Technical Assistance for establishment of the Sao Tome and Principe National Computer Security Incident Response Team (CSIRT)

REQUEST FOR EXPRESSIONS OF INTEREST

DESIGN, ESTABLISH AND OPERATIONALIZE A NATIONAL COMPUTER SECURITY INCIDENT RESPONSE TEAM (CSIRT)

Finance Agreement Reference: IDA-E0730

Project No. P177158

Assignment Title: Technical Assistance for design, establishment and operationalize a Sao Tome and Principe National Computer Security Incident Response Team (CSIRT)

Reference No. 04/C/DSTP/2023

I. Background

The Government of São Tomé and Príncipe (GoSTP) has received a grant from the International Development Association (IDA) to cover the cost of the DIGITAL SÃO TOMÉ E PRÍNCIPE Project (DSTP) and intends to apply a portion of such grant for payments under the contract to recruit a specialized consulting firm to SUPPORT THE GOVERNMENT TO DESIGN, ESTABLISH AND OPERATIONALIZE A COMPUTER SECURITY INCIDENT RESPONSE TEAM (CSIRT).

DSTP’s overall goal is to improve the equity and the sustainability of telecommunications services between Sao Tome and Principe, strengthen data systems and governance frameworks, and increase government capacity to provide updated socio-economic data.

The specific objective of this assignment is the development of policy and organizational and operational planning for the CSIRT in the framework of a National Cybersecurity Strategy that is being created. The activities to be implemented include, but are not limited to:

• drafting of policies, regulations, standards, and guidelines for the CSIRT
• propose a structure for the CSIRT that is technically, financially, and operationally sustainable for a small government system such as in Sao Tome and Principe
• support the Government in standing up and operationalizing that structure
• provide trainings for the CSIRT personnel; and assist the CSIRT to establish relationships with other international/regional CSIRTs
• activities needed to develop and obtain approval for the full CSIRT establishment plan in the Planning Phase
• activities required to set up and operationalize the CSIRT, based on the approved Establishment Plan during the Implementation Phase
• During the Operational Support Phase, providing additional training, simulation and support for CSIRT operations such as incident response, awareness campaigning and risk/vulnerability monitoring

DSTP now invites eligible consultants to indicate their interest in providing these services. Interested consultants must provide information indicating that they are qualified to perform the services (brochures, description of similar assignments, experience in similar conditions, availability of appropriate skills among staff, etc.). Consultants may constitute joint-ventures to enhance their chances of qualification.

The attention of interested Consultants is drawn to Section III, paragraphs, 3.14, 3.16, and 3.17 of the World Bank’s “Procurement Regulations for IPF Borrowers” July 2016 (“Procurement Regulations”), setting forth the World Bank’s policy on conflict of interest.

A Consultant will be selected in accordance with the QCBS – Quality Cost Based Selection method set out in the Procurement Regulations.

Interested consultants may obtain the Terms of Reference through the email provided below.

Expressions of interest must be delivered in a written form to address below or in pdf format sent to the e-mail address included, by July 6, 2023 at 11:45 am (local time) and should mention “FIRM TO IMPLEMENT CSIRT FUNCTION FOR THE GOVERNMENT OF SAO TOME AND PRINCIPE”:

Unidade de Implementação do Projeto STP Digital

Attn: Daniel Neto Vaz – Coordenador do Projecto

C. P. 130

Avenida 12 de Julho, Sao Tome, Sao Tome e Príncipe

E-mail: [email protected] / [email protected]