Want to work with the Canadian federal government as a SaaS vendor? To qualify for SaaSSA, Public Services and Procurement Canada‘s (PSPC) procurement framework, you need to meet specific criteria across two phases:
- Submit a Request for Supply Arrangement (RFSA): This is your first step to getting pre-qualified.
- Bid on contracts: Once pre-qualified, government departments can invite you to submit proposals.
Here’s what you’ll need:
- Certifications: Depending on the security stream (Protected B, Protected A, or Unclassified), certifications like ISO/IEC 27001, SOC 2 Type II, and others may be required.
- Security Clearances: Your organization and personnel must pass screenings, including Designated Organization Screening (DOS) and Document Safeguarding Capability (DSC).
- Bilingual Support: All federal contracts require English and French support, as per Canada’s Official Languages Act.
- Supply Chain Security: Compliance with standards like ISO/IEC 27036 or NIST 800-161 is critical for Protected A and B streams.
Security assessments are conducted every six months, so early preparation is key. Tools powered by AI can help simplify compliance by automating document preparation and tracking deadlines.
Why qualify? SaaSSA ensures visibility among federal buyers, streamlines procurement, and validates your security measures, opening doors to exclusive contracts.
Keep reading for a detailed step-by-step guide to applying, meeting compliance standards, and maintaining your SaaSSA qualification.
What is SaaSSA and Why Does It Matter?
SaaSSA Definition and Scope
SaaSSA, overseen by Public Services and Procurement Canada (PSPC), is a framework designed to pre-qualify SaaS vendors for federal contracts, aligning with the Government’s "Cloud First" strategy. This initiative focuses on software applications that support both service delivery and back-office operations. Meanwhile, Shared Services Canada (SSC) handles infrastructure-related services such as IaaS, PaaS, and workplace-specific SaaS.
The framework organizes solutions into four security streams based on the sensitivity of the data they handle:
- Stream 1: Protected B, for SaaS publishers.
- Stream 2: Protected A, for SaaS publishers.
- Stream 3: Protected A, for value-added resellers (VARs).
- Stream 4: Unclassified, applicable to both publishers and VARs.
Higher security levels, like Stream 1, demand certifications such as ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27001, and SOC 2 Type II. In contrast, Stream 4 focuses on technical and financial evaluations, with security reviews conducted by the client.
By establishing pre-negotiated terms, SaaSSA streamlines the contracting process and reduces administrative burdens. Once your company qualifies, its legal name is listed in search results when government clients seek solutions matching their needs. Federal departments generally invite at least two pre-qualified suppliers for competitive RFPs. This approach not only simplifies procurement but also fosters trust, as highlighted in the benefits below.
Benefits of Qualifying for SaaSSA
Qualifying for SaaSSA opens doors to federal procurement opportunities where bids are solicited exclusively from the pre-qualified pool. Pre-negotiated terms further expedite deal closures.
Another key advantage is the validation of your security measures. The Canadian Centre for Cyber Security (CCCS) performs Information Technology Security (ITS) and Supply Chain Integrity (SCI) assessments for Streams 1, 2, and 3. These evaluations occur in waves approximately every six months. Successfully passing these assessments not only ensures compliance with federal standards but also sets your solution apart from competitors.
Eligibility Requirements for Vendors
Required Certifications and Standards
The certifications you’ll need depend on the security stream you’re targeting. For Stream 1 (Protected B), the requirements are the most stringent, including ISO/IEC 27001:2013, SOC 2 Type II, ISO/IEC 27017:2015, and ISO/IEC 27018:2014. Additionally, you must ensure supply chain security through standards like ISO/IEC 27036, NIST 800-161, or ITSG-33.
For Streams 2 and 3 (Protected A), you must obtain either ISO/IEC 27001 or SOC 2 Type II, along with the Cloud Security Alliance (CSA) CCM version 3.01 or later. Stream 3 specifically applies to value-added resellers handling Protected A information. Stream 4 (Unclassified) operates differently, as individual client departments conduct their own security assessments instead of requiring centralized review by the Canadian Centre for Cyber Security (CCCS).
