Financial Consumer Agency of Canada (FCAC) - *National Capital Region (NCR), *Canada, Ottawa, ON
This is an open but highly restricted Government of Canada opportunity from the Financial Consumer Agency of Canada (FCAC) for enterprise-level cybersecurity evaluation services. The work appears to involve assessing FCAC’s security controls using ITSG-33 Annex 3A and a harmonized threat and risk assessment methodology, collecting evidence, identifying gaps, determining residual risks, and preparing a prioritized remediation plan. The supplier must also produce a separate, executive-level report based on the NIST Cybersecurity Framework 2.0 that could be shared externally without revealing sensitive technical weaknesses. The requirement is for one contract, with an estimated level of effort of 164 days and a contract period ending March 31, 2027. The work is associated with the National Capital Region and requires personnel and corporate security clearances at the Reliability/DOS – Reliability level. Documents may be submitted in either official language.Important restriction: FCAC states that only the 15 Tier 1 suppliers already qualified under the SBIPS Supply Arrangement for the Security Management stream in the National Capital Region may bid. It says no additional suppliers will be added to this solicitation. These named suppliers include major consulting and cybersecurity firms such as Accenture, CGI, Deloitte, IBM, KPMG, OPTIV, Bell, TPG Technology Consulting, and others. There is a dateinconsistency in the provided information: the tender record lists a closing date of November 5, 2026 at 2:00 p.m., while the notice text states October 22, 2026 at 2:00 p.m. Ottawa time. The RFP documents are being distributed directly by FCAC to invited SBIPS holders, and Canada Buys is not responsible for distributing them. Businesses should confirm their invitation status, the applicable deadline, mandatory qualifications, security requirements, evaluation criteria, and submission instructions directly with FCAC and the official tender notice before preparing or submitting a bid. This opportunity potentially matches only organizations that meet the stated SBIPS holder and stream requirements.
