Enterprise Governance, Risk, and Compliance (GRC) Solution & IT/OT Risk Management Professional Services

Queen Anne's County is seeking a comprehensive Enterprise Governance, Risk, and Compliance (GRC) Solution along with professional services to enhance its IT and Operational Technology (OT) risk management capabilities. The procurement focuses on acquiring a sophisticated IT GRC tool and associated implementation services that will help the county develop and refine its risk management strategies across traditional IT and operational technology infrastructures. The primary objective is to create a full IT/OT Risk Management Plan that integrates with existing county policies and procedures. The solicitation was posted on September 22, 2025, with proposals due by October 3, 2025, indicating a relatively tight procurement timeline of approximately 11 days. Potential vendors must demonstrate expertise in developing comprehensive risk management frameworks, understanding both information technology and operational technology environments, and providing scalable solutions that can adapt to the county's specific technological ecosystem. Successful respondents will need to showcase their ability to not only provide a technical solution but also offer professional services that can guide the implementation and integration process.

While specific set-aside designations are not explicitly detailed in the provided information, the procurement appears to be open to qualified vendors with demonstrated expertise in enterprise GRC solutions and IT/OT risk management. The procurement does not specify incumbent vendors or existing technological infrastructure that might require integration. No specific budget range or award value was disclosed in the available documentation. Potential respondents should anticipate a competitive selection process that will likely evaluate technical capabilities, implementation approach, solution scalability, and overall alignment with Queen Anne's County's risk management objectives. Vendors will need to demonstrate a comprehensive understanding of both IT and operational technology risk management principles, with a proven track record of successful implementations in similar government or public sector environments.