TGV Certification Controls Explained: Complete Guide

TGV controls explained: the requirements behind Quebec health-sector certification

The TGV (Trousse globale de vérification) is how the Bureau de certification et d’homologation verifies that a technology product or service meets Quebec’s health and social services requirements for security, privacy, performance, and technology. This guide covers every control in the grid - organized by group - in plain language, with what the certifier actually checks.

Frameworks · Published Aug 6, 2026

What the TGV certifies

The TGV is a point-in-time attestation, renewed annually, that a given version of a product or service technologique (PST) conforms to the sociosanitary sector’s requirements across four dimensions: security (~200 criteria), protection of personal information (~100 criteria), performance, and technology - plus a mandatory penetration test. Certification is issued by the Bureau de certification et d’homologation (BCH) with an independent auditing partner.

The complete control map

Every control below links directly to its own page, with the control number, its category, what it corresponds to, why it matters, how to implement it, and how to verify it. Groups are added as they are published - start with the group most relevant to your product today.

Performance

Documenting the technical capacity, latency, bandwidth, and connection-resilience characteristics a product must support.

PF01 · Minimum technical specifications and capacity

PF02 · Latency tolerance

PF03 · Minimum bandwidth

PF04 · Traffic share induced on a service point link

PF05 · Expected response times

PF06 · Packet handling and loss tolerance

PF07 · Connection retention and recovery delays

Frequently asked questions

Is TGV certification mandatory?

Establishments acquiring certain technology products (equipment, software, or applications) must ensure they are certified - a standard clause is suggested for inclusion in the request for proposals leading to the product’s acquisition.

How long does a TGV certification last?

The certification contract runs three years but is renewable annually, conditional on the vendor’s compliance with its ongoing commitments (annual self-declaration, at least one penetration test per year, vulnerability remediation within set delays, and reporting major changes).

What happens if a new version fails a control?

The vendor is notified that its PST does not meet the TGV requirements and may reapply, at its own expense, after a minimum three-month period once the expected corrections have been made.

Sentrix helps vendors preparing for TGV certification structure their evidence file control by control and track remediation ahead of the auditor visit. See the full TGV framework page for how the platform automates evidence collection.