Reference Library

The standards we work across

Engagements lead with the three practices; these are the instruments they draw on. Kept here as a working reference: filter it, or ask us which of these your situation actually needs, because the answer is usually three, not fifty.

Nothing in the library matches that filter.

Cybersecurity & Information Security14 itemsProves operational control of information security risks

ISO/IEC 27001Information Security ManagementCertifiable
ISO/IEC 42001AI Management SystemCertifiable
ISO/IEC 27701Privacy Information ManagementCertifiable
ISO/IEC 27017Cloud Services SecurityGuidance
ISO/IEC 27018PII Protection in Public CloudGuidance
ISO/IEC 27035Incident ManagementGuidance
ISO/IEC 27005Information Security Risk ManagementGuidance
ISO/IEC 27031ICT Readiness for Business ContinuityGuidance
ISO/IEC 27002Information Security ControlsGuidance
ISO/IEC 27036Supplier Relationship SecurityGuidance
ISO/IEC 27019Energy Utility Information SecurityGuidance
IEC 62443Industrial Automation & Control Systems SecurityCertifiable
FIPS 140-3Cryptographic Module ValidationProgram
Common CriteriaIT Security Evaluation (ISO/IEC 15408)Certifiable

IT Service & Digital Operations3 itemsProves structured IT service delivery and governance

ISO/IEC 20000-1IT Service ManagementCertifiable
ISO/IEC 19770-1IT Asset ManagementGuidance
ISO/IEC 38500Governance of ITGuidance

Business Continuity & Organizational Resilience3 itemsProves ability to maintain operations through disruption

ISO 22301Business Continuity ManagementCertifiable
ISO 22316Organizational ResilienceGuidance
ISO 31000Enterprise Risk ManagementGuidance

Compliance & Integrated Management Systems4 itemsProves systematic compliance across multiple obligations

ISO 37301Compliance ManagementCertifiable
IMS AdvisoryIntegrated Management SystemGuidance
MultistandardHarmonization & CertificationGuidance
ISO/IEC 17020Conformity Assessment: Inspection BodiesCertifiable

Canadian Programs4 itemsProves alignment with federal cybersecurity requirements

CyberSecure CanadaBaseline Cybersecurity CertificationProgram
CPCSCHigher Assurance Federal Cybersecurity CertificationProgram
ITSG-33Federal IT Security Control FrameworkGuidance
PBMMProtected B, Medium Integrity, Medium AvailabilityProgram

Framework Interoperability5 itemsProves alignment across frameworks for reporting to many stakeholders

NIST CSFCybersecurity Framework AlignmentGuidance
NIST AI RMFAI Risk Management Framework MappingGuidance
CIS ControlsCenter for Internet Security Critical ControlsGuidance
COBITIT Governance & Management FrameworkGuidance
SOC 2Service Organization Controls: Trust ServicesAttestation

Privacy & Data Protection6 itemsProves compliance with privacy legislation and data protection requirements

PIPEDAPersonal Information Protection and Electronic Documents ActRegulation
Privacy ActFederal Public Sector Privacy LegislationRegulation
BC PIPABritish Columbia Personal Information Protection ActRegulation
AB PIPAAlberta Personal Information Protection ActRegulation
QC Law 25Quebec Act Respecting the Protection of Personal InformationRegulation
PCI DSSPayment Card Industry Data Security StandardCertifiable

Sector & Supply Chain3 itemsProves compliance with sector and supply chain security requirements

NERC CIPNorth American Electric Reliability Critical Infrastructure ProtectionRegulation
TISAXTrusted Information Security Assessment Exchange (Automotive)Certifiable
SWIFT CSPSWIFT Customer Security ProgrammeProgram

AI Governance & International Regulation

Preparing for AI governance obligations across Canadian and international regulation.

EMERGING

ISO/IEC 42001 AIMS

AI Management System design and implementation readiness for the international standard.

  • AI risk classification frameworks
  • Lifecycle governance controls
  • Responsible AI documentation

ISO/IEC 23894

AI risk management guidance for identifying, assessing, and mitigating risks specific to AI.

  • Algorithmic impact assessments
  • Bias and fairness evaluation
  • Model governance protocols

ISO/IEC 38507

Governance implications of AI for organizational decision making and oversight.

  • AI ethics committees
  • Human oversight mechanisms
  • Stakeholder frameworks

ISO/IEC 22989

AI concepts and terminology foundation for organizational AI literacy.

  • AI taxonomy alignment
  • Terminology standardization
  • AI literacy across teams

ISO/IEC 23053

Framework for AI system lifecycle, from design through deployment and decommissioning.

  • AI pipeline architecture
  • Model training & validation stages
  • Deployment & monitoring controls

AIDA Readiness

Preparation for Canada's Artificial Intelligence and Data Act requirements.

  • High impact system assessment
  • Transparency measures
  • Regulatory compliance planning

CPCSC

Canadian Program for Cyber Security Certification readiness and alignment.

  • Certification pathway planning
  • Control mapping & gap analysis
  • Federal compliance readiness

EU AI Act

European Union regulation establishing requirements tiered by risk for AI systems.

  • Risk classification (unacceptable, high, limited, minimal)
  • Conformity assessment preparation
  • Compliance alignment across borders

OECD AI Principles

International principles for responsible stewardship of trustworthy AI.

  • Transparency & explainability
  • Accountability frameworks
  • Alignment with human centred values

UNESCO AI Ethics

Global recommendation on the ethics of artificial intelligence.

  • Proportionality & do no harm
  • Fairness & fairness in outcomes
  • Data governance & privacy

Not sure which instrument applies?

The finder on the homepage routes your situation to an obligation, a clock, and a first step in under a minute.