RFP - PREQUALIFICATION FOR CONFIDENTIAL INFORMATION DISCLOSURE RISK (CIDeR)

ABOUT FCC FCC is Canada’s leading agriculture and food lender, dedicated to the industry that feeds the world. FCC employees are committed to the long-standing success of those who produce and process Canadian food by providing flexible financing, AgExpert business management software, information and knowledge. FCC provides a complement of expertise and services designed to support the complex and evolving needs of food businesses. As a financial Crown corporation, FCC is a stable partner that reinvests profits back into the industry and communities it serves. For more information, visit fcc.ca. RFP CONTACT Ronke Niagwan Procurement Manager Farm Credit Canada procurement@fcc.ca RFP SCOPE FCC is wrapping up a 3.5-year project focused on maturing three (3) pillars of Information Security: • Privacy by Design • Cybersecurity • Information Management The goal of the project was to establish core capabilities to ensure effective Technology and Information Risk management. The initial scope and direction of the project were based on the recommendations from the following assessments: • EIM Maturity Assessment • NIST Cybersecurity Maturity Assessment • Privacy GAPP Assessment In 2022, FCC conducted 3 formal maturity assessments, to assess progress and provide direction and guidance on the scope and deliverables for the remainder of the project and beyond, with a focus on Confidential Information Disclosure risk. The 3 assessments are noted below: • Cyber Security Assessment using the NIST Framework • Privacy Assessment using the Privacy NIST Framework • Technology and Information Risk management Assessment Over the course of the project, FCC modified the scope and deliverables related to the Privacy component of the initiative to re-align its focus from a risk management framework to a regulatory compliance management program. As a result, the Privacy Office was mandated to develop, in a first phase, a “Second Line of Defense” Privacy Program grounded on the legal obligations governing FCC (i.e. the Privacy Act and related regulations; and the Treasury Board of Canada Privacy instruments), with a view to mature beyond the foundational legal obligations in a phase 2 exercise. Work continues to be managed through addressing our top risk of Confidential Information and Data Disclosure: The risk that private and proprietary information and data on FCC and/or third-party infrastructure is compromised through data theft, unauthorized data access and use, and/or inadvertent data exposure or disclosure, impeding the ability to serve customers and maintain confidentiality requirements. Work also continues with the completion and/or enhancement of the components of a Privacy Program, and with defining a clear roadmap to inform the implementation of the program elements within FCC’s various “first line of defense” functions. FCC sees the successful Proponent(s), as part of the Pre-Qualified List (or PQ List) being able to provide support and advisory services for the following Service Areas: Information and Data Governance, Cybersecurity and Privacy in the future. More details of scope included in the RFP document. RFP PARTICULARS • All conditions for Proponent participation are included in the RFP documents. • Duration of Contract: Varying from weeks to years. Maximum term for a SoW is 5 years. • Options: Not applicable. • Estimated Quantity of Goods or Services: Not applicable. • Timeframe of Delivery of Goods or Services: Not applicable. RFP SCHEDULE • RFP Release Date: October 30, 2023 • Proponent Questions Accepted Until: November 9, 2023 at 2:00PM* • FCC Response to Proponent Questions Delivered Before: November 20, 2023 at 5:00PM* • RFP Closing Date/Time: November 28, 2023 at 2:00PM* NOTE: All times are CST – Saskatchewan. The above dates are subject to change at the sole discretion of FCC. Any changes to the RFP Schedule will be communicated to all Proponents via amendment on MERX. RFP PROCESS CONSIDERATIONS • This opportunity is covered under the provisions of Chapter 5 (Government Procurement) of the Canadian Free Trade Agreement (CFTA) and Chapter 19 (Government Procurement) of the Canada-European Union Comprehensive Economic and Trade Agreement (CETA). • FCC is subject to the Official Languages Act (Canada). Proponents may choose to respond to this RFP in their official language of choice (English or French). • This opportunity notice references a non-binding, competitive RFP, and is not a call for tenders. FCC is not obligated to proceed with the Work described in the RFP Scope and may cancel the RFP at any time. FCC’s procurement process allows for consecutive or concurrent negotiations between FCC and one (1) or multiple Proponents, prior to awarding a Contract. MERX ELECTRONIC BIDDING SYSTEM • This Request for Proposals (RFP), including any attachments and amendments to such RFP, is available for download by the Proponent on MERX. MERX is a Canadian Public Tenders electronic bidding system accessible at https://www.merx.com. It is the sole responsibility of the Proponent to ensure its compatibility with MERX. • Proponent proposals MUST be submitted electronically through MERX, preferably in a PDF or MS Word file, prior to the RFP Closing Date/Time specified in the RFP. Proposals submitted in other formats, by other methods or through any other means, or after the RFP Closing Date/Time specified in the RFP, may be rejected by FCC. PRIORITY OF DOCUMENTS In the event there are any discrepancies between this opportunity notice and the information on the MERX website proper, this opportunity notice shall take precedence.Bidding and Documents are available on http://www.merx.com. Fees may apply; See https://www.merx.com/public/pricing for more information.