Tender: Enterprise Cybersecurity Assessment and NIST Cybersecurity Framework 2.0 Report for Financial Consumer Agency of Canada

About

The Financial Consumer Agency of Canada (FCAC) is seeking an experienced, independent third‑party cybersecurity firm to perform an enterprise‑level assessment of FCAC’s cybersecurity posture, including an internal evaluation using ITSG‑33 Annex 3A and a harmonized threat and risk assessment methodology with evidence collection, gap analysis, residual risk determination and prioritized remediation planning, and to produce a separate NIST Cybersecurity Framework 2.0 report that conveys a high‑level, externally consumable maturity narrative without disclosing sensitive technical vulnerabilities or protected information; the internal report must be detailed and evidence‑based for management decision‑making. This selective SBIPS solicitation is open only to the 15 pre‑qualified Tier 1 SBIPS holders listed for the National Capital Region Security Management stream, with an anticipated start date of 2026-10-29, estimated delivery by 2027-03-31, an estimated level of effort of 164 days, and minimum corporate and resource security of Reliability (DOS). Contracting Authority: Pavlo Kyryakov (FCAC.Contract-Contrat.ACFC@fcac-acfc.gc.ca).