Internal Audit of IT Security - Task Authorization

NOTICE OF PROPOSED PROCUREMENT (NPP) For Professional Audit Support Services Supply Arrangements (PASS SA) Tendering Procedure: Selective Tendering Requirement Details This requirement is open only to those PASS Supply Arrangement Holders who qualified under Tier 3 IT and Systems Audit The following SA Holders have been invited to submit a proposal: A Hundred Answers Inc. BDO Canada LLP C3SA CYBERNETIC SECURITY AUDIT INC. Ernst & Young LLP KPMG LLP MNP LLP Orbis Risk Consulting Inc. Pricewaterhouse Coopers LLP QMR Staffing Solutions Incorporated Raymond Chabot Grant Thornton Consulting Inc. Samson & Associés CPA/Consultation Inc Spearhead Management Canada Ltd. Description of Work: Public Safety (PS) Canada requires an audit firm to conduct an Internal Audit of IT Security and conduct the independent Quality Review of the Internal Audit of IT Security under Stream 3 of the PASS SA respectively.  The preliminary objective of the audit will be to assess the effectiveness and efficiency of the processes and controls in place for managing IT security and ensure compliance with Treasury Board and departmental policies, directives and standards. The preliminary scope includes IT infrastructure, IT services, departmental applications and systems, and the IT security controls in place for the management of electronic information. The scope will be adjusted depending on the Office of the Comptroller General (OCG) Horizontal Audit of IT Security Phase II. The audit objective and scope will be confirmed upon the completion of the risk assessment. The audit engagement will be conducted in accordance with Treasury Board Policy and Directive on Internal Audit and the Institute of Internal Auditor’s (IIA) International Professional Practices Framework. Period of Work The Work is to be performed from date of contract award to March 31, 2020. Deliverables Required Delivery Date Kick-off Meeting - Within one week of contract award Audit Risk Assessment - June 2019 Audit Terms of Reference - June 2019 Detailed Audit Program - July 2019 Criteria Working Papers - September 2019 Audit Findings - October 2019 Draft Report (1st Draft) - Early November 2019 Final Report - End of December 2019 Status Reports - Monthly Management Briefing materials (e.g. placemat) - When requested Security Security Requirement for Canadian Supplier: Public Services and Procurement Canada File #Common-Professional Services Security Requirement Check List #19

The Contractor/Offeror must, at all times during the performance of the Contract/Standing Offer/Supply Arrangement, hold a valid Facility Security Clearance at the level of secret, issued by the Canadian Industrial Security Directorate (CISD), Public Services and Procurement Canada (PSPC) The Contractor/Offeror personnel requiring access to protected/classified information, assets or sensitive work site(s) must EACH hold a valid personnel security screening at the level of RELIABLITY status, confidential or secret as required, granted or approved by CISD/PSPC The Contractor/Offeror must not remove any protected/classified information from the identified work site(s), and the Contractor/Offeror must ensure that its personnel are made aware of and comply with this restriction Subcontracts which contain security requirements are not to be awarded without the prior written permission of CISD/PSPC The Contractor/Offeror must comply with the provisions of the: Security Requirements Check List and security guide (if applicable), attached at Annex C Industrial Security Manual (Latest Edition)

Inquiries Inquiries regarding this RFP requirement must be submitted to the Contracting Authority named above. Request for Proposal (RFP) documents will be e-mailed directly from the Contracting Authority to the Qualified Supply Arrangement Holders who are being invited to bid on this requirement. BIDDERS ARE ADVISED THAT “BUYANDSELL.GC.CA” IS NOT RESPONSIBLE FOR THE DISTRIBUTION OF SOLICITATION DOCUMENTS. Canada retains the right to negotiate with any supplier on any procurement. Documents may be submitted in either official language. NOTE: The PASS SA (PASS SA) Method of Supply is refreshed periodically every year. If you wish to find out how you can be a “Qualified SA Holder”, please contact RCNMDAI.-NCRIMOS@pwgsc.gc.ca Contract Authority Denise Desserud Senior Acquisition Advisor / Corporate Services Directorate Public Safety Canada / Government of Canada ps.contractunit-unitedecontrats.sp@canada.ca / Tel: 613-990-2614