top of page

CLIENT PRACTICUM

Client Practicum · SaaS / Professional Networking · Privacy · GRC · 2026

​

​

Professional Networking Platform -

GRC & Compliance Review

Context:

A professional networking and community-events platform preparing for growth needed a clear read on its privacy and security posture. The work was carried out as a supervised practicum engagement, scoped and authorized under a defined rules-of-engagement document.

Objective:

Establish a defensible baseline across three areas: privacy compliance under Canadian law, a foundation of security policy the platform could operate against, and a compliance scoping position for payment handling.

Scope:

The engagement was bound to GRC work - privacy assessment, policy development, and compliance scoping. Authorization was verified before any work began, and specified systems and payment flows were explicitly excluded. Scope boundaries were respected throughout rather than expanded on ambiguous signals.

Approach:

Work was sequenced deliberately: a privacy gap assessment first, then controls readiness, then a maturity benchmark. Each area was mapped against an established framework rather than assessed ad hoc, so conclusions traced back to a named standard.

Framework mapping: PIPEDA, SOC 2, NIST CSF, and OWASP applied to the privacy and security review

Deliverables:

Deliverables: Privacy Gap Assessment, Security Policy Suite, Payment Compliance Scoping, and BC/DR Plan

Outcomes:

Outcomes: baseline delivered, deliverables accepted, next stage defined

Evidence:

  • Privacy Gap Assessment (PIPEDA) - v1.0

  • Security Policy Suite - v1.0

  • PCI DSS Scoping Statement - provisional (pending acquirer confirmation)

  • Business Continuity & Disaster Recovery Plan - v1.0

  • Framework Mapping Matrix - v1.0

Full artifacts available on request under appropriate confidentiality

Lessons:

An independent review of the policy deliverables caught real corrections before they were finalized. Rather than treat that as a setback, I built the review into the process as a quality-control step; a reminder that GRC deliverables benefit from a second set of eyes. 

Next Stage:

Complete recovery-test validation, confirm payment scope, and continue the compliance program from PIPEDA gap assessment through SOC 2 readiness.

Related Content: 
See the companion case study: Digital Health Regulatory Compliance Program

Building out a privacy or compliance program? Let's talk.

Download the full write-up (PDF)

bottom of page