GRC Tool as SaaS Solution for Governance, Risk, and Compliance Management

Provision, implementation, and operation of a web-based system (Software-as-a-Service, SaaS) for supporting and managing Governance, Risk, and Compliance (GRC) processes: The system supports GRC functions in Central Outsourcing Management (ZAM), Business Continuity Management (BCM), Information Security Management (ISM), and Non-Financial Risk (NFR). Implementation includes the functional and technical introduction into the existing system landscape, integration of existing systems and data sources, definition of data models, interface formats, and integration mechanisms (API-based, structured data imports such as file upload, CSV, Excel). Common standards (e.g., REST-based interfaces using HTTPS) must be supported, a prioritized bidirectional integration of CMDB ServiceNow is planned, and other systems will initially be connected via manual data provision (upload/download). The GRC system must connect existing data-holding systems without requiring their replacement, serve as a central control and evaluation platform for GRC-relevant information, and be able to map relationships between data objects (ICT assets, processes, risks, service providers); further items as per the tender documents.

Tender documents

Additional details