Federal_Resources_Corporation-FRC__Attachment_C_Functional_System_Compliance_Matrix.xlsx

XLSX spreadsheet 169 KB Posted Jan 1, 2026

Attached to: Governance, Risk and Compliance Tools
Contract number: 505ENT-M26-GRCTOOLS-01
Issued by: Wisconsin

About this file

Written by GovTribe AI · Jan 8, 2026

This document is a Functional System Compliance Matrix for a Request for Proposal (RFP 28433-SM) for Governance, Risk, and Compliance Tools, submitted by Federal Resources Corporation on 9/3/25. The document appears to be a detailed compliance matrix for a state government procurement process, specifically outlining technical requirements for a comprehensive governance, risk, and compliance software solution. The matrix covers multiple functional areas including Compliance Management, Risk Management, Audit Management, Incident Management, Policy Management, and Vendor Risk Management.

The proposed solution requires a robust software platform with capabilities to manage compliance frameworks, assess and track risks, facilitate audit processes, handle policy creation and distribution, monitor vendor risks, and provide advanced reporting and analytics. Key requirements include role-based access controls, encryption of data, customizable workflows, automated alerts, integration capabilities, and the ability to link artifacts across different compliance domains. The solution must support various regulatory frameworks such as IRS, SSA, GDPR, SOX, HIPAA, and PCI-DSS, with emphasis on scalability, flexibility, and comprehensive risk management features. While specific pricing is not detailed, the document indicates the solution should provide an affordable total cost of ownership and potential return on investment through process automation and risk mitigation.

View the file

Other files

File	Type	Posted
Federal Resources Corp. Pricing.xlsx	XLSX spreadsheet	Jan 1, 2026
RFP_28443-SM_Governance_Risk_and_Compliance_Tools.docx	DOCX document	Jan 1, 2026
FRC TrustCloud Terms of Service_12-10-2025 (002).pdf	PDF	Jan 1, 2026
Federal Resources Corp. Contract.pdf	PDF	Jan 1, 2026
Federal_Resources_Corporation-FRC_Section5_General_Requirements.pdf	PDF	Jan 1, 2026
Attachment_A_STATE_OF_WISCONSIN_SECURITY_RIDER.docx.pdf	PDF	Jan 1, 2026
Federal_Resources_Corporation-FRC_Section6_Technical_Requirements.pdf	PDF	Jan 1, 2026

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Instructions

RFP 28433-SM
Governance, Risk and Complicance Tools
Proposer:	Federal Resources Corporation
Date Submitted:	9/3/25

INSTRUCTIONS
1. Completion of the Functional System Requirements Compliance Matrix is mandatory.
2. Proposers shall respond only by marking "Yes" or "No" in response the specification as written. Proposers shall not provide any additional narrative response to the Functional Specifications document. Proposers may provide explanations for “No” answers as part of their response to the Proposal Requirements document. Instructions are provided in Section 7 of the Proposal Requirements document.
“Yes” indicating that the Proposer can certify the statement is true and that the requirement is currently available at the time Proposer’s response to the RFP is submitted to the State and any resulting Contract.
“No” indicating that the Proposer cannot certify the statement is true, the Proposer cannot meet the requirement, or the requirement is not available at the time of the Proposer’s Response to the RFP.
Proposers may provide explanations for "No" answers as part of their response to the Proposal Requirements Document. For any "No" answer, please explain why in the Additional Comments field next to the requirement.
3. As noted in the Functional Specifications document, these functional specifications describe the general, functional, and operational requirements of the desired system. While not a design, these specifications provide requirements for system architecture and performance including coverage, capacity, reliability, and interoperability. It also describes the key components of the System including the radio network, control equipment, dispatch consoles, and backhaul network.
§ The term “Contractor” refers to the prime contractor awarded this project and all subcontractors hired by the prime contractor.
§ All Request for Proposals (RFP) requirements apply equally to the prime contractor and all subcontractors, which are referred to as Contractor throughout the rest of this section.
4. The completed Compliance Matrix shall be submitted in Microsoft Excel format.
5. Proposers shall complete all the following worksheets in this Compliance Matrix:
	Compliance Management
	Risk Management
	Audit Management
	Incident Management
	Policy Management
	Vendor Risk Management

Solution Characteristics

Compliance Management

RFP 28443-SM

Governance, Risk and Complicance Tools

Federal Resources Corporation

Instructions

1. For each specification below, using an "X", indicate either "Yes" or "No" in the yellow cell. No other response or comment is permitted.

