SA&A Microsoft Copilot

The Office of the Auditor General of Canada is seeking offers for a Security Assessment and Authorization (SA&A) for Microsoft 365 Copilot and related services. The project involves conducting security architecture reviews, data residency and sovereignty analysis, control validation, and various risk assessments to ensure compliance with Government of Canada security policies, specifically for Protected A and B information. Key deliverables include a comprehensive suite of reports covering AI risk, privacy findings, a security control traceability matrix, a Plan of Action and Milestones (POA&M), and a remediation roadmap. All work must be completed by March 31, 2027, and deliverables must be provided in Microsoft Office formats. The award will be based on a trade-off process, with technical merit weighted at 60% and price at 40%. Mandatory technical requirements include demonstrated experience with Azure/M365 cloud security assessments and proficiency in at least four specific Microsoft 365 technologies, such as Entra ID, SharePoint Online, and Teams. Eligible offerors must be Canadian suppliers or from an applicable trading partner and must hold a valid organizational security clearance. Proposals must be submitted electronically via the Government Electronic Tendering Service (GETS) by the deadline of August 27, 2026.