Iron Fort keeps your ITSG-33 evidence in one place. It tracks the security controls behind every authority to operate (ATO) and shows where each Security Assessment (SA&A) stands — continuously, not just at authorization time. The offers below are the line items published in our Annex C ceiling-price submission.
The ATO offers all run the same ITSG-33 control baseline and evidence engine; what changes between them is how many Security Assessments (SA&A) you are carrying. Start with the Iron Fort Platform, then add the licence tier that matches the number of assessments you run. Enterprise Architecture Governance is a separate module for departments that also run an architecture review board.
| Item | Part No. | Offer | Unit of Measure | Profile | Languages | Ceiling Price |
|---|---|---|---|---|---|---|
| 1 | CoreSystem-ATO | Iron Fort Platform Sets up your department's Iron Fort environment: the ITSG-33 control baseline, the evidence store behind your ATOs, and the reporting your authorizer sees. Every deployment starts here; Security Assessment (SA&A) licences are ordered separately. | Per tenant implementation |
ITSG-33 / PBMM Assessed: Unclassified |
English & French | On request |
| 2 | IF-ATO-10apps | Iron Fort - 10 Security Assessment (SA&A) Licences Covers 10 Security Assessments (SA&A). Each licence holds that assessment's ATO documents, its control evidence, and its current compliance status. Suits a single branch or a small assessment portfolio. | 10 Security Assessment (SA&A) licences |
ITSG-33 / PBMM Assessed: Unclassified |
English & French | On request |
| 3 | IF-ATO-25apps | Iron Fort - 25 Security Assessment (SA&A) Licences Covers 25 Security Assessments (SA&A). Each licence holds that assessment's ATO documents, its control evidence, and its current compliance status. Suits a department consolidating SA&A activity across several branches. | 25 Security Assessment (SA&A) licences |
ITSG-33 / PBMM Assessed: Unclassified |
English & French | On request |
| 4 | IF-ATO-50apps | Iron Fort - 50 Security Assessment (SA&A) Licences Covers 50 Security Assessments (SA&A). Each licence holds that assessment's ATO documents, its control evidence, and its current compliance status. Suits a large department tracking assessments across most of its estate. | 50 Security Assessment (SA&A) licences |
ITSG-33 / PBMM Assessed: Unclassified |
English & French | On request |
| 5 | IF-ATO-100apps | Iron Fort - 100 Security Assessment (SA&A) Licences Covers 100 Security Assessments (SA&A). Each licence holds that assessment's ATO documents, its control evidence, and its current compliance status. Suits an agency managing SA&A across the full estate, including inherited and legacy systems. | 100 Security Assessment (SA&A) licences |
ITSG-33 / PBMM Assessed: Unclassified |
English & French | On request |
| 9 | IF-EARB | Iron Fort Enterprise Architecture Governance Streamlines and standardizes Enterprise Architecture Review Board (EARB) governance. One place for your board to receive submissions, review them against a consistent set of artifacts and criteria, record decisions and any conditions attached, and track those conditions through to closure. | Per tenant implementation |
EARB Governance Assessed: Unclassified |
English & French | On request |
On subscription licence pricing: the Annex C submission publishes ceiling prices for the optional professional services below; subscription ceiling prices for the SaaS offers are quoted per Supply Arrangement against your assessment count and term. Contact us for a written ceiling-price quotation. The applicable percentage discount off ceiling commercial unit prices is 0% for the duration of the Supply Arrangement.
On classification: Iron Fort's control baselines cover Unclassified, Protected A, and Protected B (PBMM) profiles for the workloads you authorize in the platform. The Government of Canada security assessment level of the hosted SaaS itself, as declared in the Annex C submission, is Unclassified.
Per-diem ceiling prices in Canadian dollars, delivered virtually. Draw on these to stand the platform up, migrate existing SA&A artefacts, or get advisory support on control implementation.
| Item | Part No. | Service | Unit of Measure | Language | Ceiling Price (CAD) |
|---|---|---|---|---|---|
| 6 | IF-TRAIN | Training A day of training for your team, delivered online. Covers running the platform day to day — logging evidence, keeping control status current, and producing reports for your authorizer. | Per day | English | $1,500CAD / day |
| 7 | IF-PS | Setup and Migration A day of hands-on delivery work: standing up your environment, moving existing SA&A documents and evidence into Iron Fort, cleaning up the data as it lands, and transitioning off your current process. | Per day | English | $1,750CAD / day |
| 8 | IF-ADVISE | Advisory A day with a senior compliance specialist on how to run the program — control implementation, evidence strategy, and preparing for assessment. For questions about approach rather than about the software. | Per day | English | $2,500CAD / day |
Ceiling prices are maximums for the duration of the Supply Arrangement — actual pricing at contract award may be lower. Professional services are quoted per diem and delivered virtually.
The same capability sits behind every offer in Table 1 — the licence count only decides how many Security Assessments (SA&A) it covers.
Pre-configured control profiles for Unclassified, Protected A, and Protected B (PBMM) workloads, mapped to the ITSG-33 catalogue with NIST SP 800-53 cross-references.
Collects and stores the evidence behind each control — timestamped and attributable — so an SA&A package is assembled from the record rather than reconstructed.
Ongoing reporting and compliance monitoring of the authorization for each workload in production, so authorization drift surfaces between assessments, not during one.
Each licensed Security Assessment (SA&A) carries its own ATO documentation, evidence set, and security control information — visible individually and rolled up across the estate.
The platform is available in both official languages, meeting departmental obligations for bilingual service delivery.
Delivered as SaaS on Amazon Web Services, the Cloud Service Provider declared in the Supply Arrangement submission.
Iron Fort is procurable through RFSA (SaaS), SLSA, TBIPS, CSPV, and ProServices — no sole-source justification required. Also available through AWS Marketplace with consolidated billing.
Tell us how many Security Assessments (SA&A) you are carrying and we will return a written ceiling-price quotation against the Supply Arrangement — usually within one business day.
Cookies on goironfort.com
Essential cookies keep this site working and are always on. With your consent we also load third-party content, such as our review badge, which shares your IP address with that provider. Rejecting keeps everything non-essential switched off. Read our Privacy Policy — you can change your choice any time from the footer.