Cadent is seeking information from the market to understand available Governance, Risk and Compliance (GRC) SaaS solutions that can support both Enterprise Risk Management and Cyber Risk Management, as well as Internal Audit management. The purpose of this RfI / ROM is to explore supplier capability, solution fit, indicative implementation approach and timescales, licensing model, integration options, migration requirements and high-level ROM costs for a single GRC solution. The solution is expected to support the management of risks, controls, assurance activities (2nd line controls and 3rd line internal audits) issues, actions, exceptions, audits and reporting across Enterprise Risk Management and Cyber Risk Management. Cadent is particularly interested in understanding how suppliers can support a joined-up risk and control framework, aligned to Cadent’s governance structure and Three Lines Model, while also supporting key standards and regulatory frameworks such as NIS Regulations, CAF / eCAF, NIST 800-53, ISO27001 and Cyber Essentials+ and MITRE ATT&CK.

Procurement Act 2023

1. RFI Issue Date: 19 October 2026 2. Supplier Q&A Deadline: 23 October 2026 (Midday) 3. RFI Clarification Release: 30 October 2026 4. RFI Submission Deadline: 04 November 2026 (Midday)