“Yes” means that the Proposer can certify the statement is true and that the requirement is currently available at the time Proposer’s response to the RFP is submitted to the State and any resulting Contract.

“No” means that the Proposer cannot certify the statement is true, the Proposer cannot meet the requirement, or the requirement is not available at the time of the Proposer’s Response to the RFP.

	Compliance Management		Proposer Response		Additional Comments
Section	System Requirements	Mandatory	Yes	No
1	Policy and procedure management	M	X
2	Automated compliance checks and alerts		X
3	Compliance tracking and reporting	M	X
4	Availability of government regulatory questionnaire templates	M	X
5	Ability to create and manage (add, edit, delete) a map of all compliance risks to required controls.	M	X
6	Identify gaps within a policy, control or regulation and link those to issue management.		X
7	Document and report due diligence and due care to strengthen comprehensive governance	M	X
8	Report action plans by status (open, complete, risk accepted) and responsibility.	M	X
9	Associate risks to controls, systems, and assets (e.g., what risks are associated with an asset, what compensating controls address a certain risk)	M	X
10	Assess compliance to policy and minimum standard requirements. Link these outcomes to Risk Control Self-Assessment (RCSA) and attestation outputs	M	X
11	Facilitate capturing certification and attestation of control design and effectiveness		X
12	Ability to directly and dynamically relate documents, assessments, attestations, test results, policies, etc., to laws, regulations, standards, and guidelines.	M	X
13	Ability to provide workflows specific to compliance.	M	X
14	Ability to identify mappings between multiple regulatory frameworks.	M	X
15	Assist in providing evidence of regulatory compliance.	M	X
16	Support for Regulatory Requirements: Ability to manage various local, regional, and international regulatory frameworks (e.g. IRS, SSA, GDPR, SOX, HIPAA, PCI-DSS)	M	X
17	Capability to define and tailor compliance frameworks to meet the organization’s specific needs and policies.	M	X
18	Manage controls with flexibility	M	X
19	Map controls across frameworks	M	X
20	Centralized repository for storing compliance-related evidence such as reports, audit results, and communications.	M	X
21	Evidence Retrieval: Searchable, easy-to-navigate evidence retrieval system.	M	X
22	Automate evidence collection		X
23	Regulation Tracking: Mechanism to track changes in regulations, standards, and legal requirements that impact the organization.		X
24	Automatic Updates: Automated alerts and notifications when regulatory changes are introduced.		X
25	Impact Assessment: Ability to assess the impact of regulatory changes on current policies and procedures.		X
26	KPI Monitoring: Key performance indicators (KPIs) to measure the effectiveness of compliance management efforts.	M	X
27	Be able to tie a compliance issue back to a specific area (Department, Division, other area as defined)	M	X
28	Solution allows artifacts to be uploaded or exported from the system individually and in bulk, if the user has permission to do so	M	X
29	Solution allows artifacts to be linked 1 to 1 and 1 to many to specfic controls, risks, issues, etc	M	X

