Cybersecurity Compliance Audit Preparation (SOC 2 / ISO 27001)

The contract requires the preparation and ongoing maintenance of cybersecurity compliance certification packages for both the prime contractor and all associated subcontractors, specifically targeting SOC 2 Type II and ISO/IEC 27001 standards. This involves conducting comprehensive readiness assessments, developing and documenting necessary controls, coordinating internal and external testing procedures, and producing detailed audit reports to demonstrate adherence to required security frameworks. The work must ensure that all parties meet rigorous industry benchmarks for data protection, operational security, and continuous compliance, with a focus on sustained certification rather than a one-time audit. The effort is to be performed in support of the Canada Mortgage and Housing Corporation, a Government of Canada agency, under a subcontracting arrangement classified under NAICS code 541611. There is no set-aside designation specified, and performance is expected to take place across Canada. Proposals must be submitted by September 8, 2026, following the posting of the solicitation on July 30, 2026, through the Canada Buys procurement portal. Successful bidders will be responsible for delivering end-to-end compliance support, including managing timelines, coordinating with multiple stakeholders, and ensuring audit readiness at all levels of the contracting hierarchy.