a) Provide cybersecurity support in system operations to ensure the compliance with Government policies, which include review, design and implementing security measure, process, controls for the Authority’s systems;

b) Review security audit reports and assessment conducted by auditors for security testing such as Vulnerability assessment, penetration testing, host configurations, IT general controls, risk assessments, etc;

c) Conduct reviews, gap analysis and provide recommendations on monthly reports and reviews, ensuring the compliance of the system processes to the Authority and Government policies;

d) Monitor and follow up with known vulnerabilities and risks in the Authority’s environment and systems;

e) Conduct cybersecurity assessments to identify vulnerabilities and risks in the

Authority’s systems and processes;

f) Design and follow through the implement of cybersecurity solutions in the Authority’s environment to protect against threats and attacks;

g) Review and verify that security policies, procedures, and best practices are implemented and comply with standards and guidelines by the Authority’s appointed contractors and systems;

h) Provide guidance and recommendations on cybersecurity strategies and technologies;

i) Conduct security awareness trainings to the Authority and the Authority’s appointed contractors when necessary to promote a culture of security;

j) Monitor and respond to security incidents and breaches, conducting forensic analysis on a need-be basis; and

k) Stay current on emerging cybersecurity threats, trends, and technologies.

21. The One (1) Onshore Cybersecurity Consultant proposed by the Contractor shall have at least 3 years of experience as a Cybersecurity Consultant or equivalent position and the following skill sets:

a) Bachelor’s degree in computer science, Electrical/ Computer Engineer, Information Technology or related discipline would be preferred;

b) Good capabilities in ICT governance, security/ risk/ data management frameworks;

c) Good knowledge in ICT infrastructure, applications and web/ cloud services;

d) Qualified and certified ICT professionals such as CREST, CRISC, CGEIT and CISSP; and

e) Knowledge of cybersecurity industry standards, government cyber security policies and requirements.