Risk Management

RFP 28443-SM

Governance, Risk and Complicance Tools

Federal Resources Corporation

Instructions
1. For each specification below, using an "X", indicate either "Yes" or "No" in the yellow cell. No other response or comment is permitted.
“Yes” means that the Proposer can certify the statement is true and that the requirement is currently available at the time Proposer’s response to the RFP is submitted to the State and any resulting Contract.
“No” means that the Proposer cannot certify the statement is true, the Proposer cannot meet the requirement, or the requirement is not available at the time of the Proposer’s Response to the RFP.
	Risk Management		Proposer Response
#	Requirement	Mandatory	Yes	No	Additional Comments
1	Risk assessment and analysis tools	M	X
2	Risk scoring, prioritization, including rescoring (downgrading risk) due to the presence of mitigating controls	M	X
3	Risk ownership, and tracking from risk finding through remediation	M	X
4	Real-time risk monitoring and reporting	M	X
5	Quantitative Assessment		X
6	Exception Management Process	M	X
7	Import vulnerabilities	M	X
8	Notification process		X
9	Open API / scriptable		X
10	Available methodologies/frameworks for Risk Management Perspective	M	X
11	Ability to add custom methodologies/ frameworks from a Risk Management perspective (NIST, COBIT, etc)	M	X
12	Risk identification and reporting	M	X
13	Monitoring and management of risks	M	X
14	Support for Qualitative Risk Analysis	M	X
15	Ability to detect mitigating controls (identify available or recommend.	M	X
16	Ability to monitor losses, perform root cause analysis, monitor controls and improvements		X
17	Capability to monitor emerging risks, capture emerging risk ratings and identify when the risk will occur.		X
18	Dashboards for action overviews, risks, wasteful expenditures, project risks and emerging risks.	M	X
19	Associate risks to controls, systems, and assets (e.g., what risks are associated with an asset, what compensating controls address a certain risk)	M	X
20	Ability to track risks that are not directly cyber related. (Fraud, physical, etc)	M	X
21	Be able to tie a risk management issue back to a specific area (Department, Division, other area as defined)	M	X
22	Solution allows artifacts to be uploaded or exported from the system individually and in bulk, if the user has permission to do so	M	X
23	Categorize systems and common control providers	M	X
24	Selection of Security Controls	M	X
25	Implementation of Security Controls and Frameworks	M	X
26	Assess organizations, systems and common control providers	M	X
27	Authorize organizations, systems and common control providers	M	X
28	Continuous Monitoring of Security Controls	M	X
29	Generation of project artifacts - Plan of Action, Milestones, Burndown Chart, etc.	M	X		Since POAM and other types of documentation require a very specific template, TrustCloud does not create these documents by default. However, if we receive a template from a customer for any type of document, we can generate the project artifacts accordingly. Furthermore, TrustCloud continuously monitors the status of the POAM tasks to show real time residual risk levels.
30	Solution allows artifacts to be linked 1 to 1 and 1 to many to specfic controls, risks, issues, etc	M	X

Audit Management

RFP 28443-SM

Governance, Risk and Complicance Tools

Federal Resources Corporation

Instructions

1. For each specification below, using an "X", indicate either "Yes" or "No" in the yellow cell. No other response or comment is permitted.

	Audit Management		Proposer Response		Additional Comments
#	Requirement	Mandatory	Yes	No
1	Audit planning and scheduling	M	X
2	Automated evidence collection		X
3	Issue tracking and remediation	M	X
4	Create an audit trail of documentation.	M	X
5	Audit Checklist Management: Customizable and automatically generated checklists for audits based on specific regulations or compliance areas.	M	X
6	Be able to tie an audit issue back to a specific area (Department, Division, other area as defined)	M	X
7	Solution allows artifacts to be uploaded or exported from the system individually and in bulk, if the user has permission to do so	M	X
8	Solution allows artifacts to be linked 1 to 1 and 1 to many to specfic controls, risks, issues, etc	M	X

Incident Management

RFP 28443-SM
Governance, Risk and Complicance Tools	Add Optional Language

Federal Resources Corporation

Instructions

1. For each specification below, using an "X", indicate either "Yes" or "No" in the yellow cell. No other response or comment is permitted.

	Incident Management		Proposer Response
#	Requirement	Mandatory	Yes	No	Additional Comments
1	CSIRT incident response process management - tool facilitates management of IR process from Event Generation to Lessons Learned			X	TrustCloud is not an incident management system. We can integrate with existing Incident Management tools to bring in the data feeds and test if the process was followed.
2	Root cause analysis			X	As above
3	Reporting and documentation			X	As above
4	Strict confidentiality enforcement	M	X
5	Threat Intelligence Information		X
6	Feed from ITSM		X
7	Be able to tie an incident back to a specific area (Department, Division, other area as defined)	M	X
8	Solution allows artifacts to be uploaded or exported from the system individually and in bulk, if the user has permission to do so	M	X
9	Solution allows artifacts to be linked 1 to 1 and 1 to many to specfic controls, risks, issues, etc	M	X

