Improve the Cybersecurity of the Platform

REQUEST FOR EXPRESSIONS OF INTEREST (REOI) Consulting Services – Firm Selection

Project: Digital Skilling for Employment (DSE) Project

Assignment: Penetration Testing and Security & Data-Protection Compliance Assessment – nammiskills Platform V2

Reference No.: LB-FORWARDMENA-541113-CS-CQS

Selection Method: Consultant’s Qualifications-based Selection (CQS)

The Digital Skilling for Employment (DSE) Project is financed by the Kingdom of the Netherlands under the PROSPECTS Partnership and administered by the World Bank. The Project aims to increase access to market-relevant digital skills and income-generating opportunities for vulnerable youth in Lebanon. As part of the Project, Forward Digital MENA operates nammiskills, a multilingual digital platform supporting learners in assessing their skills, identifying career pathways, accessing learning opportunities, and connecting to employment opportunities.

Scope of the Assignment:

Forward Digital MENA intends to engage an independent cybersecurity consulting firm to conduct penetration testing and a security and data-protection compliance assessment of nammiskills V2. The assignment will cover, among other areas, the platform's web application, APIs, cloud environment, authentication and access controls, multi-tenant architecture, AI/LLM interfaces, third-party integrations, data-protection controls, remediation verification and retesting. Minimum Qualifications

Interested firms should demonstrate:

Proven experience in penetration testing and security assessments of web applications, APIs and cloud-hosted platforms. Successful completion of at least two (2) comparable assignments within the last five (5) years, preferably involving personal data, multi-tenant systems, GDPR or equivalent data-protection requirements. Relevant cybersecurity certifications or accreditations such as CREST, ISO/IEC 27001 or equivalent will be considered an advantage. Availability of suitably qualified expertise in penetration testing, application/API security, data protection/GDPR and AWS/cloud security.

The selected Consultant must remain independent from the company responsible for the design, development, implementation or maintenance of nammiskills V2 and will be required to sign a Declaration of Independence and Absence of Conflict of Interest at contract signature. Request for the Terms of Reference Interested eligible consulting firms are invited to request the complete Terms of Reference (TOR) by email at: [contact details removed]

Subject: Request for TOR – Cybersecurity Assessment of nammiskills Platform V2 – LB-FORWARDMENA-541113-CS-CQS

The complete TOR, including the detailed scope of work, deliverables, qualification requirements, proposal submission requirements and applicable deadlines, will be provided to interested eligible firms upon receipt of their request. Selection Method The Consultant will be selected using the Consultant’s Qualifications-based Selection (CQS) method in accordance with the applicable World Bank Procurement Regulations for IPF Borrowers. Submission Interested firms shall submit their proposals in accordance with the requirements and instructions provided in the TOR.

Proposal submission deadline: 18 September 2026 at 17:00 Beirut Time.

Requests for clarification shall be submitted in writing in accordance with the instructions provided in the TOR.