Consultancy services for analysis of cybersecurity status in key sectors and development of customized Cybersecurity Guidelines

NATIONAL INFORMATION TECHNOLOGY AUTHORITY-UGANDA REQUEST FOR EXPRESSION OF INTEREST (CONSULTING SERVICES – FIRMS SELECTION) UGANDA DIGITAL ACCELERATION PROJECT – GOVERNMENT NETWORK (UDAP-GOVNET) LOAN NUMBER: P171305

REFERENCE NUMBER: NITA-U/UDAP/CONS/26-27/00002

ASSIGNMENT TITLE: CONSULTANCY SERVICES FOR THE ANALYSIS OF CYBERSECURITY STATUS IN KEY SECTORS AND DEVELOPMENT OF CUSTOMISED CYBERSECURITY GUIDELINES

The Government of Uganda represented by the National Information Technology Authority Uganda (NITA-U) has received financing from the World Bank towards the cost of the Uganda Digital Acceleration Project-Government Network (UDAP-GOVNET) and intends to apply part of the proceeds for Consultancy Services for the Analysis of Cybersecurity Status in Key Sectors and Development of Customised Cybersecurity Guidelines. The Consultant will have the overall responsibility of Consultancy Services for the Analysis of Cybersecurity Status in Key Sectors and Development of Customised Cybersecurity Guidelines. The duration of the assignment will be five (5) months from the date of signing of the contract. The detailed Terms of Reference (TOR) for the assignment can be accessed at https://www.nita.go.ug The National Information Technology Authority - Uganda now invites eligible consulting firms (“Consultants”) to indicate their interest in providing the services. Interested Consultants should provide information demonstrating that they have the required qualifications and relevant experience to perform the Services. The Shortlisting Criteria for the firm’s capacity and experience are: 1. The firm must demonstrate previous experience in delivering at least two assignments of similar nature with components related to any of these areas: cybersecurity strategy development, cybersecurity standards audit, cybersecurity advisory, cybersecurity frameworks, toolkit design, curriculum development, Cyber security Awareness. Consulting firms may provide documentary evidence of these similar assignments such as client issued completion certificates, reference letters or other relevant documentation that demonstrates the scope and successful completion of the assignments. 2. Due to the nature of the assignment, the firm must also demonstrate experience in successfully delivering at least two assignments for public or private sector organizations that focused on regulatory cybersecurity compliance requirements. Consulting firms may provide documentary evidence of these similar assignments such as client issued completion certificates, reference letters or other relevant documentation that demonstrates the scope and successful completion of the assignments. 3. The firm’s demonstration of the following standards ISO/IEC 27001:2022, ISO 9001:2015, ISO 10005:2018(en), ISO 10015:2019 and ISO/IEC 20000-1:2018 will be added advantage.

4. The firm must provide a valid Data Protection Certificate

5. Presence of appropriate skills among staff in the areas of: Team Leader / Lead Cybersecurity Expert, Cybersecurity Specialists (3), OT/ICS/SCADA Security Expert (1), Data Protection and Privacy Expert (1) and Capacity Building / Training Experts (4). (Please do not submit CVs