The Executive Office of Technology Services and Security is seeking a SaaS solution for privacy impact assessments and incident management. The solution should include features such as privacy impact assessment capabilities, data flows and asset cataloging, incident reporting and tracking, and compliance and reporting. The solution must be cloud-based and must not require internal hardware to be purchased to support it. The contract will have an initial term of 36 months, with the option to renew or extend. Bidders must submit their responses through the Commonwealth's online procurement system, COMMBUYS. Key features and requirements of the solution include: • Ability to create, manage, and store PIAs • Pre-built templates for different types of PIAs • Customizable workflows and templates • Capability for both manual and automated risk assessment and scoring • Integration with existing data sources to pull relevant information • Workflow management for review and approval processes • Ability to provide questionnaires to third-parties and intake their answers without forcing them to create an account • Real-time collaboration features for multiple stakeholders • Ability to search PIA data for specific vendors, products, dependencies, and risk factors • Data encryption at rest and in transit • Role-based access control • Solution should not require internal hardware to be purchased to support the solution • Guarantee that Commonwealth's data will not be stored (nor accessed from) outside the United States