bureau's six conditions and asking the bureau about it; scoping to the orientation's seven rules; running the test; checking the report's eight elements; fixing and retesting against the remediation clocks; filing the evidence by J+9 of verification; and the annual test after certification. This checklist has 60 items, each tied to its source or marked as good practice.
When should a supplier run the TGV penetration test?
We recommend three to four months before the planned start of verification, with preparation starting five to six months out; that timing is our advice, not a bureau rule. The application form asks whether the product had a test under six months old, and the planning document puts the first evidence deposit at J+9 of a 30-business-day verification, so that window leaves time to fix and retest.
How do I confirm a penetration testing firm is recognised by Santé Québec?
There is no public list of recognised firms and no published pre-approval process. The bureau accepts results only from a provider with legally authorised representatives in Canada, certified testing staff, criminal background evidence for testers, accountability for results including subcontractors, the ability to give the bureau the report in French at no cost with the client's agreement, and the ability to test in production or an equivalent environment. We recommend sending that evidence to certification@sante.quebec before signing and keeping the bureau's answer.
Does the TGV penetration test have to be white box?
White box is accepted in all cases and is the safe choice. Grey box is accepted only for certain non-sensitive products with no provincial deployment planned, and black box is not accepted by the bureau. The orientation defines white box as testing with the same access as a system administrator.
What must the TGV penetration test report contain?
Eight elements at minimum: context, methodology, each test performed whether conclusive or not, detailed documentation of each vulnerability, strengths and weaknesses of the controls examined, potential vulnerabilities that could not be exploited, recommendations for major or critical vulnerabilities plus general ones, and a management summary. The S16.03 evidence instruction also asks for the nature of the test and, where applicable, the action plan.
Does the TGV penetration test report have to be in French?
The provider must be able, with the client's agreement, to give the bureau the report in French at no cost. A firm that cannot does not meet the bureau's conditions, so write the French report into the statement of work rather than commissioning a translation later.
How fast must TGV penetration test findings be fixed?
Once certified, the annual self-declaration uses 15 days after the report and the current attestation refers to a deadline agreed with the bureau; a critical vulnerability must be reported at once with a mitigation plan within three business days. Before certification the documents set no fixed deadline: S16.03 asks for the action plan where applicable and the form asks whether anomalies were corrected. The government matrix the bureau shares for information runs from 2 to 90 calendar days, and we recommend working to the certified-supplier clocks from the first test.
How much does a TGV penetration test cost?
It depends on the roles, applications, mobile clients, cloud scope and AI components. Stingrai's published fixed prices cover one web application and associated APIs; a TGV test is scoped as a human-led or hybrid engagement and quoted, because the bureau's conditions concern certified, background-checked testing staff. The bureau's certification fee is separate: C$15,000 excluding applicable taxes in Santé Québec's agreement template, and the bureau's About page says certification costs "ne sont pas remboursables" and "varient en fonction de la complexité du produit ou du service technologique et des objectifs d'interopérabilité poursuivis" (are not refundable and vary with the product's complexity and interoperability objectives).
Related reading
TGV certification in Quebec (2026): the process, the fee and the timeline.
Test d'intrusion pour la certification TGV (2026): the test rules and the verification schedule, in French.
TGV certification for AI health tools (2026): the 69 AI criteria, including IA12 and IA40.
Keeping TGV certification in 2026: the annual test, the self-declaration and product changes.
Top penetration testing companies for TGV certification (2026): providers assessed against the six conditions.
Best healthtech penetration testing companies (2026): firms that test health software for Canadian and US buyers.
Talk to Stingrai
A TGV scope starts with the role matrix, the deployment mode, the integrations, any AI features and the verification date. Stingrai scopes the test to the bureau's six conditions and seven rules, delivers the report on the eight elements with retesting included, and times it so the evidence is ready for J+9. Get a quote for your TGV scope or book a free scoping call.
References
Bureau de certification. Orientation concernant les tests d'intrusion. PDF last modified 10 May 2024. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/orientation-tests-intrusion.pdf.
Ministère de la Santé et des Services sociaux. Critères de vérification de la TGV, version 2026-04-24. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/liste-criteres-TGV_v2026-04-24.xls.
Bureau de certification. Planification des vérifications TGV (24-715-53W). https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/planification-verifications-tgv.pdf.
Bureau de certification. Formulaire pour une demande de certification TGV. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/Formulaire-demande-certification-tgv.xlsm.
Santé Québec. Entente, certification TGV (BC-D0002-01). https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/BC_TGV_ENTENTE_SQ_Fournisseur.pdf.
Bureau de certification de Santé Québec. Attestation, certification TGV (BC-D0001-01). https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/BC_TGV_ATTESTATION.pdf.
Bureau de certification de Santé Québec. Autodéclaration, suivi et évaluation annuelle des engagements (BC-F0003-01). https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/gabarit-formulaire-autodeclaration-annuelle.pdf.
Bureau de certification. Orientation sur le délai de remédiation des vulnérabilités. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/orientation-delai-remediation-vulnerabilites.pdf.
Bureau de certification. Orientation sur l'authentification à facteurs multiples (MFA), 19 December 2025. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/orientation-authentification-facteurs-multiples_mfa.pdf.
Gouvernement du Québec. Orientations, procédures et documents pour la certification des produits et services technologiques (last updated 8 June 2026). https://www.quebec.ca/sante/professionnels/certification-produits-services-technologiques/orientations-procedures-documents-certification.
Gouvernement du Québec. Certification des produits et services technologiques en santé et services sociaux (last updated 5 May 2025). https://www.quebec.ca/sante/professionnels/certification-produits-services-technologiques/a-propos.
Gouvernement du Québec. Applications certifiées (last updated 30 September 2026). https://www.quebec.ca/sante/professionnels/certification-produits-services-technologiques/applications-certifiees.
Ministère de la Santé et des Services sociaux. Certification : Trousse globale de vérification (TGV) (24-715-38W, 2024). https://publications.msss.gouv.qc.ca/msss/document-003757/.
LégisQuébec. Act respecting the protection of personal information in the private sector (P-39.1), sections 3.3 and 17. https://www.legisquebec.gouv.qc.ca/en/document/cs/p-39.1.
CREST. CREST Marketplace, Stingrai Inc supplier profile and Penetration Testing filter by head office, read 13 October 2026. https://marketplace.crest.org/supplier/stingrai-inc/.
