Consultancy Services for Cybersecurity Risk and Compliance Framework Development for NCA

FEDERAL GOVERNMENT OF SOMALIA

MINISTRY OF FINANCE

REQUEST FOR EXPRESSION OF INTEREST (REOI)

Country: Federal Government of Somalia (FGS)

Name of the Project: Somalia Capacity Advancement, Livelihood and Entrepreneurship, through Digital Uplift Project (SCALED-UP),

Assignment Title: Consultancy Services for Cybersecurity Risk and Compliance Framework Development

Project ID: P168115

Individual/Firm: Firm Selection

Deadline for submission of EOI: 24th July 2025 4:00PM

Ref No. SO-MOF-492690-CS-CQS

• Background: The Federal Government of Somalia, through the National Communications Authority (NCA) and the Ministry of Communications and Technology (MoCT), is working to strengthen national cybersecurity to protect its digital infrastructure. Cybersecurity is seen as essential to building trust in the digital economy. The NCA, established under the 2017 Communications Act, regulates Somalia's communications sector and leads the national cybersecurity response.

The Republic of Somalia has received financing from the World Bank towards the cost of the Somalia Capacity Advancement, Livelihood and Entrepreneurship, through Digital Uplift Program (SCALED-UP) project; and intends to apply part of the proceeds of the above project to finance the Consultancy Services for Cybersecurity Risk and Compliance Framework Development under National Communications Authority (NCA)

• Responsibilities: The consulting firm will be responsible for carrying out several key tasks aimed at strengthening Somalia’s national cybersecurity framework. First, it will identify and classify critical infrastructure (CI) and critical information infrastructure (CII) assets, as well as relevant stakeholders, and conduct a comprehensive national cybersecurity risk assessment. Based on this assessment, the firm will develop a National Cybersecurity Risk Management Framework specifically tailored to Somalia’s unique context and needs. Additionally, the firm will establish compliance standards for both the public and private sectors, ensuring that these standards align with existing national laws and international best practices. Finally, the firm will support the implementation of these frameworks by enhancing awareness and building capacity among key stakeholders. All other specific tasks detailed in the Terms of Reference (TOR) for the assignment can be found at the following website: https://mof.gov.so/publications/terms-reference-consultancy-services-cybersecurity-risk-and-compliance-framework

• Duration: The assignment is expected to be completed within Four (4) months from the start date.

• The Ministry of Finance (MoF) of Federal Government of Somalia now invites eligible consulting firms to indicate their interest in providing the Services. Interested Consultants should provide information demonstrating that they have the require qualifications and relevant experience to perform the Services. The shortlisting criteria are:

• a. Core business of the firm: Extensive experience with 7 years in cybersecurity regulation, risk management, compliance frameworks, audits and assessments

• b. Specific experience in successfully implementing similar assignments. (Prior experience working in national or sectoral risk assessments and/or CIIP frameworks with a proven track record of successfully executing at least (2) two projects of similar scope and complexity and familiarity with frameworks such as ISO 27005 and 27001, ISO 31000, NIST 800-30,).

• c. Experience of relevant services in an environment similar to that of Somalia is considered a prerequisite. (Prior experience and demonstrated familiarity with the cybersecurity landscape and challenges specific to the region or developing contexts is considered an advantage).

• d. Technical and managerial capability of the firm: Provide detailed structure of the organization.Do not provide CVs of key staff at this stage. Key Experts will not be evaluated at the shortlisting stage.

• Consultants may associate with other firms to enhance their qualifications but should indicate clearly whether the association is in the form of a joint venture and/or a sub-consultancy. In the case of a joint venture, all the partners in the joint venture shall be jointly and severally liable for the entire contract, if selected.

• Attention of interested Consultants is drawn to section III, para 3.14,3.16 & 3.17 of the World Bank’s Procurement Regulations for IPF Borrowers: Procurement in Investment Projects Financing Goods, Works, Non -Consulting and Consulting Services dated in September 2023 (“Procurement Regulations”), setting forth the World Bank’s policy on conflict of interest.

• A Consultant will be selected in accordance with the Consultant Qualification Selection (CQS) method set out in the Procurement Regulations.

• Further information may be obtained (in person or by e-mail) at the address below during office hours from 8.00 a.m.– 4.00 p.m. Saturday to Thursday except on public holidays.

• Deadline for submission: Expressions of interest should be delivered in a written form to the address below (in person, or by e-mail) by 24th July 2025 4:00PM local time

Attention

Project Coordinator, SCALED-UP Project,

Ministry of Finance, Federal Government of Somalia, Shangani District, Mogadishu, Somalia

Email Address: [email protected]

Cc: [email protected]