Establishment of a National Cybersecurity Plan — Mozambique Digital Acceleration Project

REPUBLIC OF MOZAMBIQUE Ministry of Communications and Digital Transformation Mozambique Digital Acceleration Project REQUEST FOR EXPRESSIONS OF INTEREST Define map critical information infrastructures and identify cybersecurity risks at a national level and establish a cybersecurity and resilience plan Credit No.: 7282 – MZ Reference No. 127/INTIC/PADIM/QCBC/25 The Government of Mozambique has received financing from the World Bank toward the cost of the Digital Acceleration Project and intends to apply part of the proceeds for consulting services for Define map critical information infrastructures and identify cybersecurity risks at a national level and establish a cybersecurity and resilience plan.

The objective of this consulting services is to identify and classify the assets and stakeholders of CI/CII, followed by the development of a National Cybersecurity Risk Management Framework adapted to the context of Mozambique. The assignment will also aim to i) Develop and present the methodology and criteria for the selection of Critical Information Infrastructures (CII); ii) Identify, classify, and develop a database of all Critical Information Infrastructures (CII) at the national level; iii) Situational analysis and gap assessment of the cybersecurity risk management practices of Critical Information Infrastructures (CII), conducted as a summary (light-touch) assessment, aimed at supporting the development of the National Cybersecurity Risk Management Framework for CIIs; iv) Develop the National Cybersecurity Risk Management Framework for CIIs.

The detailed Terms of Reference (TOR) for the assignment can be obtained at the address given below. The Ministry of Communications and Digital Transformation now invites eligible consulting firms (“Consultants”) to indicate their interest in providing the Services. Interested Consultants should provide information demonstrating that they have the required qualifications and relevant experience to perform the Services.

The shortlisting criteria are: i) the firm must prove experience in the identification and mapping of Critical Information Infrastructures (CII); ii) the firm must have a minimum of five (5) years of proven experience in the cybersecurity sector; iii) the firm must provide evidence of having carried out similar projects focused on the protection of Critical Information Infrastructures (CII); iv) the firm must have the ability to develop strategies based on findings and analyses; v) the firm must have experience in facilitating workshops, meetings, and public consultations to gather insights, validate research results, and obtain feedback.

Key Experts will not be evaluated at the shortlisting stage. The attention of interested Consultants is drawn to Section III, paragraphs, 3.14, 3.16, and 3.17 of the World Bank’s “Procurement Regulations for IPF Borrowers” September 2023 (“Procurement Regulations”), setting forth the World Bank’s policy on conflict of interest. Consultants may associate with other firms to enhance their qualifications, but should indicate clearly whether the association is in the form of a joint venture and/or a sub-consultancy.

In the case of a joint venture, all the partners in the joint venture shall be jointly and severally liable for the entire contract, if selected. A Consultant will be selected in accordance with the Quality and Cost Based Selection (QCBS) method set out in the Procurement Regulations. Further information can be obtained at the address below during office hours, i.e.

08:00 to 15:30 hours, local time. Expressions of interest must be delivered in a written form to the address below by April 30, 2026. Adress: Ministry of Transport and Communications Mozambique Digital Acceleration Project 141 5D 33, Avenida para o Palmar, Zona do Antigo Mercado do Peixe.

Maputo – Moçambique Email: Procurement@padim.gov.mz