Information Security and Architecture Services

b)  SharePointBusinessIntegration

• Interact with the business and gather requirement and prepare integration of in- house project, plan
• Sharepoint management, setup best practices and implement new features and optimization.
• Knowledge, training and awareness to IT and business teams.
• Documentation and processes, procedures
• Integration of 3rd party products for monitoring alerting and security enhancements e.g. Varonis

c)  Security and IT assessments, Penetration testing & 3rd party audits

• Internal and external penetration testing, security assessments.
• Penetration testing will include the use of automated and manual tools and techniques to analyze information systems and business logic for potential vulnerabilities resulting from poor or improper system configuration, both known and unknown hardware or software flaws, and operational weaknesses in process or technical countermeasures.
• Provide security and IT assessments against international standards and best practices.
• Provide senior management with prioritized action plans and technical reports.
• Develop baseline secure configurations and build configuration assessments.
• Develop and support remediation efforts when required. Assess (and remediate) security configuration of information assets including platforms, network, and applications to identify vulnerabilities to industry benchmarks and Global Fund regulations and standards.
• Develop secure development life cycle process review and policies. Conduct code reviews and remediation. Review source code to verify the existence of security controls, ensuring that they work as intended, that they have been invoked through secure channels and at appropriate times, and to ensure the code is free of backdoors and malware.
• Develop audit plans against international standards such as ISO-27001/2 and specific Global Fund criteria.
• Conduct 3rd party audits on suppliers when required for assurance.

Engagement

Global Fund cannot guarantee the exact number of project hours that the selected suppliers will be awarded.

Global Fund recognizes that personnel changes within the bidder’s organization may affect the availability of personnel. Bidders should strive to retain the same personnel for Global Fund to ensure continuity and build knowledge of the environment and provide consistent services. Bidders should also cater for additional resources in case of multiple security services are being awarded to the same firm.

Global Fund reserves the right to accept or reject the use of specific personnel on an individual project basis.

Periodic performance reviews will be conducted to review KPI’s related to quality of service provided, availability of qualified personnel, adherence to SLAs for lead time, review of feedback including issues and challenges received from Global Fund stakeholders.

Each selected firm should propose a Program Manager who would be the focal point of engagement with Global Fund.