Zee Consulting helps organisations across Canada, the United States, Europe and Africa build cybersecurity, AI governance, anti-money-laundering, privacy, resilience, project management and business analysis programmes that stand up to auditors, regulators and enterprise customers — and gives you the ready-made toolkits to do it yourself.
Do it yourself with our toolkits, do it with our consultants beside you — or join the professional network behind both.
Audit-ready compliance template packs across our practices — AI governance, cybersecurity, incident response & security operations, PCI DSS, ISO 27001 + SOC 2 policies, vendor security, privacy & data protection, resilience & third-party risk, security project delivery, project management and business analysis toolkits, and full AML starter kits for Canada and the US. Instant download, ready to tailor to your organisation.
Shop the ToolkitsWork directly with our consultants — cybersecurity, AI governance, AML compliance, privacy & data protection, operational resilience, project management and business analysis programmes assessed, built and proven audit-ready alongside your team, wherever you are in Canada, the US, Europe or Africa.
Explore Our ServicesOur professional community of cybersecurity, AML, AI governance, privacy, resilience, project management and business analysis consultants — shared intelligence on regulatory change, peer review, and collaboration on client engagements across four regions.
Join the NetworkSecurity, financial-crime, AI governance, privacy and resilience — designed together, not in silos.
Fixed-scope packages delivered by Zee consultants — every engagement runs on the same frameworks, templates and workbooks as our toolkit store. Fees are scoped per engagement: request a package and we will confirm the scope and price with you.
Policies and procedures, business risk assessment, compliance officer guidance, record-keeping setup
Independent review of policies, risk assessment, training, record-keeping and reporting; written findings report
Screening of investors, partners, customers, suppliers, directors, beneficial owners and other counterparties against sanctions, PEP and adverse-media lists — with clear, documented results your compliance file and auditors can rely on.
Quick review against requirements with a prioritized fix list
Live or recorded session, materials, attendance records
Mock exam, document readiness, interview coaching
BSA/FinCEN independent testing of the AML program: policies, SAR/CTR reporting, training and records; written findings report
Program setup or effectiveness review for FINTRAC's newest sectors — mortgage brokers/lenders/administrators and financing & leasing entities; includes source-of-funds procedures
NIST SP 800-30 / ISO 27005 assessment mapped to ISO 27001, SP 800-53 and CIS v8; Canada HTRA/ITSG-33 and US RMF/CMMC alignment; report included
External/internal pen test, findings report with severity ratings, remediation guidance, one retest
Gap assessment and remediation roadmap
Scoping (CDE), SAQ selection, gap assessment against PCI DSS v4.0.1 and a prioritized remediation roadmap
Complete a customer's vendor security questionnaire and flag gaps
Check against common insurer requirements (MFA, backups, IR plan) with a fix list
Tailor core security policies to the business (we tailor the pack for the client)
Ongoing advice, policy upkeep, quarterly risk review, questionnaire support
Written plan plus a 2-hour simulated incident exercise with the team
Named on-call IR expert, response-time commitment, quarterly readiness check-in
Scanner deployment guidance, scan cadence, patch SLAs, remediation workflow + dashboard
SOC maturity assessment, target operating model, use-case and runbook library starter set
Sentinel workspace design, log-source onboarding, analytics rules + alert tuning, handover training
MFA/SSO rollout, conditional access policies, privileged-access setup, access-review process
Azure/M365 assessment vs CIS benchmarks, hardening implementation, before/after posture report
Phishing simulation campaigns, staff training sessions, awareness metrics reporting
Project-managed rollout of a chosen security tool: plan, pilot, deployment, adoption reporting
A security PM embedded part-time: planning, vendor coordination, board-ready status reporting
Zee manages the client's audit/assessment findings to closure: owners, deadlines, evidence, exec reporting
Policy tailored to how staff use AI tools, plus a one-page staff summary
Due-diligence review of one AI tool: data use, security, contracts
Catalogue AI use across the business, assess risks, recommendations
Roles, approval workflow, policies, mapped to NIST AI RMF / ISO 42001
Structured impact assessment per ISO/IEC 42005 with EU AI Act risk-tier screening and Canada TBS AIA alignment; board-ready report
Privacy officer designation & charter, privacy policy & notices, records of processing, retention schedule, rights-request process; Law 25 / PIPEDA / GDPR aligned
Law 25, PIPEDA & GDPR requirements review, interviews & evidence sampling, gap report with severity ratings, remediation roadmap
Data-flow mapping, necessity & proportionality analysis, risk register & mitigations, sign-off pack; Law 25 s.3.3 / GDPR Art. 35
Named privacy officer, request & regulator handling, breach triage, quarterly compliance reviews, staff advice line
Breach response plan, notification decision trees (CAI / OPC / EU timelines), breach register, tabletop exercise, notification templates
Role-based privacy training (Law 25 & PIPEDA essentials), materials, attendance records, completion certificates
TPRM policy & framework, vendor tiering model, due-diligence questionnaires, contract clauses, onboarding workflow; OSFI B-10 aligned
OSFI B-10 / E-21 & EU DORA requirements review, critical operations mapping, tolerance setting, gap report, remediation roadmap
