Protective Security Risk Review and ICT Controls Assessment

⁠⁠⁠The Australian National Audit Office (ANAO) is seeking specialist protective and cyber security services to assist with performing an ICT controls assessment and updating the ANAO Protective Security Risk Review document. This RFQ is an invitation to submit a proposal.

As part of the specialist security services, the successful supplier must deliver the following:

1. Work with the ANAO to provide a schedule and milestone for each deliverable.

2. Support the ANAO to review and update the ANAO Protective Security Risk Review document ensuring that they:

• reflect the current and emerging ANAO business and security risks and threats (with consideration to credible security sources, intelligence agencies information, the ACSC, and security industry more broadly);
• address the PSPF and ISM requirements; and
• review and update key performance metrics for ICT security to ensure they are suitable for contemporary security practices. This includes clarifying the measures and the approach to updating the threats and risks rating periodically.

3. Review the application of existing technical ICT Controls and provide support to document ICT Controls in a format suitable for ongoing security management reporting, maintenance and continuous improvement. Provide advice as to required adjustments if any improvement may be required

4. Prepare an Essential Eight Security Risk Management Plan (SRMP) using the existing ANAO template.

5. Present and deliver findings to ANAO stakeholders in a format suitable for management and also sufficient detail at the technical level.

Security clearances

• Supplier personnel must hold a minimum AGSVA Negative Vetting 1 clearance.

Fee structure

1. Services must be quoted as follows:

• A fixed fee estimate for production of the protective security risk review documents, review of ICT controls; and Essential Eight Security Risk Management Plan.
• An hourly rate for updating any additional security management framework artefacts.

Buyer contact

procurement@anao.gov.au