Policy Management

RFP 28443-SM

Governance, Risk and Complicance Tools

Federal Resources Corporation

Instructions
1. For each specification below, using an "X", indicate either "Yes" or "No" in the yellow cell. No other response or comment is permitted.
“Yes” means that the Proposer can certify the statement is true and that the requirement is currently available at the time Proposer’s response to the RFP is submitted to the State and any resulting Contract.
“No” means that the Proposer cannot certify the statement is true, the Proposer cannot meet the requirement, or the requirement is not available at the time of the Proposer’s Response to the RFP.
	Policy Management		Proposer Response
#	Requirement	Mandatory	Yes	No	Additional Comments
1	Policy creation, review, and approval workflows	M	X
2	Version control and distribution tracking

tc={D75F0BE1-770C-444E-9CD4-D123913CC6DE}: [Threaded comment]

Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924

Comment:

@Matschull, Susanne - DOA being able track and record an agency users’ acknowledgement of reading a policy would be nice to have.	M	X	TrustCloud fully supports DOA being able to track and record an agency users' acknowledgement of reading a policy.
	3	Standards Repository / SOP Repository

tc={B4E1445E-2F71-4712-A315-11FD16D5B028}: [Threaded comment]

Comment:

@Matschull, Susanne - DOA these should be separate, as standards should be with the policy documents they drill down from and should be mandatory. Standard Operating Procedures would be a nice to have.		X	Associating standards with policy documents and drilling down is fully supported. SOP are also supported.
	4	Ability to filter and view policies by statically

or dynamically defined criteria such as business unit, geography,

impact area, role, etc.		X
	5	Ability for users to perform keyword searches to
find specific information among IT policies	M	X
	6	Be able to tie a policy issue back to a specific area (Department, Division, other area as defined)	M	X
	7	Solution allows artifacts to be uploaded or exported from the system individually and in bulk, if the user has permission to do so	M	X
	8	Solution is able to tie policy statements back to control frameworks and define gaps in policy to specific control framework requirements.

tc={FFD105C1-ECCD-4032-B0DA-8EBAB5142D60}: [Threaded comment]

Comment:

@Matschull, Susanne - DOA I have added this one. I am not sure if there is a IRM solution out there that does this… but it would save a LOT of work if one does!!!

tc={D75F0BE1-770C-444E-9CD4-D123913CC6DE}: [Threaded comment]

Comment:

@Matschull, Susanne - DOA being able track and record an agency users’ acknowledgement of reading a policy would be nice to have.

tc={B4E1445E-2F71-4712-A315-11FD16D5B028}: [Threaded comment]

Comment:

@Matschull, Susanne - DOA these should be separate, as standards should be with the policy documents they drill down from and should be mandatory. Standard Operating Procedures would be a nice to have.		X		Tying policy statements back to control frameworks and define gaps in policy to specific control framework requirements is fully supported. It is a key differentiator of TrustCloud.
	9	Solution allows artifacts to be linked 1 to 1 and 1 to many to specfic controls, risks, issues, etc	M	X

@Matschull, Susanne - DOA being able track and record an agency users’ acknowledgement of reading a policy would be nice to have.

@Matschull, Susanne - DOA these should be separate, as standards should be with the policy documents they drill down from and should be mandatory. Standard Operating Procedures would be a nice to have.

@Matschull, Susanne - DOA I have added this one. I am not sure if there is a IRM solution out there that does this… but it would save a LOT of work if one does!!!

Vendor Risk Management

RFP 28443-SM

Governance, Risk and Complicance Tools

Federal Resources Corporation

	Instructions
	1. For each specification below, using an "X", indicate either "Yes" or "No" in the yellow cell. No other response or comment is permitted.
	“Yes” means that the Proposer can certify the statement is true and that the requirement is currently available at the time Proposer’s response to the RFP is submitted to the State and any resulting Contract.
	“No” means that the Proposer cannot certify the statement is true, the Proposer cannot meet the requirement, or the requirement is not available at the time of the Proposer’s Response to the RFP.
		Vendor Risk Management		Proposer Response
	#	Requirement	Mandatory Requirement	Yes	No	Additional Comments
	1	Assessment of third-party risks	M	X
	2	Automated vendor evaluation and scoring		X
	3	Continuous monitoring of vendor compliance		X
	4	Notification of significant posture change in monitored vendor		X
	5	Reports depicting all of the documented third party relationships and their organizational structure (parent, subsidiary, sub-subsidiary)		X
	6	Reports of all third party relationships by assigned business
unit manager, procurement manager, and risk analyst		X
	7	Reports of third party relationships with a

