Tenders Are Invited For Software Package And Information Systems – Sourcing Notice Relating To The Provision Of Controls/Risk And Compliance Management (Grc) And Third-Party Risk Management (Tprm) Solutions To Meet The Potential Needs Of The La Poste Group

Software Package And Information Systems – Sourcing Notice Relating To The Provision Of Controls/Risk And Compliance Management (Grc) And Third-Party Risk Management (Tprm) Solutions To Meet The Potential Needs Of The La Poste Group. As Part Of Improving The Offering Of The Cybersecurity Department Of The La Poste Group, The La Poste Group Is Studying The Possibility Of Equipping Itself With A “Controls/Risk And Compliance Management (Grc) And Third-Party Supplier Risk Management (Tprm)” Tool. The Functional Scope Envisaged For The Solution Includes At Least The Following Areas: - Mapping Of Entities: Exhaustive List Of La Poste Group Entities By Branch And Subsidiary Including The Completeness Of The Information (E.G. Turnover, Number Of Employees, Location, Contacts, Etc.); - Cyber ​​Control Plan: Catalog And Management Of Controls, Self-Assessments And Evaluation Campaigns Whether Recurring Or One-Off; - Risk Management: Mapping Of Cyber Risks At Different Levels (Group, Branches, Subsidiaries, Processes, Projects, Systems, Third Parties). Periodic Assessment Of Cyber Risks And Management Of Treatment Plans; - Compliance Management: Reference Framework Of Regulatory, Normative And Internal Requirements. Monitoring The Level Of Compliance And Management Of Evidence; - Third Party Management: Third Party Repository And Assessment Of Their Risk Exposure (Questionnaires, Score, Remediation Plans, Periodic Reassessments) Over The Entire Life Cycle Of Supplier And Partner Relationships; - Recommendations And Action Plans: Provide Planning Tools Allowing Entities, On The Basis Of Analyzes And Recommendations, To Implement Remediation Plans; - Reports And Indicators: Production Of Consolidated And Homogeneous Dashboards And Indicators At All Functional And Organizational Levels Of The La Poste Group For The Various Governance Bodies. The La Poste Group Expects From The Supplier The Following Information Which Will Be Loaded Into The Dedicated Response Framework Under The La Poste Group Suppliers Platform: A Response File In French Including: A. Functional Requirements: - Governance; - Mapping Of Entities; - Cybersecurity Control Plan (Catalog Of Controls, Planning Of Control Campaigns, Collection Of Control Results And Status, Action Plans Associated With Controls); - Risk Management (Risk Modeling And Mapping, Risk Assessment, Risk Appetite And Acceptability Thresholds, Risk Treatment Plans, Monitoring And Consolidation Of Risks); Compliance Management (Management Of Normative And Regulatory Repositories, Mapping Of Compliance Obligations, Documentary Repository, Version And History Management, Evaluation And Monitoring Of The Level Of Conformity, Management Of Proof Of Conformity, Regulatory Management); - Third Party Management (Third Party Repository, Classification And Criticality Of Third Parties, Tprm Questionnaires And Assessments, Scoring And Summary Of Third Party Risk, Contractual Monitoring And Third Party Security Commitment, Action Plans And Reassessment