Home / Compliance readiness
Know exactly where you stand against the framework you answer to.
Whether a regulator, a customer contract or an upcoming certification is driving it, we assess your controls, show you the gaps in plain language and help you close them in the right order.
Frameworks we assess against
Many organizations answer to more than one. We map overlapping controls once, so you aren't doing the same work twice.
| Framework | What it is | Who usually needs it |
|---|---|---|
| PHIPA | Ontario's Personal Health Information Protection Act, which sets rules for collecting, using and safeguarding personal health information. | Ontario clinics, hospitals and anyone acting as their agent or service provider |
| PIPEDA | Canada's federal private-sector privacy law, including mandatory reporting and record-keeping of breaches of security safeguards. | Most private-sector organizations handling personal information |
| NIST CSF 2.0 | A widely used framework organized around six functions: govern, identify, protect, detect, respond and recover. | Organizations building or measuring a security program |
| CIS Controls v8 | A prioritized set of practical safeguards, grouped into implementation levels by organization size and risk. | Small and mid-sized organizations that want a concrete starting point |
| ISO/IEC 27001 | The international standard for an information security management system, certified by an accredited auditor. | Organizations whose customers or partners require certification |
| SOC 2 | An independent attestation report on security, availability and confidentiality controls. | Service and software providers selling to larger enterprises |
| CyberSecure Canada | The federal certification program for small and medium-sized organizations, based on a national baseline of security controls. | Canadian SMBs proving security to customers and government buyers |
Novagrid prepares organizations for audits and certification. Certifications themselves are issued by independent, accredited bodies.
What you receive
A readiness assessment takes two to four weeks for most organizations, and ends with a working session with your leadership.
Gap report
Each control scored as met, partly met or not met, with the evidence we found and what's missing.
Risk register
Your top risks ranked by likelihood and impact, written so non-technical leaders can make decisions.
Remediation roadmap
A sequenced plan with effort, cost range and owner for each fix, broken into 30, 90 and 180-day horizons.
Policy pack
Security and privacy policies tailored to how you actually work, ready for approval.
Evidence plan
What your auditor will ask for, where it lives and who produces it.
Leadership briefing
A short presentation for your board, owners or executive team on findings and decisions needed.
How the assessment runs
Light on your staff's time: most clients spend about six to ten hours in interviews and evidence requests.
Scope
We confirm which framework applies, which systems and sites are in scope, and who we need to talk to.
Collect
Interviews, a document review and technical checks of your devices, cloud tenant and network.
Score
Each control is scored against the evidence, and every gap is linked to a risk.
Brief
We walk your leadership through the findings and agree on the roadmap.
Preparing for an audit, a contract or a certification?
Tell us the deadline and the framework. We will tell you whether it's realistic and what it takes.