In addition to these certifications, you’ll need Designated Organization Screening (DOS) and Document Safeguarding Capability (DSC) clearances through the Contract Security Program. Personnel with privileged access will also need individual screenings. If you don’t already have a sponsor for these clearances, you can contact the SaaSSA authority for sponsorship. Finally, your business must be registered in the Supplier Registration Information (SRI) system, which serves as your unique identifier for federal transactions.
Bilingual Support Requirements
Compliance with bilingual requirements is another critical aspect. Under Canada’s Official Languages Act, any procurement with national scope requires documentation and support in both English and French. This is non-negotiable for federal contracts. You’ll also need to complete Annex D: SaaS solution service level agreements (SLA) for all four streams, detailing your service and support standards in both official languages.
For customer support operations, this means your team must be equipped to handle inquiries, provide documentation, and offer technical assistance in both languages. If you currently operate only in English, you’ll need to expand your support capabilities before applying.
Supply Chain Security Assessments
Supply chain security plays a crucial role in the qualification process. The CCCS conducts Information Technology Security (ITS) and Supply Chain Integrity (SCI) assessments for Streams 1, 2, and 3. These assessments are conducted in six-month waves, aligned with CanadaBuys timelines. Missing a deadline could delay your qualification by six months.
To succeed in the SCI assessment, you’ll need to demonstrate compliance with standards like ISO/IEC 27036 (focused on supplier relationships) or NIST Special Publication 800-161 (covering supply chain risk management practices). If you already have an SSC invitation to qualify (ITQ) pre-qualified cloud service provider assessment report, attaching it to your submission can strengthen your application.
The process is designed to be collaborative. If your initial submission is incomplete, PSPC or CCCS will give you a chance to provide additional documentation or clarifications, rather than rejecting your application outright. However, meeting the wave deadlines is essential to avoid delays in the qualification process.
How to Apply for SaaSSA: Step-by-Step Process
How to Respond to RFSA Postings on CanadaBuys
The SaaSSA qualification process has two main phases: first, vendors must meet the requirements outlined in the RFSA to obtain a Supply Arrangement (SA). Once qualified, government departments can invite bids from this pool of suppliers. While qualification opportunities are always available, security onboarding happens in cycles, roughly every six months.
To get started, download the RFSA and any related amendments from CanadaBuys. Carefully review all attachments, including Q&A documents and update notices. Submissions can be made via email or through the Bid Receiving Unit using epost Connect.
Before submitting, complete Form 5 (Submission Completeness Review Checklist) to ensure all required technical and financial documents are included. If anything is missing, PSPC or CCCS will ask for clarifications instead of rejecting your submission outright. However, missing a security assessment deadline could delay your qualification by up to six months.
After submitting your RFSA, focus on keeping your CPSS profile updated to maintain visibility with government buyers.
Keeping Your CPSS Supplier Profile Updated
The CPSS ePortal is the platform where government buyers search for pre-qualified suppliers. To stay visible in the right categories, regions, and security levels, regularly update your profile using the Data Collection Component (DCC). Features like the Grandfather Certification allow you to reuse previously submitted data, streamlining updates. Make sure to obtain a Procurement Business Number (PBN) through the SRI system and keep your contact details current in the Supplier Module, following the PSPC guide. Keeping your profile accurate is just as important as submitting a compliant application when working to meet federal requirements.
Showing Relevant Project Experience
When preparing your technical submission, align it with Annex A requirements for Tier 1 (Protected A) or Tier 2 (Protected B). PSPC evaluates financial viability and project experience on an ongoing basis. For Tier 2 submissions, highlight your experience handling sensitive data and meeting higher security standards.
Make sure to include all required forms in your submission. These include Form 1 (RFSA Submission Form), Form 2 (Publisher Certification), and Form 5 (Completeness Checklist). You’ll also need Annex D, which outlines bilingual SLAs and price support documentation. If you’re a value-added reseller applying under Stream 3, include Form 3 (SaaS Publisher Authorization Form) as well. Begin security screenings for both your organization and personnel as soon as possible, as these clearances must be completed before an SA can be issued.
