RFP - CYBERSECURITY ASSURANCE SERVICES

Africa Re seeks to engage a qualified and experienced consultant or firm to provide comprehensive cybersecurity assurance services for its Information and Communications Technology environment on a renewable retainer basis following the completion of the baseline engagement. The engagement shall provide independent, risk-based assurance over the design and operating effectiveness of relevant cybersecurity governance, risk management, and control processes. The objectives of the engagement are to: • Provide independent and objective assurance on the adequacy and effectiveness of cybersecurity governance, risk management, and internal control processes. • Assess the effectiveness of technical, administrative, and governance controls designed to protect information assets and technology resources. • Identify cybersecurity risks, vulnerabilities, control weaknesses, and emerging threat exposures that could impact the Corporation’s strategic objectives. • Evaluate the Corporation’s preparedness, detection, response, recovery, and resilience capabilities against evolving cyber threats, including threats enabled by emerging technologies and Artificial Intelligence. • Assess compliance with relevant cybersecurity, data protection, and industry good-practice requirements. • Provide practical, risk-based recommendations to strengthen cybersecurity maturity, resilience, and ongoing risk management capabilities. • Support management and governance stakeholders through periodic assurance reporting and independent cybersecurity insights. The cybersecurity assurance engagement shall include, at a minimum, the activities set out below. The Consultant shall apply a risk-based approach, validate findings through appropriate evidence, assess the design and operating effectiveness of relevant controls, and relate identified weaknesses to their potential business and operational impact. For clarity and completeness, the cybersecurity assurance engagement shall be executed across the following assurance domains: • Cybersecurity Governance and Oversight • Cybersecurity Risk Management • Technical Security Controls • Security Monitoring and Incident Management • Identity and Access Management • Cybersecurity Awareness and Human Factors • Third-Party and Supply Chain Security • Operational Resilience and Business Continuity • Emerging Technology and Artificial Intelligence Risks • Data Protection and Regulatory Compliance. Cybersecurity Risk Management:The Consultant shall assess the effectiveness of the Corporation’s cybersecurity risk management processes, including: • Identification and assessment of cybersecurity risks across critical business processes, systems, networks, and information assets. • Evaluation of risk assessment methodologies, risk-rating frameworks, and risk appetite considerations. • Review of cyber risk mitigation, treatment, transfer, and acceptance processes. • Assessment of the integration of cybersecurity risks into the Enterprise Risk Management (ERM) framework. • Review of cyber risk monitoring, reporting, escalation, and governance mechanisms. • Evaluation of management’s approach to emerging cyber threats and evolving risk exposures. Cybersecurity Governance and Oversight:The Consultant shall assess the effectiveness of the Corporation’s cybersecurity governance arrangements and oversight mechanisms, including: • Review of cybersecurity governance structures, committees, and reporting lines. • Evaluation of the roles and responsibilities of the Board, Executive Management, Audit Committee, Risk Committee, and Information Security function in overseeing cybersecurity risks. • Assessment of cybersecurity strategies, objectives, performance measures, and reporting mechanisms. • Assessment of management oversight over cybersecurity investments, initiatives, and resource allocation. • Review of the integration of cybersecurity considerations into business decision-making and strategic planning. • Evaluation of management and Board reporting related to cybersecurity risks, incidents, control weaknesses, and remediation activities. • Assessment of the extent to which cybersecurity governance practices align with recognized standards, regulatory expectations, and industry best practices. Vulnerability Assessment and Technical Control Review:The Consultant shall conduct a detailed assessment of the Corporation’s internal and external ICT environment, including: a. Internet Perimeter and External Security • External vulnerability scanning • Review of perimeter devices (e.g., firewalls, routers and gateways) configuration and security posture. b. Internal Network and System Security • Internal vulnerability scanning • Review of access control mechanisms (logical access, privileged access); • Assessment of email security controls; • Wireless network security review. • Assessment of identity and access management governance processes; • Review of Joiner-Mover-Leaver pr