DEADLINE: 11TH NOVEMBER, 2022
NATIONAL IDENTITY MANAGEMENT COMMISSION (NIMC)
REQUEST FOR EXPRESSION OF INTEREST (REOI) FOR CONSULTANCY FOR COMPREHENSIVE PRIVACY AND SECURITY AUDIT OF NATIONAL IDENTITY MANAGEMENT SYSTEM (NIMS) INFRASTRUCTURE AND ECOSYSTEM
(1.0) BACKGROUND
The Federal Government of Nigeria (FGN) is in the process of harmonizing the existing ID ecosystem to develop a foundational ID system which can be leveraged to improve service delivery. A national strategy for identification, called the Strategic Roadmap for Developing Digital Identification in Nigeria, has highlighted the need for a minimalistic, foundational, and ecosystem-based approach to identification in the country. The Strategic Roadmap was approved by the Federal Executive Council of Nigeria (FEC) in 2018 and is being implemented in the framework of the Nigeria Digital ID4D project, with technical and financial support from the World Bank, French Development Agency (AFD), the European Investment Bank (EIB). The Strategic Roadmap is intended to offer a credible pathway for the FGN to develop identification by leveraging the FGN’s existing institutions, capacities, and systems.
Aligned with this Strategic Roadmap and the FGN’s National Strategic Action Plan for CRVS (2018-2022), the Nigeria Digital 1D4D project has been conceptualized with the primary objective to increase the number of persons with a national ID number, issued by a robust and inclusive foundational ID system, that facilitates their access to services.
The Project will be implemented by a Project Implementation Unit (PIU) in the National Identity Management Commission (NIMC) and an Ecosystem Coordination Strategic Unit (ECSU) under the oversight of a Project Ecosystem Steering Committee (PESC).
Under the ID4D Project, the enrolment of beneficiaries into the NIN system is to be carried out through an enrolment ecosystem approach, tinder which NIMC grants licenses to third-party vendors, called Front-End Enrolment Partners (FEPs), who enrol beneficiaries on NIMC’s behalf and receive a fee per successful enrolment (i.e.. one that generates a new NIN). Ahead of the rollout of ecosystem under the ID4D project, NIMC has independently begun to pilot an ecosystem arrangement and has issued licenses to around 150 FEPs who have set up enrolment centres or carry out mobile enrolment using portable devices in remote locations. NIMC also enrols beneficiaries at several its own enrolment centres,
NIMC’s experiences in licensing and management of FEPs to date has generated insights and lessons learned for the final ecosystem approach that will be financed by the ID4D project. The project will formalize and standardize the licensing and management of FEPs, notably through the creation of a Licensing and Assurance Framework (LAP), which will designate rules and procedures for the onboarding, assurance, certification, and performance monitoring of FEPs, Relevant findings from the privacy and security audits conducted under this consultancy may be used to inform the LAF or Standard Operating Procedures (SOPs) used by FEPs.
In addition to FEPs, the National Identity Management System (NIMS) also works with vendors who provide the front-end, middleware and back-end software solutions for the enrolment system, and whose activities and solutions will be reviewed as part of the audits to be conducted under this consultancy. Since the issuance and use of digital ID is intended to increase participation in the digital economy and provision of key services to the general population, the ID ecosystem will be a prime target for cyber- attacks. The fast-evolving and increasingly virulent threat landscape is raising the security stakes today. Given the highly distributed and interconnected nature of this project, security and cybersecurity are of critical importance.
It is therefore of high priority to evaluate privacy and security practices and controls to determine if these are implemented correctly, operating as intended, and achieving the desired outcome with respect to meeting defined best practice standards requirements, and provide recommendations if this is not the case.
Against this background, the PIU in NIMC intends to engage a consultancy firm with proven track record to carry out a detailed privacy and security audit of the current NIMS and ID ecosystem to reinforce security, data quality, and data protections.
(2.0) Objectives of the Consultancy Assignment
The objective of this consultancy is to conduct an independent comprehensive privacy and security assessment of the NIMS and ID ecosystem.
(3.0) Scope of Services
The firm is required to perform the following tasks to achieve the overall goal of the assignment.
(1) Conduct the formal Readiness Assessment of the NIMS for Nigeria DID4D project financing.
(2) Conduct Independent Privacy Audit of the NIMS and ecosystem,
(3) Conduct Independent Security Audit of the NIMS and ecosystem.
The TOR for the assignment is downloadable from https://tinyurl.com/PrivacyAudit
The PIU in NIMC now invites eligible Consulting firm/ Consortium to indicate their interest in providing the services. Interested Consulting firm/ Consortium should provide information demonstrating that they have the required qualifications and relevant experience to perform the services (brochures, description of similar assignments, experience in similar conditions, general qualification, and number of key staff and so forth).
Interested firm’s attention is drawn to Section III, paragraphs, 3.14, 3.16, and 3.17 of the World Bank’s “Procurement Regulations for 1PF Borrowers” Fourth Edition of November 2020, setting forth the World Bank’s policy on conflict of interest.
A Consulting Firm / Consortium will be selected in accordance with the Quality and Cost-Based Selection (QCBS) method set out in the Consultant Guidelines.
Further information can be obtained at the address below during office hours i.e., 9.00 a.m. to 4.00 p.m. (Local time).
Expressions of Interest must be sent in hard copy to the address below or by soft copy to the email addresses procurement@nigeriadid4d.org and copied to nimcid4d@nimc.gov.ng latest on Friday 11 November, 2022 at 4:00pm (local time)
The Coordinator,
Project Implementation Unit,
Nigeria Digital Identification for Development Project
Ecosystem BuildingNational Identity Management Commission (NIMC) HQ
11 Sokodc Crescent, off Dalaba Street
Zone 5 Wuse, Abuja – Nigeria
Email: procurement@nigeriadid4d.org.
Website: www.nimc.gov.ng
