Provision of Consultancy Services for Regional Cybersecurity Assessment — East African Community Secretariat

EAST AFRICAN COMMUNITY SECRETARIAT | |

| Request for Expression of Interest (REOI) (Consulting Firm) Country: Tanzania Project: East African Regional Digital Integration Project (EARDIP) Title of assignment: Consultancy Services to undertake needs assessment for establishment of A Regional Cert, including assessment of domestic Certs, Roadmap for Regional Virtual Cert and review of Cyber Security Incidents Response Capability. Client: East African Community (EAC) Secretariat Project ID: P176181 Duration of assignment: 180 Days Ref No: TZ-EAC-385063-CS-CQS The East African Community (EAC), with the support of the World Bank, is preparing to implement the Eastern Africa Regional Digital Integration Project (EA-RDIP) (2023 – 2028), which aims to advance digital market integration in the Eastern Africa region by increasing affordable access to regional broadband connectivity and strengthening the enabling environment for cross-border digital services. Phase I of the EA-RDIP Series of Projects covers two Regional Economic Communities: EAC and IGAD, and also includes country projects in Somalia and South Sudan. The East African Community has received financing from the World Bank toward the cost of the Eastern Africa Regional Digital Integration Project, and intends to apply part of the proceeds toward payments under the contracts to procure “Consultancy Services to Undertake Needs Assessment For Establishment Of A Regional Cert, Including Assessment Of Domestic Certs, Roadmap For Regional Virtual Cert And Review Of Cyber Security Incidents Response Capability for the East African Regional Digital Integration Project (EARDIP”. The specific objective of the assignment is to conduct a preparatory study for a regional incident response and information sharing facility to respond to the needs of Member States. The study aims at planning the establishment of a regional CERT by identifying a suitable governance structure, as well as by defining a sustainable and needs-based service framework and related incremental implementation. The East African Community now invites eligible firms (“Consultant”) to indicate their interest in providing the Services. Interested Consultants should provide information demonstrating that they have the required qualifications and relevant experience to perform the Services. The criteria are as follows: • Having strong skills and experience in cybersecurity and Information and Communication Technologies (ICT), particularly in the following areas: incident response, cyber threat intelligence, digital forensics, with at least 7 years of relevant experience. • At least 3 project references in the past 7 years of Integrating and customization of ISAC/ISOC/CSIRT/CERT/CIRT/SOC Tools; Developing policies and procedures related to ISAC/ISOC/CSIRT/CERT/CIRT/SOC operations (operational workflows, SOPs, information sharing and incident management processes, service level management frameworks, among others); Setting up ISAC or Cybersecurity Operation center tools; or similar. • Extensive knowledge of cybersecurity policy, strategy and operations in a government context. • Demonstrating an understanding of relevant frameworks, methodologies, and best practices in cybersecurity. • Prior experience working with the public sector is preferred. • Experience in a developing country context, in particular in the EAC, is considered an advantage. The attention of interested Consultants is drawn to Section III, paragraph 3.14, 3.16 and 3.17 of the World Bank’s Procurement Regulations for IPF Borrowers: Procurement in Investment Project Financing - Goods, Works, Non-Consulting and Consulting Services, November 2020 (Fourth Edition), setting forth the World Bank’s policy on conflict of interest. Consultants may associate with other firms to enhance their qualification but should indicate clearly whether the association is in the form of a joint venture and/or a sub consultancy. In case of a joint venture, all the partners in the joint venture shall be jointly and severally liable for the entire contract, if selected. Consulting firms will be selected in accordance with the Cost-based Selection (CBS) method set out in the Procurement Regulations. Further information can be obtained at the address below during office hours i.e. 09:00 to 17:00 hours. Interested and qualified Individuals are requested to access the detailed TOR from the EAC website from the following link: https://www.eac.int / opportunities/ consultancies Expressions of interest must be delivered to the address below on/before 22nd June 2024, 11:00 hours (East African Standard Time) and mention “Expression of Interest for Consultancy Services to Undertake Needs Assessment For Establishment Of A Regional Cert, Including Assessment Of Domestic Certs, Roadmap For Regional Virtual Cert And Review Of Cyber Security Incidents Response Capability for the East African Regional Digital Integration Project (EARDIP” and submitted to the email address eacprocurement@eachq.org to The Secretary General East African Community P. o Box 1096 Arusha - Tanzania. Tel: +255 27 2162100 Fax: +255 27 2162190 E-mail: eacprocurement@eachq.org Website: www.eac.int