description of the relationship, primary contact information and

details about the relationship	M	X
	8	Ability to uncover deteriorating third party performance trends		X
	9	Be able to tie a vendor risk issue back to a specific area (Department, Division, other area as defined)	M	X
	10	Solution allows artifacts to be uploaded or exported from the system individually and in bulk, if the user has permission to do so	M	X
	11	Solution allows artifacts to be linked 1 to 1 and 1 to many to specfic controls, risks, issues, etc	M	X

Solution Characteristics

RFP 28443-SM

Governance, Risk and Complicance Tools

Federal Resources Corporation

Instructions

1. For each specification below, using an "X", indicate either "Yes" or "No" in the yellow cell. No other response or comment is permitted.

	Solution Characteristics		Proposer Response		Additional Comments
#	Requirement	Mandatory	Yes	No
	General Characteristics
1	Scalability to accommodate all agencies	M	X
2	Flexibility to adapt to various frameworks and allow customization to meet unique business needs	M	X
3	Integration Capabilities that provide seamless integration with existing systems.		X
4	User-friendly interface offering easy navigation for by users with different technical skills.	M	X
5	Ability to migrate data from a variety of other system types.		X
6	User alerts when tasks need to be performed.	M	X
7	Standardized templates for different functions/areas.	M	X
8	Access from anywhere using mobile devices such as iPad, tablet, mobile phone, etc.			X	TrustCloud's UX has not been optimized for non-desktop access because this is not a workflow that security and GRC practitioners need.
9	Compatability with emerging technologies such Artificial Intelligence, Robotics Process Automation and Blockchain.		X
10	Built in workflows for current follow-up and escalation processes	M	X
11	Solution available in both SaaS/cloud and on-premises options.			X	TrustCloud is a SaaS-based offering only.
	Security and Data Protection
12	Create Custom role-based access controls (RBAC) to align feature and data access with user roles.

tc={0B3C2137-7799-416A-92B1-BE88864F0BE8}: [Threaded comment]

Comment:

@Matschull, Susanne - DOA this needs to include the ability to create custom roles and groups of users to facilitate the isolation of disparate agencies’ risk data.	M	X
	13	Encryption of data at rest and in transit.	M	X
	14	Compliance with relevant data protection regulations	M	X
	15	Audit Trails supported by logs of user actions and changes for traceability.	M	X
		System Security Plans
	16	System Description		X		Since some elements of SSPs are very specific pieces of information, TrustCloud does not generate these parts of the SSP documents and data by default. However, if a customer provides TrustCloud with a preferred SSP template, this information can be generated by TrustCloud.
	17	Roles and Contacts		X		As above
	18	System diagrams (boundary, network, data flow, and directionality)		X		As above
	19	Ports, Protocols and Services		X		As above
	20	System Interconnections including services, subsystems, & components		X		As above
	21	Selected Baselines and Frameworks		X
	22	Inventory		X
	23	Control Status	M	X
		Reporting and Analytics
	24	Customizable Dashboards with Real-time visibility into GRC metrics and KPIs, with access to data based on assigned role.	M	X
	25	Automated Reporting with scheduled and on-demand reports/dashboards for management, compliance, and audit purposes.	M	X
	26	Data Visualization that includes charts, graphs, and heat maps to represent risk and compliance data visually.		X
		Stakeholder Engagement
	27	User Training and Support	M	X
	28	User feedback mechanism for collecting and incorporating feedback from end-users.		X
		Budget and Cost Considerations
	29	Affordable Total Cost of Ownership (TCO): Evaluate licensing costs, implementation fees, customization costs, and maintenance expenses.	M	X
	30	Return on Investment (ROI): Estimate potential cost savings from process automation, reduced audit fees, and risk mitigation.	M	X
	31	A solution that fits our budget.Determine if the pricing is based on user count, features, or usage volume.	M	X
		Automation and Workflow Management
	32	Automated Alerts and Notifications: Automated reminders for compliance deadlines, audits, certifications, and training.	M	X
	33	Workflow Automation: Customizable workflows for managing tasks such as compliance assessments, remediation plans, and approval processes.	M	X
	34	Task Management: Tools for assigning and tracking compliance-related tasks.	M	X
	35	Mature API support with robust features		X
	36	Solution allows artifacts to be uploaded or exported from the system individually and in bulk, if the user has permission to do so	M	X
	37	Solution allows artifacts to be linked 1 to 1 and 1 to many to specfic controls, risks, issues, etc	M	X
	38	Moderate Fedramp Certification is required for cloud Saas option is Preferred.	M		X	TrustCloud's architecture allows for running on GovCloud, and testing and retaining the data within the agency's authorized boundary. Since we do not store any Federal data, we not fall under the FedRAMP requirements.

