RFP FOR FIRST LINE OF DEFENCE SECURITY SOLUTION

The Canada Mortgage and Housing Corporation (CMHC) is soliciting proposals for a cloud-based Software-as-a-Service (SaaS) solution to manage Cyber Security Governance, Risk, and Compliance (GRC). The objective is to enhance operational efficiency, regulatory alignment, and cyber risk visibility across IT and cyber domains. The selected proponent will enter into a non-exclusive agreement for an initial five-year term, with two optional renewal years, for a total potential duration of seven years. The solution must provide centralized management of policies, risk registers with assessment workflows, and compliance repositories aligned with standards such as NIST, ISO, CIS, MITRE, OSFI B-13, and SWIFT CSP. Key technical requirements include integration with SIEM, IAM, and CMDB systems, the migration of legacy audit and risk data, and a strict mandate that all data be transmitted, stored, and processed exclusively within Canada. The award will be based on the highest overall score, weighted across rated criteria (40%), a presentation (30%), and pricing (30%). Proponents must meet mandatory security standards, including providing SOC 2 Type II reports for the last three consecutive years or equivalent certifications like ISO/IEC 27001. The solution must also support Protected B information levels in accordance with Communications Security Establishment standards. Proposals are due by September 28, 2026, with an estimated contract award date of December 1, 2026. Payment will be processed via Electronic Funds Transfer with a thirty-day payment term following the submission of electronic invoices.