Africa Re seeks to engage a qualified and experienced consultant or firm to provide comprehensive cybersecurity assurance services for its Information and Communications Technology environment on a renewable retainer basis following the completion of the baseline engagement. The engagement shall provide independent, risk-based assurance over the design and operating effectiveness of relevant cybersecurity governance, risk management, and control processes.
The objectives of the engagement are to:
• Provide independent and objective assurance on the adequacy and effectiveness of cybersecurity governance, risk management, and internal control processes.
• Assess the effectiveness of technical, administrative, and governance controls designed to protect information assets and technology resources.
• Identify cybersecurity risks, vulnerabilities, control weaknesses, and emerging threat exposures that could impact the Corporation’s strategic objectives.
• Evaluate the Corporation’s preparedness, detection, response, recovery, and resilience capabilities against evolving cyber threats, including threats enabled by emerging technologies and Artificial Intelligence.
• Assess compliance with relevant cybersecurity, data protection, and industry good-practice requirements.
• Provide practical, risk-based recommendations to strengthen cybersecurity maturity, resilience, and ongoing risk management capabilities.
• Support management and governance stakeholders through periodic assurance reporting and independent cybersecurity insights.
The cybersecurity assurance engagement shall include, at a minimum, the activities set out below. The Consultant shall apply a risk-based approach, validate findings through appropriate evidence, assess the design and operating effectiveness of relevant controls, and relate identified weaknesses to their potential business and operational impact.
For clarity and completeness, the cybersecurity assurance engagement shall be executed across the following assurance domains:
• Cybersecurity Governance and Oversight
• Cybersecurity Risk Management
• Technical Security Controls
• Security Monitoring and Incident Management
• Identity and Access Management
• Cybersecurity Awareness and Human Factors
• Third-Party and Supply Chain Security
• Operational Resilience and Business Continuity
• Emerging Technology and Artificial Intelligence Risks
• Data Protection and Regulatory Compliance.
Cybersecurity Risk Management: The Consultant shall assess the effectiveness of the Corporation’s cybersecurity risk management processes, including:
• Identification and assessment of cybersecurity risks across critical business processes, systems, networks, and information assets.
• Evaluation of risk assessment methodologies, risk-rating frameworks, and risk appetite considerations.
• Review of cyber risk mitigation, treatment, transfer, and acceptance processes.
• Assessment of the integration of cybersecurity risks into the Enterprise Risk Management (ERM) framework.
• Review of cyber risk monitoring, reporting, escalation, and governance mechanisms.
• Evaluation of management’s approach to emerging cyber threats and evolving risk exposures.
Cybersecurity Governance and Oversight: The Consultant shall assess the effectiveness of the Corporation’s cybersecurity governance arrangements and oversight mechanisms, including:
• Review of cybersecurity governance structures, committees, and reporting lines.
• Evaluation of the roles and responsibilities of the Board, Executive Management, Audit Committee, Risk Committee, and Information Security function in overseeing cybersecurity risks.
• Assessment of cybersecurity strategies, objectives, performance measures, and reporting mechanisms.
• Assessment of management oversight over cybersecurity investments, initiatives, and resource allocation.
• Review of the integration of cybersecurity considerations into business decision-making and strategic planning.
• Evaluation of management and Board reporting related to cybersecurity risks, incidents, control weaknesses, and remediation activities.
• Assessment of the extent to which cybersecurity governance practices align with recognized standards, regulatory expectations, and industry best practices.
Vulnerability Assessment and Technical Control Review: The Consultant shall conduct a detailed assessment of the Corporation’s internal and external ICT environment, including:
a. Internet Perimeter and External Security
• External vulnerability scanning
• Review of perimeter devices (e.g., firewalls, routers and gateways) configuration and security posture.
b. Internal Network and System Security
• Internal vulnerability scanning
• Review of access control mechanisms (logical access, privileged access);
• Assessment of email security controls;
• Wireless network security review.
• Assessment of identity and access management governance processes;
• Review of Joiner-Mover-Leaver procedures and user access lifecycle controls;
• Evaluation of privileged access management controls and monitoring activities;
• Assessment of periodic access reviews and segregation-of-duty controls;
• Evaluation of multifactor authentication implementation and effectiveness.
c. Administrative and Endpoint Controls
• Review of administrative security controls;
• Assessment of Active Directory policies and configurations;
• Mobile Device Management (MDM) controls and policies.
d. Application, Database, and Platform Security
• Database security configuration and access controls;
• Review of database security policies and procedures;
• Assessment of Microsoft Defender and Microsoft Compliance configurations.
