Seven practices. One accountable programme.
Security, financial-crime, AI governance, privacy and resilience — designed together, not in silos.
Cybersecurity
- SOC 2 readiness and audit preparation
- ISO/IEC 27001 implementation and internal audit
- PCI DSS v4.0.1 readiness and SAQ guidance
- Threat & risk assessments (NIST SP 800-30, ISO 27005)
- Penetration testing & vulnerability management
- Incident response planning, tabletops & retainers
- SOC design & SIEM implementation (Microsoft Sentinel)
- Identity, access & Microsoft 365 / cloud security hardening
- Security awareness & phishing simulation programmes
- Security questionnaires & vendor security assessments
- Cyber insurance readiness
- Security policy development & customization
- Virtual CISO services
- Security project management & remediation programme delivery
AML Compliance
- AML programme design & implementation
- KYC and customer due diligence
- KYC/AML screening
- Transaction monitoring programme design
- Suspicious activity / transaction reporting (SAR / STR)
- AML audits and effectiveness reviews (FINTRAC (Canada), FinCEN/BSA (US), Central Banks)
- Staff AML training programmes
- Mortgage, financing & leasing sector programmes (FINTRAC's newest sectors)
AI Governance & Risk Management
- AI management system (AIMS) implementation — ISO/IEC 42001
- AI risk management — NIST AI RMF and ISO/IEC 23894
- AI system impact assessments — ISO/IEC 42005, EU AI Act, Canada’s Algorithmic Impact Assessment
- GenAI & LLM security assessments — OWASP LLM Top 10, MITRE ATLAS
- Bias, fairness and human oversight frameworks
- AI third-party risk, model evaluation and go-live oversight
Privacy & Data Protection
- Privacy programme design & implementation — Quebec Law 25, PIPEDA, GDPR
- Privacy impact assessments (PIA / DPIA) — Law 25 s.3.3 and GDPR Article 35
- Privacy Officer as a Service — a named privacy officer for your organisation
- Breach readiness, response support and regulator notification
- Privacy gap assessments with remediation roadmaps
- Staff privacy training & awareness
Operational Resilience & Third-Party Risk
- Third-party risk management (TPRM) programme design & implementation
- Vendor due diligence and annual vendor reviews
- Operational resilience gap assessments — OSFI B-10 / E-21 and EU DORA
- Business impact analysis, continuity & disaster recovery planning
- Resilience testing & tabletop exercises
- Critical operations mapping & tolerance setting
Project Management
- Project planning & delivery — end-to-end delivery of technology and business projects
- Programme management — coordinating multi-project programmes to one outcome
- PMO setup & improvement — standards, governance, reporting and tooling
- Fractional project manager — a dedicated PM for as long as you need one
- Project recovery & rescue — getting troubled projects back on track
- Project governance, reporting & assurance — steering, status and health checks
Business Analysis
- Requirements elicitation & documentation — BRDs, FRDs, user stories
- Business process analysis & improvement — finding the waste and the fix
- Process mapping & workflow design — BPMN maps your team can actually follow
- Gap analysis & solution assessment — current state vs target, build vs buy
- Stakeholder analysis & engagement — who matters, what they need, how to reach them
- UAT planning & support — test planning, execution support and sign-off
Consulting services, delivered by the network.
Fixed-scope packages delivered by Zee consultants — every engagement runs on the same frameworks, templates and workbooks as our toolkit store. Fees are scoped per engagement: request a package and we will confirm the scope and price with you.
AML compliance
Policies and procedures, business risk assessment, compliance officer guidance, record-keeping setup
Independent review of policies, risk assessment, training, record-keeping and reporting; written findings report
Screening of investors, partners, customers, suppliers, directors, beneficial owners and other counterparties against sanctions, PEP and adverse-media lists — with clear, documented results your compliance file and auditors can rely on.
