# GRC software: vendor-neutral RFP and assessment matrix

Original T-NEX working aid. Version: 11 September 2026. Edit locally; no information is transmitted to T-NEX.

## 1. Procurement context

- Institution / project / owner: [complete]
- Business processes and user groups: [complete]
- Service scope and explicit exclusions: [complete]
- Operating model, data types and integrations: [complete]
- Contractual/supervisory framework with rationale and source: [complete]
- Schedule, volumes and comparison period: [complete]

## 2. Request to all suppliers

Answer each criterion for the specific product version offered. Identify included functions, additional costs, development required and limitations. Refer to verifiable records or a demonstration.

| ID | Area | Request | Required evidence |
| --- | --- | --- | --- |
| RFP-01 | Business workflow | Show a requirement through to an action and its evidence in one workflow. | End-to-end demonstration using a case supplied by us. |
| RFP-02 | Scope | Which functions and datasets are included in the offer? | Service description with exclusions and required add-on modules. |
| RFP-03 | Roles and separation | How are editing, approval and independent review separated? | Permission matrix and a test using two distinct user roles. |
| RFP-04 | Change history | Which changes can later be traced to an actor and time? | Exported history and demonstrated handling of corrections. |
| RFP-05 | Sources and versions | How does an update preserve the origin of a requirement? | Before/after example with source, version and affected downstream work. |
| RFP-06 | AI assistance | Which output is a suggestion, who reviews it and what happens on failure? | Tests covering a supported answer, insufficient source and deliberately incorrect input. |
| RFP-07 | Integration | Which interfaces are available and included in the price? | Interface description, authentication and a reproducible failure case. |
| RFP-08 | Migration | How are existing records imported and reconciled? | Trial import, error report and reconciliation report. |
| RFP-09 | Register/export | Which specifically named register or reporting requirement is supported? | Export file, version identification and appropriate validation result. |
| RFP-10 | Operations | Where is data processed and who can access it during support? | Actual data flow, operating locations, subcontractors and access design. |
| RFP-11 | Security | How do identity management, logging, updates and recovery work? | Evidence covering the offered scope and a recovery test, not just a logo. |
| RFP-12 | Continuity | Which outage and recovery objectives are agreed? | Agreed targets, test scope, latest result and open remediation. |
| RFP-13 | Privacy/contracts | Which terms apply to this specific service and data arrangement? | Contract draft with clear annexes, roles and outstanding deviations. |
| RFP-14 | Audit rights | Which information, access and audit rights are contractually committed? | Specific clauses and procedures, including their reach across subcontractors. |
| RFP-15 | Exit | How can complete, readable data and evidence be returned? | Trial export and handover plan with timelines, costs and deletion confirmation. |
| RFP-16 | Cost | What costs arise across implementation, operation and exit? | Comparable total-cost plan including assumptions, volume drivers and change effort. |

## 3. Assessment per supplier

Before responses arrive, set must/should, weight 1–5 and exclusion effect. Scale: 0 = not met; 1 = claimed only; 2 = partially evidenced; 3 = appropriately evidenced. Exclude non-applicable criteria with reasons. Weighted points = weight × score. A high total cannot replace missing mandatory evidence.

| ID | Must/should | Weight | Response/evidence | Score 0–3 | Open question | Cost effect | Decision |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RFP-01 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-02 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-03 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-04 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-05 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-06 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-07 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-08 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-09 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-10 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-11 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-12 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-13 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-14 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-15 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| RFP-16 | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |

## 4. Decision record

- Supplier / version / offer date: [complete]
- Test cases performed and boundaries: [complete]
- Mandatory criteria met / open / unmet: [complete]
- Business, technical, legal and operating participants: [complete]
- Remaining deviations, actions and owners: [complete]
- Total cost and assumptions: [complete]
- Decision, rationale, date and authority: [complete]

The scoring scale is a T-NEX procurement suggestion, not a supervisory rating. This template does not replace assessment of the actual contract and operation.


## Sources and context

- [BaFin: MaRisk, Rundschreiben 06/2026 (BA), 30.06.2026, amtlicher Volltext bei der Bundesbank](https://www.bundesbank.de/resource/blob/825336/866a68577eb35afee82fbe60c39a4f87/472B63F073F071307366337C94F8C870/2026-06-30-rundschreiben-data.pdf)
- [Verordnung (EU) 2022/2554: DORA, insbesondere Artikel 11, 24 und 28–30](https://eur-lex.europa.eu/eli/reg/2022/2554/oj)