Expression of Interest For Defining Institutional Roles For Cybersecurity And National Cybersecurity Risk Assessment

Expression of Interest for Bhutan: Defining Institutional Roles for Cybersecurity and National Cybersecurity Risk Assessment. Publication Date: 10/31/2024 12:00 AM EDT EOI Deadline: 11/13/2024 11:59 PM EST As part of ongoing advisory engagements, the World Bank (WB) has expanded its support to the Royal Government of Bhutan (RGoB) in accelerating inclusive digital transformation. One strategic area of engagement has been cybersecurity, where the government has expressed keen interest in the Banks assistance in building a solid foundation for mitigating the risks associated with Bhutans ambitious plans to advance digital transformation. The WBs primary support vehicle for the RGoB is the upcoming Accelerating Transport and Trade Connectivity in Eastern South Asia (ACCESS) lending project, which is under preparation and expects WBs board approval in March 2025. The ACCESS project will focus on developing digital trade systems for Bhutan and include significant cybersecurity interventions. To inform and streamline the preparation for ACCESS and support the RGoB cybersecurity aspirations, the WB, under the Cybersecurity Multi-Donor Trust Fund (Cyber TF), is providing advisory support services to the Bhutan Computer Incident Response Team (BtCIRT). The Bhutan Computer Incident Response Team (BtCIRT) was established in 2016 as part of the Department of Information Technology and Telecom (DITT) within the Ministry of Information and Communication (MoIC). Functions of DITT, including BtCIRT, transitioned to the new Government Technology Agency (GovTech) as part of a Civil Service Reform Bill that became effective in December 2022. In the new GovTech structure, BtCIRT is part of the Cybersecurity Division, though, in practice, there are no other functions under the Cybersecurity Division, and BtCIRT acts, de facto, as the National Cybersecurity Agency in Bhutan. Since the establishment of BtCIRT and the formation of GovTech, the RGoB has made reasonable efforts to strengthen cyber security and build solid foundations for mitigating the evolving risks. The first phase of advisory support to BtCIRT started in early 2023 and was concluded in September 2024 with the following deliverables: 1. A revised and prioritized National Cybersecurity Strategy (NCS)[1] focusing on four strategic goals: a. Goal 1: Enhance national cybersecurity governance. b. Goal 2: Strengthen the cybersecurity legislation framework. c. Goal 3: Protect Critical Information Infrastructure (CII) and d. Goal 4: Enhance Incident Response (IR) capacities. 2. An action plan for the implementation of the NCS 3. A Critical Information Infrastructure (CII) identification methodology 4. A road map for implementing the CII Protection (CIIP) plan. 5. A proposed institutional governance structure for cybersecurity in GovTech, defining GovTechs divisions cybersecurity roles and responsibilities. 6. High-level cybersecurity legal framework gap analysis. The NCS was approved (September 2024) by GovTech High Commission and enters its implementation phase. The CII identification methodology is still under review. The CII identification process will commence once the methodology is approved. Given these achievements, the RGoB expressed strong interest in a follow-on phase of advisory support to strengthen its cyber security foundations further. This phase of the advisory support will help BtCIRT prepare to implement NCSs high-priority areas and enhance its capacity to streamline cybersecurity activities in ACCESS. In particular, the grant will advise BtCIRT on the institutional and technical preparations needed to implement NCSs operational goals 3 and 4 (CIIP and IR enhancement) as part of ACCESSs cybersecurity activities: establishment of a Government Security Operations Center (G-SOC) as the operational arm of BtCIRT, development of a Critical Information Infrastructure Protection (CIIP) plan and a rollout of National Cybersecurity Risk Assessment (NCRA). Tender Link : https://wbgeprocure-rfxnow.worldbank.org/rfxnow/public/advertisement/4192/view.html