Structured due-diligence questionnaire review, evidence validation, risk scoring, findings report with conditions & monitoring plan
Business impact analysis, business continuity plan, disaster recovery plan, crisis communications plan, roles & escalation trees
Scheduled vendor reassessments, certificate & insurance tracking, risk & performance reviews, exit-plan maintenance, quarterly reporting
Scenario design (outage, vendor failure, cyber incident), facilitated exercise, observer scoring, lessons-learned report & action plan
Scope, schedule, budget and resourcing for technology and business projects, delivered end to end
Coordination of related projects under one programme plan, with shared governance and benefits tracking
Project management office design: standards, templates, governance cadence, reporting and tooling
A dedicated project manager for your initiative, part-time or interim, without a full-time hire
Diagnostic review of a troubled project, recovery plan, and hands-on delivery to get it back on track
Steering-committee packs, status reporting, stage-gate reviews and independent health checks
Stakeholder interviews and workshops producing BRDs, FRDs and user stories your builders can work from
Current-state analysis, pain-point identification and a prioritised improvement roadmap
BPMN process maps, workflow redesign and handoff documentation
Current-state vs target-state gaps, options analysis (build, buy, outsource) and recommendation
Stakeholder mapping, engagement plans and communications for change initiatives
Test planning, test-case design, defect triage and acceptance sign-off support
Quick questions with a vetted consultant; low-risk first purchase
Consultant reviews what the client filled in from the DIY toolkit (add-on to toolkit price) — the bridge from a toolkit sale to a full engagement
Don't see your exact need? Talk to us — most engagements begin as a variation of a package above.
The same material we use on client engagements, packaged for your team. Word + Excel, instant download, licensed for use inside your organisation.
ISO 42001, NIST AI RMF, MITRE ATLAS, OWASP and the EU AI Act — governance, risk, impact assessment and a 42-case technical test library.
NIST SP 800-30 + ISO 27005 methodology with a self-scoring 5×5 risk register and a cross-framework control map.
Incident response plan, seven playbooks, a tabletop exercise kit and a CVSS-driven vulnerability management tracker.
All 302 requirements as a working assessment workbook, plus SAQ selection, scoping and the procedures auditors ask for.
15 audit-ready policies mapped to both frameworks, with an implementation guide and crosswalk workbook.
A complete Law 25, PIPEDA & GDPR programme — policies, notices, PIA template, records register, compliance checklist and breach plan.
A 50-question, NIST-mapped vendor questionnaire with automatic weighted scoring and risk tiers.
TPRM policy, a 46-question vendor due-diligence workbook, BIA, continuity and disaster recovery plans — OSFI B-10/E-21 and DORA aligned.
Charters, project plans, RAID log and reporting packs for running security and compliance projects to a clean close.
A complete FINTRAC / PCMLTFA compliance programme for money services businesses — manual, procedures, forms and registers.
The FinCEN / BSA counterpart — AML programme manual, SAR and CTR procedures, OFAC screening and independent review.
FINTRAC compliance for the new sectors — mortgage brokers and lenders, financing and leasing entities — including source-of-funds verification.
Charters, plans, stakeholder registers, status reports, RAID logs, change control, business cases and closure documents for running any project from approval to closure.
BRDs, functional requirements and user stories, process maps, gap analysis, traceability and UAT templates that turn vague requests into signed requirements.
Based in North America and Africa, working to the rules of each market we serve.
FINTRAC and PCMLTFA programmes for MSBs, mortgage, financing and leasing sectors; SOC 2 and ISO 27001 readiness for Canadian technology and financial services firms; privacy programmes under Quebec Law 25 and PIPEDA; operational resilience and third-party risk; AI governance and algorithmic impact assessments.
FinCEN / Bank Secrecy Act AML programmes for money services businesses, SOC 2 and PCI DSS readiness, vendor risk and operational resilience programmes, state privacy law readiness, and AI governance built on the NIST AI RMF.
ISO/IEC 27001 and ISO/IEC 42001 (AI governance) programmes, EU AI Act readiness, GDPR privacy programmes, DORA operational resilience, and AML frameworks aligned to the EU anti-money-laundering directives.
AML programmes aligned to central bank supervision and FATF-style regional frameworks (GIABA, ESAAMLG); cybersecurity and data protection under laws such as South Africa's POPIA, Kenya's Data Protection Act and Nigeria's Data Protection Act; and AI governance for fast-growing technology and financial services markets.
Four steps, in order, with evidence at every one.
We map your current state against the framework or regulation that applies — no assumptions, evidence first.
Policies, procedures, registers and controls built around your actual systems and team, not boilerplate.
Evidence organised the way auditors and regulators ask for it, with gaps closed before they are found for you.
Review cycles, monitoring and training that keep the programme alive after the audit is over.
Tell us which framework, regulator or customer requirement is in front of you — we’ll reply with the shortest honest path to meeting it.
Tell us about your organisation and what you need. A consultant reviews every request personally — you will receive a response within 48 hours.
Thank you — your scoping request is on its way to our team. You will receive a response within 48 hours.
