Cybersecurity Governance, Risk, and Compliance Solution

The Vendor is required to provide cybersecurity (GRC) governance, risk, and compliance solution that supports university enterprise risk management, third-party risk management, compliance, and governance processes across electric and water utility operations.
- Functional and non-functional requirements
1. Enterprise risk management
• Provide a centralized system of record for enterprise risks across it and business processes.
• Support the full risk lifecycle: allow assignment of risk ownership, track inherent and residual risk, and maintain historical records for audit and reporting purposes.
2. Risk assessment
• Support standardized and repeatable risk assessment processes, including preliminary risk assessments, threat-based risk assessments, and criticality or impact assessments.
• Support configurable scoring methodologies and automated documentation of assessment results.
3. Risk treatment & remediation
• Support documentation and tracking of risk treatment decisions, assignment of remediation actions, tracking of progress and validation of closure, and maintenance of audit-ready records of approvals and outcomes.
4. Enterprise risk register
• Maintain a centralized enterprise risk register that associates risks with assessments, assets, controls, remediation actions, and third parties, and supports filtering, reporting, and aggregation for management oversight.
5. Third party risk management
• Support identification, classification, and tiering of third parties; execution of third-party risk assessments during procurement and ongoing vendor management; centralized tracking of third- party risks and remediation; and correlation of third-party risks with enterprise risks.
6. External vendor risk intelligence integration
• Support integration with external third-party risk intelligence and monitoring tools, ingestion and tracking of vendor risk indicators, and correlation of external intelligence with internal risk assessments.
• Offer integrations with external third-party risk intelligence platforms (please specify if this functionality is provided through native, pre-built connectors or require custom integration using application programming interfaces (APIs).
7. Reporting and dashboards
• Provides configurable dashboards and reporting for executive, management, and operational users, support drill-down into detailed records, and enable scheduled and ad hoc reporting.