SW-120055 - USA (Colorado) - Governance, Risk and Compliance Platform System Implementation - Deadline October 14,2026

(1) Vendor needs to provide governance, risk and compliance platform system implementation.– Provide a Software as a Service (SaaS) GRC solution to replace the existing OneTrust system in use by the Information Security Office.– This software must also be capable of meeting the future information and technology risk management, Governance, Risk, and Compliance, and vendor risk management needs of the Information Security Office.• Includes a risk register, assessment functionality, control library, issue resolution tracking, and governance workflows. • Scalable and extensible third–party onboarding risk assessment functionality and life cycle monitoring and management. • Capability to develop frameworks for government–specific compliance requirements. • Timely framework updates and customizable risk calculations. • Ability to document cybersecurity, privacy incidents and compliance violations regarding the city’s third–party portfolio. • Dark web / OSINT monitoring. • Supports life cycle risk evaluation and monitoring of on–premises, GenAI, and Agentic AI applications. • Capability to validate Software Bill of Materials (SBOM) or identify product third–party dependencies. • Third–party and business stakeholder self–service portal for reporting, treatment status tracking, and response. • Improved dashboard builder, filtering, and saved views. • Support for custom attributes and metadata • High–quality dashboards and executive reporting capabilities. • Multiple publication methods (web, email, Teams). • AI–assisted reporting and document analysis. (2) All the questions must be submitted no later than October 02, 2026