RFPs: Cyber Incident Response and Data Protection for the Health Sector (Indonesia)

Deadline: 02-Sep-2026

The World Health Organization (WHO) is seeking a qualified organization to support Indonesia’s health sector in developing cyber incident handling mechanisms and personal data protection policies. The six-month assignment will produce policy documents, operational procedures, implementation guidelines, roadmaps, templates, and forms for healthcare facilities, telemedicine providers, and organizations managing health data. Overview The World Health Organization is supporting Indonesia’s efforts to strengthen health-sector cybersecurity, cyber incident preparedness, and personal health data protection as the country advances its digital health transformation. The assignment focuses on developing practical governance and policy frameworks rather than implementing cybersecurity technologies or conducting technical security assessments. The selected organization will review existing regulations and practices, identify cybersecurity and data-protection risks, define stakeholder responsibilities, and develop a coordinated set of policy and operational documents. What Is the WHO Indonesia Cybersecurity and Data Protection Initiative? The initiative is designed to strengthen how Indonesia’s health sector prepares for, manages, and responds to cybersecurity incidents while protecting sensitive personal and health information. The work will support organizations that operate or manage: The resulting documents will provide practical guidance for management teams, information technology personnel, cybersecurity teams, and staff responsible for data protection. Key Objectives The main objectives of the assignment are to: Review existing Indonesian regulations, policies, and practices related to cybersecurity and personal data protection. Assess existing approaches to cyber incident handling within the health sector. Identify relevant cybersecurity and data-protection risks. Define the roles and responsibilities of key stakeholders. Develop cyber incident handling policies and operational procedures. Develop personal data protection policy documents. Prepare implementation guidelines and roadmaps. Develop standardized templates and forms. Consult relevant government, health, technology, and other stakeholders. Ensure proposed documents are consistent with national regulations and recognized best practices. What Will the Selected Organization Develop? The assignment is expected to produce a structured package of policy and operational resources.

Key deliverables may include:

Cyber incident handling policy documents Personal data protection policies Standard operating procedures Implementation guidelines Implementation roadmaps Roles and responsibilities frameworks Operational templates Reporting and documentation forms Supporting guidance for healthcare and digital health organizations These materials are intended to provide a consistent framework for responding to cyber incidents and protecting personal health information. What the Assignment Does Not Cover The initiative is focused on policy, governance, coordination, and operational preparedness.

It does not involve:

Technical cybersecurity implementation System-level cybersecurity deployment Technical penetration testing Security infrastructure installation Detailed technical security assessments The emphasis is instead on creating documents and mechanisms that organizations can use to improve cybersecurity governance and personal data protection. Why It Matters Indonesia’s expanding digital health ecosystem creates opportunities to improve healthcare access and service delivery, but it also increases the importance of protecting sensitive health information. A coordinated cyber incident response framework can help health organizations establish clear procedures for identifying, reporting, managing, and learning from cybersecurity incidents. Similarly, clear personal data protection policies can help organizations understand their responsibilities when collecting, processing, storing, and sharing health-related information. The assignment therefore supports broader goals related to: Digital health governance Cybersecurity preparedness Health data protection Privacy governance Incident response Regulatory compliance Stakeholder coordination Resilience of health information systems Who Is Eligible? Eligible proposers must have the legal capacity to enter into a contract with the World Health Organization.

Applicants must also:

Comply with the UN Supplier Code of Conduct. Submit the required signed self-declaration form. Demonstrate their ability to undertake the required assignment. Meet all applicable WHO procurement and eligibility requirements. Organizations that do not satisfy WHO’s contractual and compliance requirements may be excluded from consideration. Who May Be Excluded?

Proposers may be excluded if they:

Are subject to bankruptcy or insolvency proceedings. Have a conflict of interest that WHO determines affects the procurement process. Fail to satisfy other mandatory WHO eligibility or compliance requirements. Applicants should carefully review the official request for proposals and associated procurement documents before submitting an offer. Project Duration The total duration of the assignment is six months. During this period, the selected organization will be expected to conduct the assessment and consultation work and develop the required policy and operational documentation. The work will require coordination with relevant Indonesian health-sector and other stakeholders to ensure that the resulting documents are practical and aligned with national requirements. How the Assignment Will Work The expected approach can be understood through several stages: Review existing frameworks Examine relevant Indonesian laws, regulations, policies, guidelines, and existing cybersecurity and data-protection practices. Assess current mechanisms Review how cyber incidents and personal data protection are currently managed across