81314139-Provision requirements of Stage 1 Audit of ISO 27001 certification in Jordan's water sector

The tender focuses on enhancing IT security and governance within the Jordanian Water Sector (JWS) by implementing an Information Security Management System (ISMS) based on ISO/IEC 27001:2022. Work package 1: Develop an ISMS action plan to achieve "ISMS certification readiness" based on ISO/IEC 27001 ISMS (Annexes 3,4 and 5). As a preparation phase, the contractor will conduct a gap analysis to analyse the status of IT security in the JWS six institutes according to ISO/IEC 27001:2022 requirements and develop a detailed gap analysis report, based upon which an action plan which will be as inputs to the next activities. The contractor will work closely with the six Jordanian Water Sector entities to identify the requirements and scope of an IT governance framework based on ISO/IEC 27001:2022 ISMS for the six institutes, which also. encompasses the water sector cyber security strategy and action plan. The action plan to be developed includes organizational structure, policies, planning activities, responsibilities, practices, procedures, processes, and resources collectively managed by the JWS six institutes, in the pursuit of protecting their information assets and complying with their legal, regulatory, and contractual obligations. ISMS is a systematic approach for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving information security within the Jordanian Water Sector. The contractor will consider the review and analysis of the current status of the PARtner project and align the Action Plan (see below, WP 2) with their project deliverables on the Work Package on Developing Comprehensive Governmental Digital Services Standard (DSS) for Jordan. Work package 2: Implement the action plan according to the ISO 27001 Information Security requirements, incl. training and operation of the ISMS After the action plans have been agreed upon with each of the organisations separately, these will be implemented with each organisation respectively in order to make sure they achieve the state of readiness to operate an effective ISMS. The contractor will work closely with six institution teams with the goal of to implementing the approved action plan delivered by task 1 and achieve readiness to operate an effective ISMS. Work package 3: Conduct Internal audits and monitor ISMS operation Plan and conduct 6 institution Internal Audit programs as part of ISMS.