Description
The African Development Bank Group (AfDB or “the Bank”) relies on a diverse digital environment comprising enterprise applications, cloud and on-premises infrastructure, network services, identity platforms, endpoints, databases, application programming interfaces (APIs), and third-party connections. Protecting the confidentiality, integrity, and availability of these assets is essential to the Bank’s operations and development mandate. The Corporate Information Technology Services Department, through the Cybersecurity Division (TCIS.6), intends to engage a qualified cybersecurity services firm to provide independent, on-demand penetration testing and security testing services. The engagement will help identify exploitable vulnerabilities, validate realistic attack paths, assess business impact, and provide actionable remediation guidance before weaknesses can be used by threat actors. Each testing exercise will be initiated through a specific statement of work or task order defining the authorized scope, objectives, exclusions, schedule, access arrangements, deliverables, and commercial terms. Testing may be performed remotely or at the Bank’s Headquarters in Abidjan, Côte d’Ivoire, subject to the Bank’s authorization and security requirements.
|
|
|
|
|
|---|
|
|
|
|---|
|
|
15.Information Management Technology |
|---|
|
|
1. Overall Objective
To engage a qualified and independent cybersecurity services firm to provide authorized, risk-based, and on-demand penetration testing and security testing across Bank-approved systems, applications, infrastructure, cloud services, identities, and related technology environments. The services shall identify and validate exploitable weaknesses and realistic attack paths, assess their technical and business impact, provide prioritized and actionable remediation guidance, and verify the effectiveness of corrective actions through retesting, thereby strengthening the Bank’s security posture and cyber-resilience while protecting sensitive information and minimizing operational disruption.
2. Specific Objectives
• Identify and validate vulnerabilities, security misconfigurations, design weaknesses, insecure business logic, and exploitable attack paths in systems approved by the Bank.
• Assess the likely technical and business impact of successful exploitation on confidentiality, integrity, availability, privacy, and service continuity.
• Demonstrate, safely and only within approved boundaries, how vulnerabilities may be combined to gain unauthorized access, elevate privileges, move laterally, or access sensitive data.
• Provide prioritized, technically actionable remediation guidance, likely root cause, compensating controls, and strategic improvement recommendations.
• Perform remediation validation and retesting to confirm effective closure of agreed findings.
• Improve internal capability through debriefings, knowledge transfer, and reusable testing insights. |
|---|
|
|
Individual assignments may include one or more of the following services:
• External and internal network and infrastructure penetration testing.
• Web application, API, mobile application, thick-client, database, middleware, ERP, and source-code security testing.
• Cloud security assessments covering configurations, identities, workloads, services, and exposed interfaces.
• Active Directory, authentication, authorization, privilege escalation, endpoint, segmentation, wireless, and remote-access testing.
• Attack-path analysis, vulnerability validation, security architecture review, and configuration assessment.
• Controlled red-team, social-engineering, or physical security testing only when expressly and separately authorized.
• Executive and technical reporting, immediate escalation of critical findings, remediation guidance, technical readouts, retesting, and closure reporting.
• Knowledge transfer, lessons learned, root-cause themes, and strategic control-improvement recommendations.
The exact scope, authorized targets, exclusions, testing windows, permitted techniques, data-handling requirements, deliverables, schedule, and price will be defined in a written task order and approved Rules of Engagement before testing begins. |
|---|
|
|
• Engagement initiation pack: Scope confirmation, work plan, methodology, prerequisites, team contacts, schedule, dependencies, test source details, risk controls, and draft Rules of Engagement.
• Approved Rules of Engagement : Authorized scope, boundaries, permitted techniques, exclusions, emergency procedures, communications, data-handling requirements, and written authorization.
• Test execution updates: Concise status updates covering progress, blockers, emerging risks, and material scope changes.
• Critical finding notifications: Immediate notification with validated evidence, affected assets, potential impact, and urgent containment guidance.
• Draft executive and technical report: Executive summary, scope, methodology, limitations, attack narrative, findings, evidence, severity, root cause, remediation, and appendices.
• Technical and management readout: Presentation of material findings, business implications, remediation priorities, and questions.
• Final report and remediation register: Incorporates validated comments and provides a trackable register with owner, priority, target date, status, and residual-risk observations.
