Guangdong Agricultural Product Quality and Safety Improvement (Demonstration) Project Information Technology Service Package II (Cybersecurity Level Protection Assessment Service and Commercial Cryptography Application Security Evaluation Service)

What the buyer is asking for

REQUEST FOR EXPRESSIONS OF INTEREST INFORMATION TECHNOLOGY CYBERSECURITY LEVEL PROTECTION ASSESSMENT SERVICE AND COMMERCIAL CRYPTOGRAPHY APPLICATION SECURITY EVALUATION SERVICE for China Food Safety Improvement Project Guangdong Agricultural Product Quality and Safety Improvement (Demonstration) Project Country: People's Republic of China Name of Project: China Food Safety Improvement Project Loan No.: IBRD-92130 Assignment Title: Guangdong Agricultural Product Quality and Safety Improvement (Demonstration) Project Information Technology Third-Party Service Package II (Cybersecurity Level Protection Assessment Service and Commercial Cryptography Application Security Evaluation Service) Reference No.: GD-FSS-GAMR-CS13 The Guangdong Administration for Market Regulation has received financing from the World Bank toward the cost of the China Food Safety Improvement Project Guangdong Agricultural Product Quality and Safety Improvement (Demonstration) Project, and intends to apply part of the proceeds for consulting services. The total estimated amount for this project is RMB 0.56 million. (I) Scope of Service The service scope of this project covers the Cybersecurity Level Protection Assessment and Commercial Cryptography Application Security Assessment services required for four informatization projects, specifically including: The "Scan-to-Trace" Full-Chain Traceability Platform Project for Food in Key Fields (Categories); The "Yue-Shi-An Internet Plus Open Kitchens" System Construction Project; The Upgrade, Renovation, and Operation Project of the Emergency Real-Time Dispatch and Command System; The Capacity Building Project for Food-Related Personnel in Market Regulation. (II) Service Contents 1. Cybersecurity Level Protection Assessment Services Based on the assessment results of security technology and security management controls, as well as the overall system assessment, the service agency shall conduct a comprehensive assessment of the information system in accordance with the corresponding level standards and provide relevant security review opinions. This specifically includes two aspects: First, security control assessment, which primarily evaluates the implementation and configuration of basic security controls required by the cybersecurity level protection standards within the information system. Second, overall system assessment, which primarily analyzes the overall security of the information system. The security control assessment serves as the foundation for the overall security assessment of the information system. 2. Commercial Cryptography Application Security Assessment Services The service agency shall provide security assessment services for systems upgraded with domestic cryptography. For the upgraded national cryptographic systems, the agency shall formulate an assessment plan, conduct the assessment, propose rectification opinions, and track the rectification progress in accordance with national specifications, thereby providing a basis for project acceptance. Through this assessment service, the agency will comprehensively understand the current status of cryptography application in the relevant information systems and evaluate the gap between the current status and the corresponding levels stipulated in the Information Security Technology—Basic Requirements for Cryptographic Application of Information Systems (GB/T 39786-2021). This aims to achieve the goals of promoting construction, rectification, and application through assessment. On-site assessments and technical verifications will be conducted covering physical and environmental security, network and communication security, equipment and computing security, application and data security, key management, and security management. The agency will identify weak links and potential risk hazards in cryptographic applications, propose targeted rectification recommendations, and ensure the compliance, correctness, and effectiveness of cryptographic…