Webinar – All you need to know about Government Procurement in Canada
sbb-itb-e60d259
SaaSSA Security Streams and Contract Value Limits
SaaSSA Security Streams and Requirements Comparison Chart
SaaSSA classifies vendors into four security streams, each tailored to the sensitivity of the data involved and the vendor’s role.
- Stream 1: Reserved for SaaS publishers handling Protected B information, the highest security level. Vendors must meet Tier 2 qualification standards.
- Stream 2: For publishers managing up to Protected A data, requiring Tier 1 standards.
- Stream 3: Designed for value-added resellers (VARs) working with Protected A solutions. However, VARs cannot qualify for Protected B projects.
Stream 4 functions differently. It includes both publishers and VARs dealing with unclassified information. Here, the client departments manage IT Security and Supply Chain Integrity assessments instead of relying on centralized CCCS reviews. This means you’ll coordinate directly with the purchasing department for security requirements, bypassing CCCS assessment cycles.
For Streams 1, 2, and 3, the CCCS conducts security assessments in waves approximately every six months. To secure a Supply Arrangement, vendors must have valid Designated Organization Screening (DOS), Document Safeguarding Capability (DSC), and personnel security clearances for individuals with privileged access. These stream structures are vital for understanding the contractual limits and compliance requirements outlined below.
Contract Value Limits by Tier
Once your security stream is determined, contract value limits define your procurement options.
- Tier 1: Allows direct awards or simplified bidding for contracts up to $3,750,000.
- Tier 2: Requires competitive bidding for contracts exceeding that amount.
It’s important to note that these procurement tiers differ from the qualification tiers (Tier 1 for Protected A, Tier 2 for Protected B) specified in your RFSA submission.
| Procurement Tier | Award Method | Contract Value Limit |
|---|---|---|
| Tier 1 | Direct Award / Sole Source | Up to $3,750,000 |
| Tier 2 | Competitive Bidding | Exceeding $3,750,000 |
To maximize your opportunities, ensure you select the appropriate stream and meet the necessary certifications. If you’re a VAR aiming for Protected B projects, you’ll need to collaborate with a qualified publisher or rethink your approach, as Stream 1 explicitly excludes resellers.
Meeting Compliance Requirements and Using AI to Simplify the Process
Compliance and Reporting Requirements
Maintaining continuous compliance is key to keeping your SaaSSA qualification intact. Achieving the qualification is just the start – vendors must meet ongoing supply arrangement reporting obligations, including submitting usage data regularly as outlined in the federal Supply Manual. These obligations are tied to CCCS assessment cycles, requiring vendors to align their reporting and documentation schedules accordingly.
Security clearances are another critical piece. This includes keeping Designated Organization Screening (DOS), Document Safeguarding Capability (DSC), and personnel screenings for privileged access up to date. Missing deadlines for documentation or failing to renew clearances can result in corrective actions. For Stream 4 vendors, the process differs slightly – security assessments are handled by individual client departments instead of CCCS, meaning compliance must be coordinated directly with those purchasing departments.
With tight deadlines and complex requirements, automating these tasks has become more of a necessity than a luxury.
How AI Tools Simplify SaaSSA Applications
SaaSSA compliance can feel like a mountain of administrative work. From tracking assessment cycles to maintaining certifications and generating quarterly reports, it’s a lot to manage. That’s where AI tools come in, offering a way to streamline the process. By automating tasks like document preparation, compliance monitoring, and data collection, AI-native platforms can significantly reduce the workload.
For example, AI tools can match your existing certifications to RFSA requirements, flag upcoming deadlines, and automatically pull the necessary usage data. In 2025, SolarEdge adopted Reco.ai’s platform to manage SaaS security. Tomer Stenzler, Director of Cyber Security, reported that the tool cut false positives and saved over 50% of the security team’s time, allowing them to focus on more strategic initiatives.
