Cybersecurity Incident Exercise Design & Facilitation

The contract seeks a vendor to design, develop, and facilitate a ransomware tabletop exercise aimed at evaluating the incident response and business continuity functions of the Office of the Superintendent of Financial Institutions. The scope includes creating a realistic ransomware scenario, crafting strategic injects to simulate evolving threats, coordinating participation across relevant stakeholders, and delivering a comprehensive after-action report with actionable recommendations. The exercise is intended to stress-test preparedness, communication protocols, and decision-making under pressure in a controlled environment. Performance must align with Canadian federal cybersecurity standards, and all activities will be conducted within Canada. The subcontract is open for proposals with a submission deadline of July 3, 2026, and was posted on June 16, 2026, under NAICS code 541611 for management, scientific, and technical consulting services. The project is issued by the Government of Canada through the Office of the Superintendent of Financial Institutions, with no specific set-aside provisions indicated. While point of contact details are not provided, responses must be submitted via the Canada Buys tender portal, and the work is expected to be performed entirely in Canada without geographic restrictions beyond the national boundary. The selected vendor will be responsible for ensuring the exercise is both technically rigorous and operationally relevant to financial sector regulatory environments.