Quick review against requirements with a prioritized fix list
Live or recorded session, materials, attendance records
Mock exam, document readiness, interview coaching
BSA/FinCEN independent testing of the AML program: policies, SAR/CTR reporting, training and records; written findings report
Program setup or effectiveness review for FINTRAC's newest sectors — mortgage brokers/lenders/administrators and financing & leasing entities; includes source-of-funds procedures
Cybersecurity
NIST SP 800-30 / ISO 27005 assessment mapped to ISO 27001, SP 800-53 and CIS v8; Canada HTRA/ITSG-33 and US RMF/CMMC alignment; report included
External/internal pen test, findings report with severity ratings, remediation guidance, one retest
Gap assessment and remediation roadmap
Scoping (CDE), SAQ selection, gap assessment against PCI DSS v4.0.1 and a prioritized remediation roadmap
Complete a customer's vendor security questionnaire and flag gaps
Check against common insurer requirements (MFA, backups, IR plan) with a fix list
Tailor core security policies to the business (we tailor the pack for the client)
Ongoing advice, policy upkeep, quarterly risk review, questionnaire support
Written plan plus a 2-hour simulated incident exercise with the team
Named on-call IR expert, response-time commitment, quarterly readiness check-in
Scanner deployment guidance, scan cadence, patch SLAs, remediation workflow + dashboard
SOC maturity assessment, target operating model, use-case and runbook library starter set
Sentinel workspace design, log-source onboarding, analytics rules + alert tuning, handover training
MFA/SSO rollout, conditional access policies, privileged-access setup, access-review process
Azure/M365 assessment vs CIS benchmarks, hardening implementation, before/after posture report
Phishing simulation campaigns, staff training sessions, awareness metrics reporting
Project-managed rollout of a chosen security tool: plan, pilot, deployment, adoption reporting
A security PM embedded part-time: planning, vendor coordination, board-ready status reporting
Zee manages the client's audit/assessment findings to closure: owners, deadlines, evidence, exec reporting
AI governance & risk
Policy tailored to how staff use AI tools, plus a one-page staff summary
Due-diligence review of one AI tool: data use, security, contracts
Catalogue AI use across the business, assess risks, recommendations
Roles, approval workflow, policies, mapped to NIST AI RMF / ISO 42001
Structured impact assessment per ISO/IEC 42005 with EU AI Act risk-tier screening and Canada TBS AIA alignment; board-ready report
Privacy & data protection
Privacy officer designation & charter, privacy policy & notices, records of processing, retention schedule, rights-request process; Law 25 / PIPEDA / GDPR aligned
Law 25, PIPEDA & GDPR requirements review, interviews & evidence sampling, gap report with severity ratings, remediation roadmap
Data-flow mapping, necessity & proportionality analysis, risk register & mitigations, sign-off pack; Law 25 s.3.3 / GDPR Art. 35
Named privacy officer, request & regulator handling, breach triage, quarterly compliance reviews, staff advice line
Breach response plan, notification decision trees (CAI / OPC / EU timelines), breach register, tabletop exercise, notification templates
Role-based privacy training (Law 25 & PIPEDA essentials), materials, attendance records, completion certificates
Operational resilience & third-party risk
TPRM policy & framework, vendor tiering model, due-diligence questionnaires, contract clauses, onboarding workflow; OSFI B-10 aligned
OSFI B-10 / E-21 & EU DORA requirements review, critical operations mapping, tolerance setting, gap report, remediation roadmap
Structured due-diligence questionnaire review, evidence validation, risk scoring, findings report with conditions & monitoring plan
Business impact analysis, business continuity plan, disaster recovery plan, crisis communications plan, roles & escalation trees
Scheduled vendor reassessments, certificate & insurance tracking, risk & performance reviews, exit-plan maintenance, quarterly reporting
Scenario design (outage, vendor failure, cyber incident), facilitated exercise, observer scoring, lessons-learned report & action plan
Project management
Scope, schedule, budget and resourcing for technology and business projects, delivered end to end
Coordination of related projects under one programme plan, with shared governance and benefits tracking
Project management office design: standards, templates, governance cadence, reporting and tooling
A dedicated project manager for your initiative, part-time or interim, without a full-time hire
Diagnostic review of a troubled project, recovery plan, and hands-on delivery to get it back on track
Steering-committee packs, status reporting, stage-gate reviews and independent health checks
Business analysis
Stakeholder interviews and workshops producing BRDs, FRDs and user stories your builders can work from
Current-state analysis, pain-point identification and a prioritised improvement roadmap
BPMN process maps, workflow redesign and handoff documentation
Current-state vs target-state gaps, options analysis (build, buy, outsource) and recommendation
Stakeholder mapping, engagement plans and communications for change initiatives
Test planning, test-case design, defect triage and acceptance sign-off support
Flexible options
Quick questions with a vetted consultant; low-risk first purchase
Consultant reviews what the client filled in from the DIY toolkit (add-on to toolkit price) — the bridge from a toolkit sale to a full engagement
Don't see your exact need? Talk to us — most engagements begin as a variation of a package above.
