---
title: "GRC Enterprise & Cyber Risk Management RFI ROM"
ocid: "ocds-h6vhtk-078a4c"
canonical_url: "https://d3tenders.com/contract/?ocid=ocds-h6vhtk-078a4c"
markdown_url: "https://d3tenders.com/contract/ocds-h6vhtk-078a4c.md"
json_url: "https://d3tenders.com/contract/ocds-h6vhtk-078a4c.json"
source: "Find A Tender Service"
current_stage: "Planning"
buyer: "CADENT GAS LIMITED"
published: "2026-10-19"
---

# GRC Enterprise & Cyber Risk Management RFI ROM

Buyer: CADENT GAS LIMITED  
Current stage: Planning  
OCID: ocds-h6vhtk-078a4c

[View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-h6vhtk-078a4c)  
[Download OCDS JSON](https://d3tenders.com/contract/ocds-h6vhtk-078a4c.json)

## Summary

Cadent Gas Limited is exploring a single cloud-based Governance, Risk and Compliance (GRC) software service for enterprise risk management, cyber risk management and internal audit. The system is intended to manage risks, controls, assurance activity, issues, actions, exceptions and audits, and provide reporting across these areas. Cadent wants the solution to support a joined-up risk and control framework aligned with its governance structure and Three Lines Model. The work is a business software service covering risk management and related information systems. The buying organisation is Cadent Gas Limited, a private utility based in Coventry. The procurement is intended to address the organisation’s enterprise-wide governance, assurance and cyber risk needs.

This process is at planning: Cadent is seeking market information through a request for information and request for market (RFI/ROM), not inviting tenders. The engagement is intended to explore supplier capability and solution fit, implementation approach and timescales, licensing models, integration options, migration requirements and high-level costs. Cadent’s stated timetable anticipated issuing the RFI on 19 October 2026, supplier questions by midday on 23 October, clarification on 30 October, and RFI responses by midday on 4 November 2026. The planned contract period is 3 July 2027 to 2 July 2030. No procurement procedure, award method or contract value is set out at this stage; suppliers are being asked for indicative, high-level cost information.

This preparatory engagement is relevant to suppliers offering enterprise GRC software as a service, especially providers able to bring enterprise risk, cyber risk and internal audit management together in one solution. Cadent is looking for a joined-up risk and control framework that supports second-line controls and third-line internal audits, and fits its governance model. Suppliers should be ready to explain implementation approach and timescales, licensing, integration and migration, as well as provide high-level cost information. The solution is expected to support NIS Regulations, the Cyber Assessment Framework and enhanced CAF, NIST 800-53, ISO 27001, Cyber Essentials Plus and MITRE ATT&CK. Providers with experience mapping controls, assurance and reporting to these standards and frameworks are well placed to contribute useful market insight.

## Notice

Cadent is seeking information from the market to understand available Governance, Risk and Compliance (GRC) SaaS solutions that can support both Enterprise Risk Management and Cyber Risk Management, as well as Internal Audit management. The purpose of this RfI / ROM is to explore supplier capability, solution fit, indicative implementation approach and timescales, licensing model, integration options, migration requirements and high-level ROM costs for a single GRC solution. The solution is expected to support the management of risks, controls, assurance activities (2nd line controls and 3rd line internal audits) issues, actions, exceptions, audits and reporting across Enterprise Risk Management and Cyber Risk Management. Cadent is particularly interested in understanding how suppliers can support a joined-up risk and control framework, aligned to Cadent's governance structure and Three Lines Model, while also supporting key standards and regulatory frameworks such as NIS Regulations, CAF / eCAF, NIST 800-53, ISO27001 and Cyber Essentials+ and MITRE ATT&CK.

### Planning Information

1. RFI Issue Date: 19 October 2026
2. Supplier Q&A Deadline: 23 October 2026 (Midday)
3. RFI Clarification Release: 30 October 2026
4. RFI Submission Deadline: 04 November 2026 (Midday)

## Key Details

| Field | Value |
| --- | --- |
| Publication source | Find A Tender Service |
| Latest notice | https://www.find-tender.service.gov.uk/Notice/098276-2026 |
| Notice type | UK2 - Preliminary Market Engagement Notice |
| Procurement type | Standard |
| Procurement category | Services |
| Procurement method | Not Specified |
| Procurement method details | Not specified |
| Tender suitability | Not specified |
| Awardee scale | Not specified |
| All stages | Planning |

## Dates

| Field | Value |
| --- | --- |
| Publication date | 19 Oct 2026 |
| Submission deadline | Not specified |
| Future notice date | Not specified |
| Award date | Not specified |
| Contract period | 3 Jul 2027 - 3 Jul 2030 |
| Recurrence | Not specified |

## Values

| Field | Value |
| --- | --- |
| Tender value | Not specified |
| Lots value | Not specified |
| Awards value | Not specified |
| Contracts value | Not specified |

## Status

| Field | Value |
| --- | --- |
| Tender status | Planning |
| Lots status | Planning |
| Awards status | Not specified |
| Contracts status | Not specified |

## Buyer

| Field | Value |
| --- | --- |
| Main buyer | CADENT GAS LIMITED |
| Locality | COVENTRY |
| Postcode area | Coventry |
| Postcode | CV7 9JU |
| Country | England |
| ITL 1 | TLG West Midlands (England) |
| ITL 2 | TLG1 Herefordshire, Worcestershire and Warwickshire |
| ITL 3 | TLG13 Warwickshire CC |
| Local authority | Rugby |
| Electoral ward | Revel and Binley Woods |
| Westminster constituency | Rugby |
| Delivery location | Not specified |

## CPV Codes

### Divisions

- 48 - Software package and information systems
- 66 - Financial and insurance services

### Codes

- 48000000 - Software package and information systems
- 66517300 - Risk management insurance services

## Release History

- 19 Oct 2026 at 09:06 - Planning - UK2 - Preliminary Market Engagement Notice - https://www.find-tender.service.gov.uk/Notice/098276-2026

## Documents

- https://www.find-tender.service.gov.uk/Notice/098276-2026
  19th October 2026 - Preliminary market engagement notice on Find a Tender

## Notice URLs

- https://cadentgas.com/
- https://www.legislation.gov.uk/ukpga/2023/54/contents

## Provenance

This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-h6vhtk-078a4c. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-h6vhtk-078a4c.json.