Security Operations Centre (SOC) and a Security Information and Event Management (SIEM) SOLUTION

Canada Mortgage and Housing Corporation (CMHC), as a federal Crown corporation under Housing, Infrastructure and Communities Canada, is initiating a pre-qualification process through Invitation to Qualify ITQ-004121-1 to identify eligible proponents for a subsequent Request for Proposal aimed at establishing a Co-Managed Service Model for a Security Operations Centre (SOC) and Security Information and Event Management (SIEM) solution. The procurement is focused on securing 24/7/365 security monitoring, incident response, vulnerability management, threat intelligence, endpoint detection, identity and access management, cloud security including Microsoft Azure, network security, and data protection services, all aligned with Agile transformation initiatives and requiring strict adherence to Canadian data residency laws—ensuring all data is processed and stored exclusively within Canada. Proponents must demonstrate proven experience across ten mandatory technical capabilities, with at least five of those delivered to Canadian financial institutions or insurance sector clients, and must show a minimum of $5,000,000 in related business revenue over the past five years. All responses must be submitted electronically by May 4, 2026, at 2:00 PM Eastern Time to the designated CMHC email address, with attachments limited to 8 MB per email and formatted in accordance with specified templates. Evaluation during this ITQ stage is strictly pass/fail, with no scoring or weighting applied; failure to meet any mandatory requirement results in disqualification. Key eligibility criteria include attestation of Canadian supplier status, compliance with confidentiality and non-disclosure agreements, and verification of experience through project references, which may be subject to audit. While no contract value, pricing, or performance period is defined at this stage, award decisions will be made following the RFP process, and qualified proponents will be bound by a pre-RFP non-disclosure agreement. Personnel are preferred to be based in Canada, though mixed onshore/offshore delivery models are permitted under defined conditions. No formal security clearances are mandated, but compliance with NIST 800-53 Rev 5, SOC 2, and CSAE 3416 is implied through technical requirements. Optional services such as penetration testing, compliance support, red teaming, and staff augmentation may be considered in later stages but are not required for qualification.