Cybersecurity Professional Services (TBIPS SA EN578‑170432)

The Department of Public Works and Government Services is seeking cybersecurity professional services under the Task-Based Informatics Professional Services (TBIPS) Supply Arrangement to support the modernization of Public Services and Procurement Canada’s Cybersecurity Directorate. The contract, solicited under number 20261030-B and posted on April 27, 2026, will run from June 1, 2026, to May 31, 2029, and is limited to pre-qualified Tier 1 TBIPS holders. Contractors must provide specialized personnel with Secret-level security clearance to deliver a range of cybersecurity services including threat and risk assessment, vulnerability analysis, incident management, forensic analysis, and the development of standardized security requirements and technical documentation. These services are intended to strengthen PSPC's operational capabilities in response to emerging technologies such as cloud computing and artificial intelligence, while simultaneously enabling knowledge transfer to internal teams. The work is exclusively performed in the National Capital Region and requires Level 3 expertise in four specific TBIPS categories: C.3 for threat and risk assessment, C.11 for vulnerability analysis, C.12 for incident management, and C.15 for computer forensics. Resource allocation is defined in Level of Effort units totaling 660 per year for C.3 in years one and two, with adjustments in year three, and smaller efforts for the other categories. All personnel must hold Secret clearance prior to contract award, and compliance with the Government of Canada’s Contract Security Program is mandatory. While no monetary values or pricing details are provided, the contract operates under an IDIQ framework, allowing task order execution without predetermined costs. Proposal submissions are restricted to incumbent TBIPS suppliers, with no formal evaluation weights or award criteria disclosed, though technical merit is clearly prioritized over price. There are no explicitly stated option periods or extension clauses, but task orders may be issued throughout the three-year base period. No packaging, marking, invoicing protocols, or specific technical standards like NIST or ISO are referenced, and no formal inspection or acceptance criteria are outlined beyond performance of the required deliverables.