Cyber Security is a top priority at PEBA. The Agency maintains a robust multilayered defensive cyber security posture. Internal staff is supplemented by regular external audit, vulnerability assessment and penetration testing. Recently a 3rd party external monitoring service was put in place to provide 24/7 detection and escalation of security events. The 3rd party monitoring was a recognition that as the security field is evolving very quickly, tapping into the expertise of large pools of external cyber expertise is a valid strategy for extending the capabilities of internal staff.

PEBA decided to measure its Enterprise Security Program against a best in class frame work. An external firm with expertise in security benchmarks measured PEBA’s Security Program effectives against the Canadian Center for Cybersecurity: Baseline Cybersecurity Controls Framework (Framework). The benchmarking exercise identified key priorities in some of the domain areas within the framework where there is opportunity to enhance the resilience of PEBA’s Enterprise Security Program. To address these findings in a timely manner, PEBA is looking to supplement its internal capabilities by tapping into an external pool of expertise that can assist PEBA staff to take the findings from the assessment, plan out a technical approach to address them and then assist with the coordination of the implementation activities. Within industry these services are referred to as Virtual Chief Information Security Officer Services (Virtual CISO). When the initial work is complete, subsequent cycles of operational review, planning, and coordination of implementation of findings may be requested.

While not the primary focus of the RFS, the capability to provide Cyber Security operations and technical support of operations are within the scope of capabilities and experience requested in this competition.