Objectives

The primary objective of this tender is to ensure that the BANKSETA complies with South African data protection laws and international standards such as COBIT2019 and ISO/IEC 27001:2022. This involves assessing, improving, and aligning the BANKSETA’s data and information security and protection practices to close existing compliance gaps and establish a robust data security framework.

Scope

The scope encompasses:

• Assessment of current data/information security and protection practices across BANKSETA’s departments and business units.
• Development of a comprehensive data/information security architecture aligned with legal and international standards.
• Conducting a compliance gap analysis to identify deficiencies against applicable legislation and standards.
• Providing recommendations and implementing measures to enhance data security and compliance.
• Engagement with multiple stakeholders and integration with existing systems supported by various vendors.

Technical Requirements

The technical requirements include:

• Evaluation of existing data security and protection frameworks against legislation such as POPIA, PFMA, and ISO 27001.
• Design and documentation of a data/information security architecture compliant with ISO/IEC 27001 and COBIT2019.
• Development of a compliance gap analysis report highlighting areas of non-conformance.
• Provision of a detailed implementation plan to address identified gaps.
• Alignment of data/information security architecture with the BANKSETA’s existing systems and vendor-supported platforms.

Skills Requirements

The bidder must demonstrate:

• Experience in data/information security and compliance projects, supported by at least three reference letters from previous clients.
• Minimum of three staff members dedicated to the project, including:
• Team Leader: Owner or director of the bidding company, with a CV/profile and proof of project management certification.
• Specialist in Data or Information Security: Expertise in data protection, information risk, governance, or compliance, with relevant certifications and a CV/profile.
• ICT Governance Specialist: Certified in ISO27001 or COBIT2019, with supporting proof of certification and a CV/profile.
• Proven track record in implementing data security frameworks aligned with ISO standards and COBIT2019.
• Ability to develop and deliver detailed reports, gap analysis, and compliance strategies.