Data Security Posture Management Solution

INVITATION TO INTERESTED PROPONENTS

Introduction

The purpose of this request for proposals (the “RFP”) is to invite qualified companies or organizations (the “Proponent”) to submit proposals to supply, implement and support a Data Security Posture Management solution (the “DSPM”) for the City of Surrey (the “City”). The proposed solution is expected to enable the discovery, classification, and continuous assessment of sensitive data across cloud, Software‑as‑a‑Service (“SaaS”), and on‑premises environments.

The three schedules referenced in this Invitation to Interested Proponents are provided as separate attachments. For clarity these are:
• Schedule 1 – Technical Environment and Preliminary Scope;
• Schedule 2 – RFP document; and
• Schedule 3 – Confidentiality and Non-Disclosure Agreement.
 Schedule 1 provides high-level information regarding the City’s current technical environment and preliminary scope considerations. It is provided for informational purposes only and is intended to assist Proponents in understanding the City’s general environment and objectives. The detailed scope, requirements, and obligations will be set out in the final RFP documents issued by the City.

Schedule 2 contains the RFP for this project, excluding the Information Meeting, Scope of Services, and DSPM Requirements Response form.

Schedule 3 contains the City’s Confidentiality and Non‑Disclosure Agreement (the “NDA”), which must be executed by Proponents as a condition of participation in order to access confidential portions of the RFP, receive RFP‑related communications, and be eligible to submit a proposal.

Participation Requirement

Certain portions of the RFP have been designated as confidential and are not being released at this time. Access to the confidential portions of the RFP will be provided only to those Proponents who have completed and submitted the City’s NDA.

As a condition of participation, and in consideration of the City issuing the RFP and disclosing confidential information for the purposes of the RFP, all Proponents are required to execute and submit the City’s NDA. The NDA must be executed by a duly authorized signatory with authority to bind the Proponent and each member of the Proponent’s team. For greater certainty, the authorized signatory may be different from the Proponent’s designated representative(s).

The City will not release the confidential portions of the RFP to any Proponent who has not submitted a fully executed Confidentiality and Non-Disclosure Agreement. RFP responses will not be accepted from any Proponent that has not complied with this requirement. Any unauthorized disclosure by a Proponent of confidential RFP information to a person or entity that has not executed the Confidentiality and Non-Disclosure Agreement may result in disqualification of the Proponent’s submission.

All inquiries received by the City in relation to the RFP, including requests for clarification and any resulting amendments or addenda to the RFP documents, will be addressed and distributed solely to those Proponents who have executed and submitted Schedule 3. Inquiries related exclusively to the invitation process, may be considered by the City and, where applicable, responses may be posted publicly on the City’s website as part of this invitation.

The City would prefer to receive the NDA on or before May 15th, 2026.

All inquiries related to this RFP should be directed in writing to purchasing@surrey.ca