NATO Request for Information: Governance, Risk, and Compliance Tool

The NATO Communications and Information Agency (NCIA) has issued RFI-07119-GRC to gather industry input on commercial-off-the-shelf Governance, Risk, and Compliance (GRC) tool solutions in support of a future acquisition. This RFI is a market research tool designed to inform planning and does not solicit bids or obligate NCIA to award a contract. Respondents are invited to share corporate capabilities, provide feedback on draft requirements, and highlight potential risks or concerns to enhance outcome efficiency, competition, and performance. The solution must support automated compliance tracking, real-time risk modeling, and Everything as Code methodologies, integrating with NATO security standards including NIST CSF, NIST SP 800-53, ISO/IEC 27001, CSA CCM, and OSCAL. The system must operate in secure NATO environments, including air-gapped networks, while ensuring data sovereignty, portability, and full NATO policy compliance. Only vendors from NATO member countries with personnel holding NATO security clearances are eligible to respond, and all technical support staff must be cleared prior to any future contract award. Response submissions are limited to 15 pages in PDF or Microsoft Word format, excluding cover pages, brochures, and past performance references. Submissions must be sent via email to Esteban.Diaz@ncia.nato.int no later than 12:00 hours CET on 29 May 2026. Licensing models, pricing structures, price protection, and vendor eligibility are key areas of interest, though no contract value, CLINs, or payment terms are defined at this stage. The RFI does not include formal FAR clauses, evaluation factors, or contract administration data beyond the point of contact, and no inspection, packaging, or delivery specifications are mandated. Future procurement decisions will be informed by this input, with the ultimate goal of selecting a GRC tool that enables continuous compliance across NATO’s complex, multi-framework IT landscape.