Public sector penetration testing procurement in Quebec
Quebec is the province where the procurement rules and the privacy rules both bite, and where a firm that cannot deliver in French is out before the technical evaluation starts.
A Quebec public body buying a penetration test posts it on SEAO, the provincial electronic tendering system, once the value reaches the threshold set under the Act respecting contracting by public bodies. Below that it may solicit directly or use an existing arrangement. Three things then decide who can realistically win: whether you can work and report in French, whether you hold any contracting authorisation the value of the contract triggers, and whether the personal information in scope can lawfully be handled the way you intend to handle it.
SEAO Where every tendered Quebec requirement is posted
French Working language for deliverables, in practice
$6,000 to $40,000 The test itself, CAD, unchanged by the province
The three rule sets in play
- Contracting
- The Act respecting contracting by public bodies and its regulations set when a public call for tenders is required, how bids are evaluated, and what a supplier must hold. Thresholds follow the applicable trade agreements and are revised periodically, so read the value stated in the notice rather than a remembered figure.
- Oversight
- The Autorité des marchés publics oversees public contracting in Quebec and administers the authorisation a firm must hold to contract with public bodies above certain values. Where the requirement applies, it takes months to obtain, and a bid submitted without it fails on a mandatory condition.
- Language
- The Charter of the French Language governs the language of contracts and documents with the civil administration, and the obligations were tightened in recent years. Assume the contract, the correspondence, the readout meeting and the report itself are in French unless the notice says otherwise.
The French requirement is the real filter
This is the practical difference between Quebec and the rest of the country, and firms outside the province under-appreciate it. A penetration test report is a technical document written under time pressure. Producing a professional one in French requires a tester who works in French, not a translation pass at the end. Buyers can tell the difference immediately, because translated findings read like translated findings.
For a buyer, your realistic shortlist is smaller than the national market suggests. Say so in the internal business case before anyone budgets on five comparable quotes. For a firm outside Quebec, the options are to partner with a Quebec firm, hire francophone testers, or leave the sector alone. Bidding with a promise to translate is the option that loses on evaluation.
Law 25 and personal information leaving Quebec
Quebec is the only province where moving personal information outside the province triggers a specific assessment obligation before it happens. Under the Quebec privacy regime, an organisation must conduct a privacy impact assessment before communicating personal information outside Quebec and must satisfy itself that the information will receive adequate protection, taking the legal framework of the destination into account.
For a penetration test that is not a theoretical point. It reaches your tooling, your cloud-hosted collaboration platform, your ticketing system and any subcontractor. A Quebec public body will ask where the working evidence sits, and the honest answer for many firms is a United States hosted service that has never been assessed. Sort that out before you bid, because the assessment belongs to the party communicating the information and it cannot be produced in the week the contract is awarded.
This is also the reason to mask early
The cleanest way through the assessment is to reduce what leaves. Test against masked or synthetic records where the application behaves the same way, keep evidence screenshots free of real personal information, and state both in the statement of work. The general handling rules are on Law 25, and what belongs in the shareable document rather than the report is on report versus letter.
Who is buying, and what they ask for
| Buyer | What usually drives the test | What to expect in the documents |
|---|---|---|
| Ministries and provincial organisations | Government security direction and internal audit | French deliverables, named methodology, retest included |
| Health and social services institutions | Clinical system changes and privacy obligations | Strict handling terms, masked data, residency by contract |
| Municipalities | Insurance renewals and ransomware exposure | Smaller values, invitational processes, faster awards |
| School boards and CEGEPs | Student information systems and remote access | Modest budgets, internal network scope, term contracts |
| Crown corporations | Board level risk reporting | Larger scopes, authorisation to contract more likely to apply |
Bidding into it without wasting a month
- Search SEAO by category rather than by keyword. Testing is bought under professional and information technology services headings and rarely says penetration test in the title.
- Check the mandatory conditions first: language, authorisation to contract, insurance limits, and whether personnel need to be located in Canada.
- Decide whether the assessment obligation for information leaving Quebec is satisfiable with your current tooling. If it is not, the bid is a loss you discover late.
- Price the French deliverable honestly. A report and a readout in French is real effort, and it is better recovered in the price than in the timeline.
- Ask about the retest obligation and how long after the report it runs. The terms are set out on retest and remediation verification.
Scope a Quebec public sector test
Tell us the systems, the language requirement and the deadline, and the scope goes to Canadian firms that deliver in French.
Get matchedCommon questions
Does the penetration test report have to be in French?
Assume yes for a Quebec public body unless the solicitation says otherwise. The Charter of the French Language governs documents exchanged with the civil administration and the obligations have been tightened. Even where an English report is technically acceptable, a French one is what the people reading it want, and evaluation panels notice.
Do we need an authorisation from the Autorité des marchés publics?
Only above the values where the requirement applies, and the threshold depends on the contract type. Check it against the specific notice before bidding, because obtaining the authorisation takes months and it is a mandatory condition, not something that can be cured after submission.
Can a testing firm outside Quebec win this work?
Yes. Trade agreements make an outright geographic preference difficult, and nothing in the rules requires a Quebec address. The practical barriers are language and the assessment required before personal information is communicated outside Quebec, and both of them are solvable with planning rather than with a local office.
Is the pricing different in Quebec?
The testing itself is not. Day rates are national, and a Montreal or Quebec City engagement prices the same as one anywhere else, which is set out on penetration testing cost in Canada. What does add cost is French reporting and the extra contract work around personal information, and both are worth pricing openly rather than absorbing.