SBIPS - Professional Cyber Security Evaluation Services for the Financial Consumer Agency of Canada (FCAC) under Solution-Based SBIPS Supply Arrangement EN537-05IT01/XXX/EI.

NOTICE OF PROPOSED PROCUREMENT (NPP) For Solution-Based Informatics Professional Services (SBIPS). GSIN: D302A Informatics Professional Services Reference Number: 20261288 Solicitation Number: 20261288 Organization Name: The Financial Consumer Agency of Canada (FCAC) Solicitation Date: 2026-10-06 Closing Date: 2026-10-22, 2:00 PM Ottawa Time Anticipated Start Date: 2026-10-29 Estimated Delivery Date: 2027-03-31 Estimate Level of Effort: 164 day Contract Duration: The contract period will be from the date of contract to 2027-03-31. Solicitation Method: Competitive Applicable Trade Agreements: World Trade Organization Agreement on Government Procurement (WTO-AGP), the Canada-Chile Free Trade Agreement (CCFTA), the Canada-Peru Free Trade Agreement (CPFTA), the Canada-Colombia Free Trade Agreement (CColFTA), the Canada-Panama Free Trade Agreement (CPanFTA), the Canada-Honduras Free-Trade Agreement, the Canada-European Union Comprehensive Economic and Trade Agreement (CETA), the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP), the Canadian Free Trade Agreement (CFTA), the Canada-Ukraine Free Trade Agreement (CUFTA), the Agreement on Trade Continuity between Canada and the United Kingdom of Great Britain and Northern Ireland and the Canada-Korea Free Trade Agreement (CKFTA). Comprehensive Land Claim Agreement Applies: No Number of Contracts: 1 Requirement Details Tendering Procedure: Selective Tendering This requirement is open only to those SBIPS Supply Arrangement Holders who qualified under Tier 1 for services in the National Capital Region for the following stream(s): Security Management 1. Accenture Inc.; 2. ADGA Group Consultants Inc.; 3. CGI Information Systems and Management Consultants Inc.; 4. Deloitte Inc.; 5. Ernst & Young LLP.; 6. Gartner Canada Co.; 7. IBM Canada Limited/IBM Canada Limitée.; 8. IPSS Inc.; 9. KPMG LLP.; 10. OPTIV Canada Federal Inc.; 11. T-REX Solutions LLC.; 12. TEKsystems Global Services Corp.; 13. The Bell Telephone Company of Canada or Bell Canada/La Compagnie de Téléphone Bell du Canada ou Bell Canada.; 14. TPG Technology Consulting Ltd.; 15. TRM Technologies Inc. *** Financial Consumer Agency of Canada (FCAC) thanks you for your interest in our procurement process. The RFP will only be open to the fifteen (15) suppliers listed on the NPP and we will not be adding any additional suppliers to this solicitation. FCAC has met the mandatory requirements under the PSPC SBIPS SA and we are confident that we will be receiving a sufficient number of proposals to make this a truly competitive process. With our current staffing limitations, we cannot invite additional proponents without creating undo process or inefficiencies within our procurement system. FCAC thanks you again for your interest and going forward we will keep your firm in mind for our future requirements. Description of Work: The Financial Consumer Agency of Canada requires the services of an experienced, reputable, and independent third-party cybersecurity firm to conduct an enterprise-level assessment of FCAC’s cybersecurity posture. The assessment shall include an internal evaluation of FCAC’s information technology security controls using ITSG-33 Annex 3A and a harmonized threat and risk assessment methodology, supported by evidence collection, gap analysis, residual risk determination, and prioritized remediation planning. The assessment shall also include a separate National Institute of Standards and Technology Cybersecurity Framework 2.0 report to present FCAC’s cybersecurity posture in a broader, executive-level and externally consumable manner. The internal report shall be detailed, evidence-based, and suitable for management decision-making, while the external report shall provide a high-level maturity narrative suitable for publication or broader stakeholder communication, without disclosing sensitive technical vulnerabilities, system-specific weaknesses, or protected information