Toolkits that do the heavy lifting.
The same material we use on client engagements, packaged for your team. Word + Excel, instant download, licensed for use inside your organisation.
AI Governance & Risk Assessment Toolkit
ISO 42001, NIST AI RMF, MITRE ATLAS, OWASP and the EU AI Act — governance, risk, impact assessment and a 42-case technical test library.
Cybersecurity Threat & Risk Assessment Toolkit
NIST SP 800-30 + ISO 27005 methodology with a self-scoring 5×5 risk register and a cross-framework control map.
Incident Response & Security Operations Toolkit
Incident response plan, seven playbooks, a tabletop exercise kit and a CVSS-driven vulnerability management tracker.
PCI DSS v4.0.1 Readiness Pack
All 302 requirements as a working assessment workbook, plus SAQ selection, scoping and the procedures auditors ask for.
ISO 27001 + SOC 2 Policy Pack
15 audit-ready policies mapped to both frameworks, with an implementation guide and crosswalk workbook.
Privacy & Data Protection Toolkit
A complete Law 25, PIPEDA & GDPR programme — policies, notices, PIA template, records register, compliance checklist and breach plan.
Vendor Security Assessment Pack
A 50-question, NIST-mapped vendor questionnaire with automatic weighted scoring and risk tiers.
Operational Resilience & Third-Party Risk Toolkit
TPRM policy, a 46-question vendor due-diligence workbook, BIA, continuity and disaster recovery plans — OSFI B-10/E-21 and DORA aligned.
Security Project Delivery Toolkit
Charters, project plans, RAID log and reporting packs for running security and compliance projects to a clean close.
Canadian MSB AML Starter Kit
A complete FINTRAC / PCMLTFA compliance programme for money services businesses — manual, procedures, forms and registers.
US MSB AML Starter Kit
The FinCEN / BSA counterpart — AML programme manual, SAR and CTR procedures, OFAC screening and independent review.
Canadian Mortgage, Financing & Leasing AML Kit
FINTRAC compliance for the new sectors — mortgage brokers and lenders, financing and leasing entities — including source-of-funds verification.
Project Management Toolkit
Charters, plans, stakeholder registers, status reports, RAID logs, change control, business cases and closure documents for running any project from approval to closure.
Business Analysis Toolkit
BRDs, functional requirements and user stories, process maps, gap analysis, traceability and UAT templates that turn vague requests into signed requirements.
Where we work.
Based in North America and Africa, working to the rules of each market we serve.
Home baseCanada
FINTRAC and PCMLTFA programmes for MSBs, mortgage, financing and leasing sectors; SOC 2 and ISO 27001 readiness for Canadian technology and financial services firms; privacy programmes under Quebec Law 25 and PIPEDA; operational resilience and third-party risk; AI governance and algorithmic impact assessments.
North AmericaUnited States
FinCEN / Bank Secrecy Act AML programmes for money services businesses, SOC 2 and PCI DSS readiness, vendor risk and operational resilience programmes, state privacy law readiness, and AI governance built on the NIST AI RMF.
EMEAEurope
ISO/IEC 27001 and ISO/IEC 42001 (AI governance) programmes, EU AI Act readiness, GDPR privacy programmes, DORA operational resilience, and AML frameworks aligned to the EU anti-money-laundering directives.
Emerging marketsAfrica
AML programmes aligned to central bank supervision and FATF-style regional frameworks (GIABA, ESAAMLG); cybersecurity and data protection under laws such as South Africa's POPIA, Kenya's Data Protection Act and Nigeria's Data Protection Act; and AI governance for fast-growing technology and financial services markets.
A straight line to audit-ready.
Four steps, in order, with evidence at every one.
Assess
We map your current state against the framework or regulation that applies — no assumptions, evidence first.
Build
Policies, procedures, registers and controls built around your actual systems and team, not boilerplate.
Prove
Evidence organised the way auditors and regulators ask for it, with gaps closed before they are found for you.
Maintain
Review cycles, monitoring and training that keep the programme alive after the audit is over.
Let’s discuss your compliance priorities.
Tell us which framework, regulator or customer requirement is in front of you — we’ll reply with the shortest honest path to meeting it.