• Retest and closure report: Retest evidence and status of each finding: remediated, partially remediated, not remediated, not retested, accepted risk, or superseded.
• Secure evidence disposal attestation: Written confirmation that Bank data, credentials, evidence, and working copies were returned or securely destroyed, subject to agreed retention.
• Lessons learned and knowledge transfer: Debrief, recurring root causes, control improvement themes, and reusable recommendations. |
|---|
| D. Duration and Timetable for the Assignment | |
|
Framework contract with assignments commissioned through individual task orders or statements of work.
Twelve (12) months, subject to the final solicitation and contract. |
|---|
| E. Bank Contribution and Institutional Arrangement | |
|
The Bank will provide the Consultant with all relevant documentation necessary for the execution of the assignment.
The Bank will also provide access to office premises, IT systems, tools, and relevant Bank platforms. |
|---|
|
|
Remote and/or at the Bank’s Headquarters in Abidjan, Côte d’Ivoire, as authorized. |
|---|
| G. Essential Specialized Skills/Knowledge/Competencies | |
|
1. Institutional Experience
• At least five (5) years of corporate experience delivering independent penetration testing and security assessment services.
• At least three (3) comparable penetration-testing or security-testing assignments completed during the previous five (5) years, preferably for multilateral development banks, international organizations, financial institutions, government institutions, or other regulated or similarly sensitive entities. The firm shall provide at least three client references or other independently verifiable evidence. Where contractual confidentiality prevents disclosure of a client’s identity, sufficient anonymized information and alternative evidence shall be provided to permit verification.
• Demonstrated experience in at least four (4) relevant domains, including infrastructure, web applications and APIs, cloud, identity services, mobile applications, databases and middleware, SAP/ERP, network segmentation, or wireless environments.
• A documented and repeatable methodology aligned with recognized practices such as NIST SP 800-115, OWASP testing guidance, PTES, OSSTMM, MITRE ATT&CK, or equivalent standards.
• A documented quality-assurance process and secure procedures for handling credentials, findings, source code, screenshots, reports, and testing evidence.
• Appropriate professional indemnity, cyber-liability, and employer-liability insurance, with limits to be defined at the solicitation or contract stage.
• No actual, potential, or perceived conflict of interest that could compromise independence or objectivity.
2. Organizational Accreditation
Organizational accreditation for penetration testing services, such as CREST or an independently verifiable equivalent, is desirable and may be considered during shortlisting. Where an equivalent is proposed, the firm should explain how it evaluates technical capability, governance, quality assurance, data protection, ethical conduct, and consistency of service delivery. Accreditation is not a mandatory eligibility requirement unless expressly stated by Procurement.
3. Indicative Key Personnel
• Engagement / Technical Lead: At least eight (8) years of cybersecurity experience, including at least five (5) years leading complex penetration-testing or red-team engagements in financial, regulated, or similarly sensitive environments.
• Senior Penetration Tester: At least five (5) years of hands-on penetration-testing experience, competence in at least two relevant domains, and participation in at least three comparable penetration-testing or security-testing assignments during the previous five years.
• Penetration Tester: At least three (3) years of relevant hands-on security-testing experience and recent experience with the assigned technology.
• Specialist Resources: Recent demonstrated experience in relevant specialist areas such as cloud, Active Directory, API, mobile, ERP, databases, wireless, source-code review, or red-
• Independent Quality Reviewer: At least seven (7) years of relevant assessment experience and independence from the principal tester responsible for producing the finding under review.
4. Certifications
Certifications are supporting evidence and shall not replace recent hands-on experience. Relevant credentials may include OSCP, OSEP, OSWE, OSCE3, OSMR, CREST CRT/CCT, relevant GIAC certifications, technology-specific cloud or Microsoft security certifications, CISSP, CCSP, CISM, ISO/IEC 27001 qualifications, or equivalent credentials. The Engagement / Technical Lead should hold at least one relevant advanced technical certification or equivalent independently verifiable qualification supported by substantial practical experience. |
|---|
|
|
The firm will report to the Division Manager, Cybersecurity Division (TCIS.6), or a designated Bank officer responsible for the assignment. The firm shall work closely with authorized Bank stakeholders while preserving independence, confidentiality, and strict need-to-know access. Progress meetings and written status reporting will be scheduled for each assignment. |
|---|
Consultancy Input Days
|
|
