Guangdong Agricultural Product Quality and Safety Improvement (Demonstration) Project Information Technology Service Package III (Specialized Security Assessment Service and Acceptance Assessment Service)

REQUEST FOR EXPRESSIONS OF INTEREST INFORMATION TECHNOLOGY SPECIALLIZED SECURITY ASSESSMENT SERVICE AND ACCEPTANCE ASSESSMENT SERVICE for China Food Safety Improvement Project Guangdong Agricultural Product Quality and Safety Improvement (Demonstration) Project

Country: People's Republic of China

Name of Project: China Food Safety Improvement Project

Loan No.: IBRD-92130

Assignment Title: Guangdong Agricultural Product Quality and Safety Improvement (Demonstration) Project Information Technology Third-Party Service Package III (Speciallized Security Assessment Service and Acceptance Assessment Service)

Reference No.: GD-FSS-GAMR-CS14

The Guangdong Administration for Market Regulation has received financing from the World Bank toward the cost of the China Food Safety Improvement Project Guangdong Agricultural Product Quality and Safety Improvement (Demonstration) Project, and intends to apply part of the proceeds for consulting services. The total estimated amount for this project is RMB 0.42 million. (I) Scope of Services The service scope of this project covers specialized security assessment services and acceptance assessment services for four informatization sub-projects, specifically including: The "Scan-to-Trace" Full-Chain Traceability Platform Project for Food in Key Fields (Categories); The "Yue-Shi-An Internet Plus Open Kitchens" System Construction Project; The Upgrade, Renovation, and Operation Project of the Emergency Real-Time Dispatch and Command System; The Capacity Building Project for Food-Related Personnel in Market Regulation.

(II) Service Content

1. Specialized Security Assessment Services

Before the system is launched on the provincial government cloud or domestic cloud, the service agency shall conduct a pre-launch security assessment. The security assessment agency will simulate hacker attack methods to perform non-destructive offensive testing on the system. The objective is to attempt to intrude into the system and obtain system control, and then generate a report detailing the intrusion process and specifics for the user. The assessment will focus on the network, host, application, data, and the overall system to evaluate whether the system possesses sufficient information security protection capabilities, meets the security control requirements of the industry and competent authorities, can continuously provide secure, stable, and efficient business support, and can guarantee the security of sensitive information and public privacy.

2. Acceptance Assessment Services

Before the final project acceptance, the service agency shall conduct pre-acceptance assessments and compliance checks for the informatization services to strictly manage project quality and ensure that all indicators comply with design standards and construction specifications such as the contract and requirement specifications. This mainly includes: functional testing, performance efficiency testing, information security testing, compatibility testing, reliability testing, usability testing, maintainability testing, portability testing, and document review. (III) Service Period The service period for this project shall commence from the date of contract signing and continue until the project closing date (March 31, 2029). The specific service timeline will be implemented in phases based on the system launch schedule of the four informatization projects. (IV) Deliverables The deliverables required for this project are as follows: No. Report Name Submission Date/Phase

1 Mobilization Time

Acceptance Assessment Mobilization Time: Subject to the time of preliminary project acceptance;

Security Assessment Mobilization Time: Subject to the system launch time.

2 Acceptance Assessment Plan Submitted within 10 working days after receiving the project materials.

3 Acceptance Testing Issue Report Submitted within 5 working days after the completion of the first round of testing.

4 Acceptance Assessment Report Submitted within 5 working days after the completion of regression testing.

5 Security Assessment Plan Submitted within 10 working days after receiving the project materials.

6 Security Assessment Issue Report Submitted within 5 working days after the completion of the first round of testing.

7 Security Assessment Report Submitted within 5 working days after the completion of regression testing.

Upon receiving the deliverable reports submitted by the assessment service agency, the Project Management Office (PMO) shall review them. For deliverable documents that are required to be submitted to the World Bank for review according to regulations, the assessment service agency shall assist the PMO in completing the submission. The phased deliverables shall be officially considered closed only after obtaining the World Bank's "no objection." All deliverable reports must fully align with the service content specified in this Terms of Reference (TOR). They must be standardized in format, comprehensive in content, and authentic and accurate in data. V. Agency Qualification Requirements Service agencies undertaking the two types of services—specialized security assessment and acceptance assessment—must possess valid qualifications. They must hold either the Inspection Body Accreditation Certificate (including the CNAS Laboratory Accreditation Certificate) issued by the China National Accreditation Service for Conformity Assessment (CNAS), or the Inspection and Testing Agency Qualification Accreditation Certificate (CMA) issued by market regulation departments at or above the provincial level. Within the past three years, the service agency must have independently undertaken no fewer than five specialized security assessment and acceptance assessment service projects. The relevant performance records must cover related types such as government informatization, software platform construction, system integration, and network security. These records must sufficiently demonstrate the agency's comprehensive se