External Penetration Testing: The Consultant shall perform a controlled external penetration test to simulate realistic cyberattacks against the Corporation’s internet-facing systems. Testing shall be conducted only within an agreed scope, during approved testing windows, and in accordance with documented rules of engagement designed to minimise disruption to operations. The assessment shall include:
• Attempting to identify and exploit external vulnerabilities
• Testing the effectiveness of existing security controls
• Attempting to bypass perimeter defences and gain unauthorized access, where feasible
• Documenting findings, attack paths, and potential business impact.
Social Engineering Assessment (Email Phishing): To evaluate employee cybersecurity awareness, the Consultant shall conduct a controlled email phishing simulation targeting a group of employees agreed with Africa Re. The simulation shall be designed and executed in accordance with approved scenarios, privacy requirements, escalation procedures, and safeguards for handling any information collected during the exercise. The assessment shall include:
• Design and execution of phishing scenarios.
• Measurement of user responses (e.g., click rates, credential submission, and reporting behaviour).
• Analysis of awareness gaps.
• Recommendations for improving employee cybersecurity awareness and training programs.
Information Security Program Assessment: The Consultant shall assess the organization’s information security governance framework, including:
• Review of the Information Security Program structure;
• Evaluation of roles, responsibilities, and accountability;
• Review of information security policies, standards, and procedures;
• Assessment of employee cybersecurity training and awareness initiatives;
• Alignment with recognized frameworks and best practices (e.g., ISO 27001, NIST, or equivalent).
Operational Resilience and Incident Preparedness: The Consultant shall evaluate the organization’s ability to respond to and recover from cyber incidents, including:
• Review and validation of Cyber Crisis Management Plans (CCMP);
• Assessment of incident response procedures and escalation protocols;
• Review of incident reporting, communication, and coordination mechanisms.
• Review of Business Continuity Plans (BCP) and related governance structures;
• Assessment of Disaster Recovery (DR) capabilities and recovery strategies;
• Evaluation of Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs);
• Review of business continuity and disaster recovery testing results;
• Assessment of remediation activities arising from continuity and recovery exercises;
• Evaluation of resilience against disruptive cyber incidents and operational outages.
Artificial Intelligence (AI) Threat Assessment: The Consultant shall assess the organization’s preparedness against cybersecurity threats amplified by emerging technologies, including Artificial Intelligence. This shall include:
• Identification of AI-enabled cyber threats relevant to the organization;
• Review of controls to detect, prevent, and respond to such threats;
• Assessment of AI usage risks within the organization, where applicable;
• Recommendations to enhance resilience against AI-driven attacks.
The assessment shall also evaluate governance arrangements governing the use of Artificial Intelligence technologies within the Corporation, including:
• Acceptable-use requirements;
• Data privacy implications;
• Model governance considerations;
• Risks associated with generative AI tools;
• Third-party AI services;
• Monitoring of AI-related risks and regulatory developments
Data Protection, Backup, and Security Policies: The Consultant shall review data protection practices and supporting policies, including:
• Backup and disaster recovery processes;
• Incident response plans and reporting procedures;
• Employee cybersecurity awareness and training programs related to data protection;
• Alignment with applicable regulatory and data protection requirements.
Security Monitoring and Threat Detection: The Consultant shall assess the effectiveness of cybersecurity monitoring, detection, and response capabilities, including:
• Review of security event logging and monitoring controls.
• Assessment of threat detection mechanisms and alert management processes.
• Evaluation of security incident monitoring, escalation, and investigation procedures.
• Assessment of the adequacy of security monitoring coverage across critical systems and infrastructure.
• Review of threat intelligence utilization and integration into security operations.
• Evaluation of management reporting on cybersecurity events, incidents, and emerging threats.
Third-Party Cybersecurity Risk Management: The Consultant shall assess the effectiveness of controls established to manage cybersecurity risks arising from third-party relationships, including:
• Vendor and supplier cybersecurity due diligence processes.
• Review of cybersecurity requirements in contracts, service-level agreements, and outsourcing arrangements.
• Assessment of monitoring and oversight processes for outsourced and cloud-based services.
• Evaluation of third-party access controls and data protection arrangements.
• Review of critical supplier dependency risks and associated contingency measures.
• Assessment of the Corporation’s ability to identify, monitor, and respond to cybersecurity incidents affecting third-party service providers.
