APN - Enterprise Resource Planning Software System

Amendment #2

To accommodate holiday business hours of operation, vendors are advised that questions concerning this Advance Procurement Notice will not be addressed between December 24, 2024, and January 1, 2025.

************************************************************************************************************************************************************************************************************************************* Amendment #1

The timing of the following anticipated security requirement was changed from before contract award to after contract award.

The DCC IT Security Authority must perform a Security Assessment and Authorization (SA&A) of the system in-scope of the contract, and in accordance with Appendix B: Mandatory Procedures for Information Technology Security Control of the Directive on Security Management, or other assessment as determined by the DCC CSO or CIO.  Vendors must provide the required information to the IT Security Authority upon request.

The following anticipated security requirement was added

Prior to contract award, the vendor and its proposed ERP Software System will need to undergo a security assessment by DCC. At a minimum this assessment will include a review of the following:

ISO/IEC 27001:2022 certification (or subsequent version) ISO/IEC 27017:2015 certification (or subsequent version) ISO/IEC 27018:2014 certification(or subsequent version) AICPA Service Organization Control (SOC) 2 Type II Audit Report

For clarity, the services of a systems integrator to implement the new ERP software system are out of scope of this anticipated procurement. DCC plans to procure the services of a systems integrator in a separate procurement.

************************************************************************************************************************************************************************************************************************************* Advance Procurement Notice

ENTERPRISE RESOURCE PLANNING SOFTWARE SYSTEM OTTAWA, ONTARIO

(with Security Requirements)

Purpose of this Advance Procurement Notice This is not a bid solicitation nor a request for proposals. This is an advance notice for a potential contract with anticipated security requirements to provide interested vendors an opportunity to begin the sponsorship process for obtaining (if required) the anticipated security clearance(s). Note that there is no guarantee that this solicitation will proceed or that any security clearance(s) will be granted under the sponsorship process in a timely fashion or otherwise.

Description of the Project and Services The goal of this project is to procure a modern Enterprise Resource Planning (ERP) software system that will replace DCC’s legacy ERP system. DCC’s current ERP system is used by roughly 1,300 users across Canada. As of the date of this Advance Procurement Notice, DCC estimates that it will need the following modules in the ERP software system in order to meet its requirements: •  Finance •  Human Resources •  Procurement •  Project Management It is anticipated that this solicitation will be initiated in winter 2025.  This is conditional on the contract receiving approval to proceed.

Contract Award and Anticipated Security Requirements To be eligible for contract award, a proponent or bidder will be required to, among other things, actively hold or obtain all required security clearance(s) prior to the date of the award, as further detailed in the solicitation documents. As of the date of posting of this Advance Procurement Notice, the required security clearance(s) for vendors are anticipated to be as follows:

A valid and active Designated Organization Screening (DOS) and obtain approved Document Safeguarding Capability at the level of PROTECTED B granted or approved by the Contract Security Program (CSP), Public Works and Government Services Canada (PWGSC); and Prior to contract award, the vendor must provide evidence and confirmation to Canada of a completed Cloud Service Provider Information Technology Security assessment (ITSM.50.100) for its cloud-based system, or other assessment accepted by the DCC Department Chief Security Officer (CSO) or Chief Information Officer (CIO), performed by DCC or the Canadian Centre for Cyber Security (CCCS). Prior to contract award, the vendor and its proposed ERP Software System will need to undergo a security assessment by DCC. At a minimum this assessment will include a review of the following:

ISO/IEC 27001:2022 certification (or subsequent version) ISO/IEC 27017:2015 certification (or subsequent version) ISO/IEC 27018:2014 certification(or subsequent version) AICPA Service Organization Control (SOC) 2 Type II Audit Report

For awareness, the following will be required by the vendor after contract award

Data residency for electronic data at rest at the level of PROTECTED B or higher must be within Canada. The vendor MUST NOT utilize its Information Technology systems to electronically process, produce or store PROTECTED information until the CSP, PWGSC has issued written approval.  After approval has been granted, these tasks may be performed at the level of PROTECTED B including an IT Link at the level of PROTECTED B. The DCC IT Security Authority must perform a Security Assessment and Authorization (SA&A) of the system in-scope of the contract, and in accordance with Appendix B: Mandatory Procedures for Information Technology Security Control of the Directive on Security Management, or other assessment as determined by the DCC CSO or CIO.  Vendors must provide the required information to the IT Security Authority upon request.

Industrial Security Program Sponsorship Defence Construction Canada (DCC) is providing vendors early access to the security clearance application process through sponsorship under its Industrial Security Program (ISP). Accordingly, vendors that intend to submit a proposal or a bid on one or more of these projects and that do not actively hold the above identified security clearance(s) should begin forthwith the security clearance application process by applying through DCC’s ISP. Under this program, DCC may, at its entire discretion, provide preliminary assistance to all the potential bidders or proponents with their respective security clearance sponsorship process. To begin the security clearance sponsorship process, please submit a sponsorship request application to DCC by following the steps identified on DCC’s website at: https://www.dcc-cdc.gc.ca/industry/security-requirements. In their sponsorship request application to DCC, vendors are asked to quote the following information, among other things:

Contract number DCC-IT-020-03; and Level of clearance requested to be sponsored for.

Sponsorship Process Upon receipt, DCC will review the sponsorship request application and will communicate directly with the vendors to provide assistance for the completion of the sponsorship request packages. Once DCC has determined, at its entire discretion, that a vendor:

has started the sponsorship process prior to the solicitation (Contract number listed on their request for sponsorship) being advertised on MERX, has met all the material requirements of the sponsorship request package, and has submitted a proposal or a bid

DCC will send the documents to the Public Services and Procurement Canada’s (PSPC) Contract Security Program (CSP). Following receipt of the sponsorship request package, the CSP will communicate directly with the proponent or bidder regarding any further steps or actions to be undertaken or the status of the sponsorship request package processing. At such time, the proponent or bidder will need to promptly cooperate with CSP to ensure that the process is completed as soon as possible.

Questions Any questions pertaining to the sponsoring process through the ISP can be addressed to: Telephone Number: (613) 998-8974; or Email address: ISP.Sponsorship@dcc-cdc.gc.ca

Any questions relating to this Advance Procurement Notice can be addressed to: Paul Chouinard Procurement Specialist Defence Construction Canada 343-549-1737 paul.chouinard@dcc-cdc.gc.ca

Disclaimer DCC is only providing assistance, at its entire discretion, for the above stated sponsorship process  and does not provide any representations  or guarantees that a sponsorship request package or a security clearance application forwarded by DCC to the CSP will be successful or result in the granting of the requested security clearance(s) by the CSP. At all times, the processing of a sponsorship request package or a security clearance application is subject to the respective terms, conditions, and timelines of DCC’s ISP sponsorship process and the CSP security clearance granting process. By applying to either of the aforementioned processes, the proponent or bidder agrees to bear any fees and risks associated with: (i) the completeness or accuracy, or lack thereof, of its application or related documents submitted under or in connection with either said processes, and (ii) the timeliness, or lack thereof, of any processing or granting of security clearance(s) under or in connection with either said processes. Notwithstanding anything else stated above, DCC shall in no event be liable to the bidder or proponent for any direct, indirect, incidental, special, consequential, punitive or exemplary damages arising out or in connection with the above stated sponsorship process.

 Bidding and Documents are available on http://www.merx.com. Fees may apply; See https://www.merx.com/public/pricing for more information.