Our validation and verification process assesses your organization’s governance practices against the framework for digital sovereignty (CAN/DGSI 100-8, final draft).
The framework’s draft structure supports validation and verification of organizational practices and claims across four key domains of digital sovereignty:
- Data sovereignty: review focusses on how organizations govern the location, access, and classification of data, as well as the extent to which critical information remains under domestic control. Assessment in this area confirms whether data handling practices align with jurisdictional obligations and internal governance policies.
- Operational sovereignty: examines how administrative control, incident response and decision-making are maintained within the organization. Verification assesses whether these operational functions remain under the organization’s direct authority or are dependent on foreign entities and external service providers.
- Technological sovereignty: assesses the degree of independence within an organization’s digital infrastructure and supply chain. The assessment considers control over cybersecurity operations, visibility into technology stack and resilience against external legal or jurisdictional influence that could compromise control.
- Organizational readiness and risk management: review measures the integration of sovereignty principles into governance systems. The assessment focuses on the maturity of risk management, ethical data practices, privacy-by-design implementation and the treatment of sovereignty as part of enterprise governance and compliance.
Organizations that complete validation and verification during the prelaunch phase will receive a complimentary follow-up review once CAN/DGSI 100-8 is formally published. The Sovereign Ready prelaunch will run through 2025. Following the framework’s publication in 2026, the program will transition into a full validation and verification recognition process based on the finalized standard.
Through an impartial, objective review, we evaluate your systems, tools and processes for conformity with defined requirements in CAN/DGSI 100-8.
Successful organizations receive a statement of validation or verification and associated Trustmark.
What options apply to your organization?
| Validation Review | Validation Audit | Verification Review | Verification Audit | |
| Cost | $250 | $750 | $250 | $750 |
| Deliverable | A validation statement confirming plausibility at a point in time that requirements in the Standard have been fulfilled for future use
(e.g. if an organisation has not yet implemented any technology but has completed its planning of a service and is close to deployment) |
A validation statement confirming plausibility at a point in time that requirements in the Standard have been fulfilled for future use
(e.g. if an organisation has not yet implemented any technology but has completed its planning of a service and is close to deployment) |
A verification statement confirming truthfulness at a point in time that the requirements in the Standard have been fulfilled in the past
(e.g. If an organisation has implemented technology and has use cases) |
A verification statement confirming truthfulness at a point in time that the requirements in the Standard have been fulfilled in the past
(e.g. If an organisation has implemented technology and has use cases) |
| Scope of Work | DGC reviews an organisation’s self-assessment | DGC conducts more in-depth questioning and analysis of evidence from the organisation | DGC reviews an organisation’s self-assessment | DGC conducts more in-depth questioning and analysis of evidence from the organisation |
| Level of Assurance | lower level of assurance stating that no significant issues were detected | A positive conclusion about the organisation’s conformity with the Standard | Lower level of assurance stating that no significant issues were detected | A positive conclusion about the organisation’s conformity with the Standard |
| Duration* | Shorter duration | Longer duration | Shorter duration | Longer duration |
*The time required of an organization can vary; on average, organizations allow for a couple of weeks to gather necessary documentation for a review. However, this timeframe can be shorter depending on the organization’s readiness.
