Integrated Governance, Risk &Compliance (GRC) SaaS Solution

Tender description

The Contracting Entity intends to procure a framework agreement for the provision of implementation, Licencing, Support and Maintenance services, for an integrated Governance, Risk & Compliance (GRC) SaaS solution. Background The integrated GRC solution will enable simplification, automation and integration of ESB’s Governance, Risk and Compliance activities. These will include the following: 1. Enterprise Risk Management 2. Governance, Internal Control & Operational Risk Management 3. IT Risk Management 4. Cyber Security Risk Management 5. Policy Management 6. Third party Cyber Security Risk Management 7. Business Continuity Management 8. Audit Management 9. Incident and investigation management and reporting 10. Ethics Management & Compliance Management (This is an optional capability) Full details contained in the Pre-Qualification Questionnaire document: Section A.1.1 General Description of the Proposed Contract Lot 1: Business-wide Governance Risk & Compliance (GRC) A scalable integrated SaaS solution to support end-to-end standard GRC processes to include at least the following: a. “Governance” monitoring: · Attestation process capability to include: · automatic workflows; summary view (dashboard) of attestation responses (different levels); · ability to attach, (associate) documents incl. Risk and Control/Treatment Registers to workflows · attestation metrics (no. of responses within date range, non-respondents etc.) · capability to run multiple attestations simultaneously · An easily accessible library of relevant company policies / procedures / processes / role documentation and related documents · ethics management (optional) b. Enterprise Risk Management process: · capturing risks and Controls/Treatments throughout the organisation and cascading upwards & providing summary views; · an Enterprise-Level “Principal/Strategic Risk” process, supporting the updating/attestations to updates of Principle Risks (automatic workflows, dashboards etc.) · Metrics on individual Risks, Risk ranking, Mitigations/Controls, Residual Risks and Assurance, Risk and Control Owners; also providing an integrated view of multiple instances and interdependencies · automatic workflows; summary view of completions and reviews/sign-offs · Incident management, escalation and reporting · Incident data uploading capability c. Compliance (optional)– support for Legal/Regulation/Policy Compliance assurance processes – · capture of Compliance Risk universe and ranking; · compliance policies & policy management; · compliance assurance processes and associated timelines/ cycle frequency; · compliance reporting functionality; · Compliance Test Plan · automatic workflows; summary view of completions and reviews/signoffs Please consult the associated documentation, which contains full instructions regarding the submission of responses and is available to download from www.etenders.gov.ie using RFT ID 219315 Lot 2: Audit Management & Fraud Incident Management • Audit Management System to manage and automate audit process workflow, including workpaper documentation, issue tracking and reporting for third line internal audit and second line audit functions. • The solution should cater for multiple audit functions (both second and third line) to separately manage and have a segregated view of their audit activities for each of the following use cases: o Audit Universe Management o Audit Plan Scheduling & Resourcing o Individual Audit Planning and Execution o Automated Issue/Action Tracking & Follow up o Dashboard, KPI and Ad-hoc Reporting and Analysis • Incident Management & Reporting system to centrally track and report on highly confidential information relating to incidents and associated investigations of suspected fraud and protected disclosures across multiple separate business functions. Please consult the associated documentation, which contains full instructions regarding the submission of responses and is available to download from www.etenders.gov.ie using RFT ID 219315 Lot 3: Cyber Security Risk, Third Party & Policy Compliance Management (i) A scalable integrated Cybersecurity Risk Management solution to support and deliver cybersecurity risk assessments, cybersecurity policy management and compliance & third-party cybersecurity risk management (TPCRM) (ii) The Integrated Cybersecurity Risk Management solution will provide KPI monitoring/reporting, scorecards and dashboards, external data integration and performance metrics (iii) The requirement is to support and deliver the Integrated Risk Management solution across the following use cases o Cybersecurity risk management & assessments  Provide a standard library for the selection of standard cybersecurity control frameworks o Cybersecurity policy management including:  Policy lifecycle management  Policy exemption management  Policy attestations o Third party cybersecurity risk management & assessments including:  Integration with a provided external 3rd party cybersecurity ratings services to support ongoing third-party risk screening  Cybersecurity compliance assessments based on industry standard cybersecurity frameworks Please consult the associated documentation, which contains full instructions regarding the submission of responses and is available to download from www.etenders.gov.ie using RFT ID 219315 Lot 4: Business Continuity Management / Business Impact Assessment The tool will provide the following: • Business Impact Assessments, Continuity Risk assessments • Business Continuity & Crisis Management Plans • Ability to map Interdependencies • Enable the planning Exercises & Tests-helps to validate the plan content and identify weaknesses and areas for improvement before a real disaster occurs. • Dash Board and Reporting KPIs • We may at some future point seek Emergency Mass Notification System (EMNS) capability, but we do not intend to score based on this capability (Optional) Please consult the associated documentation, which contains full instructions regarding the submission of responses and is available to download from www.etenders.gov.ie using RFT ID 219315 Lot 5: IT Governance & Risk Management • The IT Risk Management Software System solution is required to deliver the following capabilities: • The Integrated Risk Management software solution will provide KPI monitoring/reporting, scorecards and dashboards, external data integration and performance metrics for IT risk • The Integrated Risk Management software product must be a cloud-based SaaS and be fully scalable (for future expansion if necessary), e.g., the system must be able to cater for an increase in users, volumes of users logged in concurrently, and increasing data storage or processing power as required in future • The requirement is to support and deliver the Integrated Risk Management solution across the following: • Overall IT Risk Management • IT Activity/Process Risk management • Cybersecurity risk management (as above) • Policy Management • Compliance Risk Management Please consult the associated documentation, which contains full instructions regarding the submission of responses and is available to download from www.etenders.gov.ie using RFT ID 219315