SW-118382 - USA (Tennessee) - Governance, Risk and Compliance Software - Deadline September 9,2026

(1) Vendor needs to provide governance, risk and compliance software. – Provide comprehensive Governance, Risk, and Compliance (GRC) software platform to be used across the agency environment. • Organizational structure and data model:– The platform must support representation of University entities structured by a hierarchical organizational model (e.g., system, campus, college, department, sub–department).– The platform must support assets that can be assigned to any level of the organizational hierarchy.• Risk management capabilities:– Risk assessments.– Risk lifecycle management.• Control and compliance management:– The platform must support control assessments that directly influence associated risks.– The platform must support control–based compliance assessments applicable to any asset or organizational level.• Inheritance and aggregation:– Risk inheritance.– Control inheritance.• Automation and workflow:– Data and assessment automation.– Notifications and reporting automation.• Assessment interface and collaboration:– Provide a questionnaire–based or simplified interface for assessment respondents.– The platform must support collaboration between assessors and respondents, including comments, questions, task assignment, mitigation tracking, and issue flagging.• Reporting and dashboards: – Role–based access and visibility: The platform must support role–based access control aligned to the organizational hierarchy.– The platform must provide built–in dashboards and reports without reliance on external reporting tools.– Reporting and dashboards must support flexible filtering across all relevant data fields (e.g., entity, asset, framework, timeframe, risk level, deadlines).– Dashboards and reports must provide visibility into both risk posture and compliance status at any level of the organization, leveraging hierarchical aggregation. • External risk integration: The platform must integrate with other risk management tools or provide equivalent native functionality.• Scalability and operating model: The platform must support operation at scale across multiple campuses, entities, and assets with a small, centralized administrative team. • Security and compliance requirements:– Maintain a SOC 2 Type II (or equivalent) attestation.– The platform must support multi–factor authentication (MFA).(2) All the questions must be submitted no later than August 31, 2026. (3) The contract period will be for three years.