What the buyer needs
AI summaryThe University of Calgary seeks a vendor to provide offsite penetration testing and cybersecurity assessment consulting services for a five-year contract term. The scope includes penetration testing and reporting for selected systems and networks, alongside consulting for vulnerability assessments, cloud and application security, risk management, system architecture reviews, and security posture testing. Only onshore Canadian organizations are eligible to bid on this solicitation. Proponents must submit a signed digital proposal through the University of Calgary's online bidding system at MERX.com on or before the closing date, including completed pricing information, reference, and signature forms. All questions must be submitted to the RFP Manager no later than November 30, 2026, with public responses published on MERX.com. The University of Calgary will evaluate proposals based on the criteria and requirements set out in the solicitation documents.
Scope of work
- Penetration testing services to assess selected systems and networks
- Penetration testing and reporting including security, data, credentials, and evidence handling
- Vulnerability assessments and cybersecurity risk management services
- Cloud security assessment services and application security assessment services
- Threat and risk assessments for technology
- System architecture reviews and security posture testing
- Cybersecurity standards consulting
How proposals are evaluated
| Criterion | Weight / scoring |
|---|---|
| Held Pricing | 3 |
| Pricing Currency | 2 |
| Service Requirement | 40 |
| Qualification Requirements | 12 |
Minimum qualifications
- Onshore (Canada Organization Only)
- Third-party security audit report such as SOC 2 Type 2, ISO 27001, or CSA STAR Level 2 upon request
- Evidence of relevant experience and qualifications for proposed roles, resources, and subcontractors
- Past project references demonstrating experience delivering similar services
- Years in business and work experience with post-secondary institutions
Documents to include with your response
- Pricing Requirements (Schedule A)
- Service Requirements (Schedule B)
- Corporate Profile
- Reference Form (Schedule D)
- Proposal Signature Form (Schedule E)
- Exceptions Statement (Schedule F)
- Proof of Insurance in amounts set out in Appendix A
- WCB Good Standing Letter (or similar insurance)
How to submit
- Method
- Electronic via MERX.com
- Instructions
- A digital version of the Proponent's Proposal, signed by the Proponent's authorized representative, must be submitted and received through the University of Calgary's online bidding system at MERX.com.