Based on the official FedRAMP guidance on how to classify "External Services" used by the Cloud Service Provider (CSP) to deliver and maintain its Cloud Service Offering (CSO), and determine the scope and authorization boundary for the External Service - The GRC solution for the State of Wisconsin will be classified as an External Service that is part of the authorization boundary of State of Wisconsin. However, since GRC platforms (the External Service) will only process (or can be architected to only process) "indirect-impact metadata" - such as the compliance controls, policies, risks, etc. - this indirect-impact metadata needs to only reside in a system that is maintained to adhere to security requirementes that are commensurate with NIST SP 800-171 (wiothout having FedRAMP as a requirement, due to the "indirect-impact metadata" data classification). For clarity and for the avoidance of doubt, "direct-impact metadata", such as vulnerability information, active incident response information and communications, active threat assessment, penetration test results, etc. can be architected to not be stored or processed in a GRC platform like TrustCloud - which means that the GRC platform does not have to be FedRAMP compliant.

As shown above, FedRAMP is not a requirement for a GRC platform, however, proving adherence to NIST SP 800-171 is. TrustCloud can meet and exceed Wisconsin's security needs without FedRAMP authorization. Our product and internal security controls are aligned with widely accepted standards, such as NIST SP 800-171 and NIST SP 800-53, which are the foundational frameworks for FedRAMP. TrustCloud has implemented a continuous control monitoring environment to monitor all its controls. In addition, TrustCloud has achhieved a successful SOC 2 attestation and ISO 27001 certification. TrustCloud can easily demonstrate that it has established protocols for data encryption, access control, and continuous control monitoring that ensure risk is mitigated effectively and transparently. We are prepared to transparently and comprehensively provide extensive proof, documentation, and third-party assessments to demonstrate our strong security posture.

	Dashboard
39	Enterprise Dashboard across organizations, systems and common control providers with isolation for agency specific data & RBAC	M	X
40	Operation Dashboard for individual organizations, systems and common control providers	M	X
41	Generate a dashboard to report on a single or all package statuses	M	X
42	Notify internal, external stakeholders, as well as stakeholder groups, of changes, status updates and other important notifications		X
43	Assign a task or package to an internal or external stakeholder with notification.	M	X
	Collobration
44	Automate workflow processes	M	X
45	Integrate with automated validation rules to enable pass/fail automated review and generate reports to users.

tc={87F47F44-7B7D-4EAB-B543-8532024918CE}: [Threaded comment]

Comment:

@Matschull, Susanne - DOA this should include an automated customizable form as an entry point to processes like assessments. This will help ensure the correct scope of project based security assessments.

tc={0B3C2137-7799-416A-92B1-BE88864F0BE8}: [Threaded comment]

Comment:

@Matschull, Susanne - DOA this needs to include the ability to create custom roles and groups of users to facilitate the isolation of disparate agencies’ risk data.	M	X			security validation form
	46	Enable simultaneous reviews	M	X
	47	Enable users on review teams to track notes and rationale for review.		X
	48	Track package progress (e.g. schedule, performance, etc.)	M	X
	49	Access previous versions of a package.	M	X
	50	Facilitate and track updates by external stakeholders.	M	X
	51	Import or manage diagrams in PDFs and search keywords within them.	M	X

@Matschull, Susanne - DOA this needs to include the ability to create custom roles and groups of users to facilitate the isolation of disparate agencies’ risk data.

File details come from the government source that posted it. Updated Jan 8, 2026.