Objectives

The primary objective of this tender is to engage a qualified service provider to conduct comprehensive security audits and assessments of the Electoral Commission’s ICT network and infrastructure. This includes identifying vulnerabilities, evaluating compliance with security standards, and providing actionable recommendations to enhance security posture. The audits aim to produce independent reports that inform both technical and operational management, ensuring the integrity, confidentiality, and resilience of the Electoral Commission’s digital environment.

Scope

The scope encompasses:

• Assessment of ICT network and infrastructure, including internal and external penetration testing.
• Review of security controls around LAN, WAN, data centers, workstations, web and mobile applications.
• Evaluation of security policies, architecture, and configurations of network devices (routers, switches, firewalls, IPS).
• Assessment of remote access solutions such as VPN and APN.
• Vulnerability scans and penetration testing of websites, applications, VMD systems, and cloud environments (Azure, M365, Google Cloud).
• Evaluation of identity and access management systems, including MFA, PAM, and PIM.
• Testing of human vulnerabilities through social engineering exercises.
• Assessment of database security (Oracle, SQL Server) and overall disaster recovery capabilities.
• Review of security policies, procedures, and compliance with standards like POPIA, NIST, ISO 27000, CIS Benchmarks.
• Two assessments scheduled approximately 6 months apart, with reports to be shared with stakeholders.

Technical Requirements

The technical specifications include:

• Use of latest vulnerability assessment and penetration testing methodologies.
• Assessment of network topology, security controls, and configurations of all relevant hardware and software components.
• Evaluation of web and mobile applications against OWASP Top 10 risks.
• Security testing of cloud environments and APIs.
• Testing of identity management systems and human factors (social engineering).
• Analysis of security incident detection, response, and recovery capabilities.
• Provision of detailed methodologies, tools, and solutions used for assessments.
• Preparation of comprehensive reports with findings, risk levels, and remediation recommendations.
• Re-assessment after remediation to verify effectiveness.

Skills and Skills Requirements

The successful bidder must demonstrate:

• At least 5 years’ experience in conducting IT security audits and vulnerability assessments.
• Proven track record with a minimum of three similar projects, including references with contact details and scope descriptions.
• Expertise in network security, application security, cloud security, database security, and human vulnerability testing.
• Qualified security professionals, including at least two team members with certifications such as:
• Certified Ethical Hacker (CEH)
• Offensive Security Certified Professional (OSCP)
• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Ability to develop and implement detailed methodologies, including testing tools and procedures.
• Security clearance as required by the Electoral Commission.
• Experience in managing sensitive data and ensuring confidentiality and data protection compliance.
• Capability to perform team-based exercises such as war games and cryptography analysis.