Ransomware Tabletop Exercise

PROCUREMENT OVERVIEW

The Office of the Superintendent of Financial Institutions (OSFI) is seeking to conduct a Ransomware Tabletop Exercise as part of its initiative to enhance its Business Continuity Management function. The objective is to validate the operational readiness of OSFI's revised corporate incident management capability, which integrates Incident Command System (ICS) principles. The exercise will simulate a ransomware event to assess the effectiveness of the incident response strategies and ensure a smooth transition from emergency response to business recovery.

ISSUING ORGANIZATION

• Organization Name: Office of the Superintendent of Financial Institutions (OSFI)
• Location: Ottawa, Ontario, Canada
• Primary Contact: Craig Kenny, Lead Senior Contracting Officer
• Email: [email protected]

KEY DATES

• Posted Date: June 16, 2026
• Proposal Due Date: July 3, 2026
• Anticipated Award Date: Not specified
• Performance Period: Not specified

CONTRACT DETAILS

• Contract Type: Not explicitly stated, but likely to be a firm-fixed-price or similar based on the nature of the exercise.
• Estimated Contract Value: Not mentioned.
• Option Years: Not specified.

MANDATORY REQUIREMENTS

Bidders must meet the following mandatory requirements to be eligible:

• Security Clearance: Minimum corporate security clearance required is "Secret," and the same applies to individual resources.
• Supply Arrangement Holders: Only qualified SBIPS Supply Arrangement Holders under Tier 1 for services in the National Capital Region are eligible to submit proposals.

TECHNICAL CAPABILITIES

Bidders should demonstrate expertise in:

• Business Continuity Management
• Incident Command System (ICS) principles
• Cybersecurity, specifically in relation to ransomware scenarios
• Experience in conducting tabletop exercises or incident response simulations

DELIVERABLES AND PERFORMANCE STANDARDS

The key deliverables include:

• A comprehensive tabletop exercise focused on a ransomware scenario.
• Documentation of the exercise outcomes, including lessons learned and recommendations for improvement.
• Reporting on the effectiveness of the incident management strategies employed during the exercise.

EVALUATION CRITERIA

Proposals will be evaluated based on a combined high score for technical merit and price. Specific weighting or priority factors have not been disclosed, but bidders should focus on demonstrating their technical approach and past performance in similar exercises.

PREFERRED QUALIFICATIONS

While not mandatory, the following qualifications may provide a competitive advantage:

• Previous experience with government or financial institutions in conducting similar exercises.
• Advanced certifications in cybersecurity or business continuity management.
• Proven track record of successful incident response planning and execution.

This summary provides a comprehensive overview of the RFP for the Ransomware Tabletop Exercise, highlighting the essential information that potential bidders need to assess their fit for this opportunity.