Context
A large Canadian financial institution needed to strengthen the protection of personal information and payment card data, in line with Law 25 and the PCI-DSS standard.
Case study · Financial institution · 2022–2024
A large Canadian financial institution: Law 25 / PCI-DSS compliance
Engagement delivered by Groupe Conseil GRD from 2022 to 2024. The client remains anonymous.
Engagement scope
- Law 25 / PCI-DSS compliance
- Data loss prevention (DLP) with Microsoft Purview
- Vulnerability management with Tenable
Approach
- Data classification and Microsoft Purview sensitivity labels
- Data loss prevention policies
- Tenable scanning and impact-based vulnerability prioritization
- Documentation supporting compliance requirements