Objectives

The primary objectives of this tender are to:

• Appoint a qualified service provider or independent consultant to assess and improve the University’s cybersecurity posture.
• Provide clear understanding and response framework for prospective providers regarding the University’s cybersecurity review requirements.
• Ensure a structured and uniform approach to proposal evaluation.

Scope

The scope of the cybersecurity audit includes:

• Assessment of the University’s cybersecurity governance, risk management, and control effectiveness.
• Evaluation of cybersecurity controls in relation to recognized frameworks such as NIST CSF, ISO 27001, and CIS Controls.
• Review of data governance and management, security risk management (including third-party risks), asset management, incident management, and continuous monitoring.
• Delivery of reports, practical recommendations, and bi-weekly progress feedback.
• Completion of the audit by 31 July 2026.

Technical Requirements

The technical scope involves:

• Conducting a cybersecurity review aligned with Global Internal Audit Standards and recognized cybersecurity frameworks.
• Performing cybersecurity maturity assessments, risk identification, control evaluation, and gap analysis.
• Providing a detailed methodology outlining the approach to assessment, including phases such as Preliminary Evaluation, Planning, Fieldwork, Reporting, and Project Quality Management.
• Ensuring the audit covers governance, risk management, control effectiveness, and practical recommendations for improvement.
• Delivering a comprehensive audit report and supporting documentation, including an audit file.

Skills and Skills Requirements

The tender requires service providers and team members to possess:

• Proven experience in cybersecurity reviews, IT audits, and maturity assessments, preferably within the higher education sector.
• Qualified team members with relevant certifications such as CISSP, CISM, CEH, or equivalent in information security.
• Knowledge of recognized cybersecurity frameworks (e.g., NIST CSF, ISO 27001, CIS Controls).
• Experience in conducting cybersecurity assessments, risk management, and control evaluations.
• Ability to develop and implement detailed methodologies aligned with international standards and best practices.
• Demonstrated understanding of the scope phases: Evaluation, Planning, Fieldwork, Reporting, and Quality Management.
• Previous experience in the higher education sector or similar environments is preferred.