"AI is an intelligent assistant designed to empower your compliance team by providing faster, more detailed insights to your decision-making loop." – Micah Spieler, Chief Product Officer, Strike Graph
Supportbench is another example of how AI can simplify compliance. Its built-in automation tracks documentation, generates audit-ready case summaries, and monitors customer activity. This helps vendors meet SaaSSA requirements without the need to expand their teams. By embedding AI tools directly into case management and reporting workflows, Supportbench allows vendors to manage compliance effectively while keeping operational costs in check. Unlike older platforms where AI features often come with additional fees, Supportbench integrates these tools as part of its core functionality, making compliance easier and more cost-efficient.
Conclusion
Navigating the SaaSSA qualification process requires careful planning and timely action. To qualify, vendors must meet specific criteria through a two-phase process: first, pre-qualify by responding to the Request for Supply Arrangement (RFSA) on CanadaBuys, and second, bid on individual contracts. This involves submitting required forms, holding essential security certifications like ISO/IEC 27001 and SOC 2 Type II, and maintaining organizational screenings such as Designated Organization Screening (DOS) and Document Safeguarding Capability (DSC). If there are gaps in documentation, PSPC or CCCS will provide an opportunity to address them.
Once qualified, vendors must adhere to ongoing requirements. For example, quarterly usage reports are mandatory, and failure to submit them can result in suspension or cancellation of the supply arrangement. Starting security screenings early is crucial to prevent delays caused by pending personnel or organizational clearances.
To simplify compliance, tools powered by AI can be a game-changer. These tools can automate document preparation, track compliance deadlines, and produce audit-ready reports. Supportbench, for instance, integrates these features into case management and reporting workflows, reducing administrative tasks and helping to manage costs efficiently.
FAQs
What advantages do vendors gain by qualifying for Canada’s federal SaaS Supply Arrangement (SaaSSA)?
Securing a spot in Canada’s federal SaaS Supply Arrangement (SaaSSA) can open up significant opportunities for vendors looking to work with the government. By becoming pre-approved, vendors gain access to a streamlined procurement process that reduces administrative burdens and speeds up contract awards. This arrangement creates a pool of trusted suppliers, giving vendors a chance to tap into federal procurement opportunities under consistent terms and conditions. Plus, being on this list can boost a vendor’s visibility and reputation within the government sector.
SaaSSA also emphasizes efficiency and cost-effectiveness. It eliminates the need for repetitive negotiations on every contract, fostering a competitive environment among pre-qualified suppliers. For vendors, this isn’t just about winning contracts – it’s about building lasting relationships with the federal government. It’s a chance to showcase cutting-edge, AI-powered solutions that meet the evolving needs of government operations, positioning vendors for long-term success.
How does offering bilingual support affect SaaSSA qualification?
Offering bilingual support in both English and French can enhance a vendor’s chances of qualifying for Canada’s federal SaaS Supply Arrangement (SaaSSA). While it’s not always a strict requirement, it aligns with Canada’s official language policies and highlights a commitment to accessibility and inclusivity – key factors in government procurement decisions.
By providing bilingual support, you demonstrate the ability to effectively serve a diverse range of government departments and stakeholders. It also helps meet broader accessibility and customer service standards, which are becoming increasingly important in SaaS and AI-related government contracts. Even when not explicitly required, this capability can set your application apart from competitors.
How do AI tools help vendors qualify for Canada’s federal SaaS Supply Arrangement (SaaSSA)?
AI tools make it much easier to navigate the process of qualifying for Canada’s federal SaaS Supply Arrangement (SaaSSA). They take on repetitive tasks like preparing documentation, checking for compliance, and generating reports. This not only cuts down on manual work but also helps reduce the risk of errors. By ensuring all submission requirements are met, these tools simplify the application process and save a lot of time.
On top of that, AI can analyze data in real time to spot any gaps in applications and offer suggestions for improvement before submission. It also helps with ongoing monitoring and reporting, making it easier for vendors to address compliance issues or respond to procurement authority requests quickly. This kind of proactive support improves efficiency and increases the likelihood of a successful qualification.
