NATO Request for Information: Governance, Risk, and Compliance Tool

The NATO Communications and Information Agency (NCIA) is conducting market research to identify potential sources and gather information regarding industry capabilities to support a Commercial-Off-The-Shelf (COTS) solution to meet the requirements provided in this document for a Governance, Risk and Compliance tool. The NCIA is seeking an automated solution to synchronize the risk management and regulatory compliance processes that is adaptable based on the definition of security requirements coming from the NATO Policies and Directives. Key features and requirements of the tool include: • Implementation of safeguards and third-party or customer APIs • Customizable APIs for data collections • Integration with other technologies and systems • Support for Single Sign On (SSO) with one or more Identity Providers (IdP) • Multi Factor Authentication (MFA) capability • Ability to define additional fields for collected asset valuation • Support for document versioning and collaborative workflows • Formal sign-off/attestation of specific versions, confirming risk acceptance or authorization • Clientless web access option via web browser • Configurable dashboard from the data and user access perspective • Real-time updates to the dashboard • Scalability to easily consider average number of assets to model risk in the range of 1-5 million(s) and the compliance Security Controls in the range of 1-5 thousand(s) • Support for deployment via Helm/Containers on internal Kubernetes • Ability to function entirely without outbound internet connection to the vendor • Full ownership and direct access to underlying database • Active-active clustering support • Asset-based or User-based licensing • No additional costs or rate limits for API calls or data ingestion • Annual price cap • Data portability clause • Access to Engineering-level resources • Certification track for OSCAL Architects or Platform admins • SLA for cloud connectivity bug fixes • Searchable « Documentation-as-Code » portal available The NCIA invites industry partners to share relevant corporate capabilities and experience, review and comment on the draft requirements, and identify any risks or concerns that should be considered during planning.