Objectives

The primary objective of this tender is to procure a cybersecurity assessment service for the NYDA. The assessment aims to evaluate the internal cybersecurity environment, focusing on applications used within NYDA, to ensure compliance with insurance renewal requirements, identify vulnerabilities, threats, and risks, and provide recommendations to enhance cybersecurity posture. The service will support NYDA in maintaining a secure digital environment, complying with relevant legislation, and strengthening its cybersecurity defenses.

Scope

The scope of work includes:

• Conducting a comprehensive application security assessment, including vulnerability assessments, penetration testing, and code reviews for all applications used by NYDA, both internally developed and third-party.
• Evaluating the overall internal cybersecurity environment, covering infrastructure, network configurations, access controls, and application security controls.
• Collecting, analyzing, and reporting cybersecurity incident data and vulnerabilities, with summarized reports for NYDA stakeholders.
• Developing and supporting cybersecurity awareness campaigns for NYDA employees and stakeholders.
• Ensuring compliance with legislation such as POPIA, PFMA, and the Cybercrimes Act, and providing risk mitigation strategies.
• Reviewing patch management processes for identifying, testing, and deploying software updates.
• Providing a prioritized remediation plan to address identified vulnerabilities and improve cybersecurity defenses.

Technical Requirements

The technical requirements for the cybersecurity assessment include:

• Application Security Assessment: Vulnerability scans, penetration testing, and code reviews for all applications used by NYDA.
• Cybersecurity Environment Review: Evaluation of infrastructure, network configurations, access controls, and application security controls.
• Data Management & Reporting: Collection, analysis, and reporting of cybersecurity incident data and vulnerabilities, with reports in English.
• Awareness Campaign Support: Development of educational materials on cybersecurity best practices.
• Compliance & Risk Management: Ensuring assessments and solutions adhere to relevant legislation and standards, with risk mitigation strategies.
• Patch Management Review: Assessment of processes for software updates and vulnerability patches.
• Remediation Planning: Delivery of a prioritized plan to address vulnerabilities and strengthen cybersecurity posture.
• Experience & References: Submission of three signed reference letters demonstrating relevant experience, preferably related to cybersecurity insurance renewal.
• Contract Duration: The assessment is to be completed within a four-week period under a Service Level Agreement.