Background

The Asia-Pacific Economic Cooperation (APEC) is a regional economic forum established in 1989. APEC members aim to create greater prosperity for the people of the region by promoting balanced, inclusive, sustainable, innovative and secure growth and by accelerating regional economic integration.
The APEC Secretariat is the core supporting institution of APEC. Located in Singapore, the Secretariat provides analytical and policy support, institutional coordination in support of up to 80 APEC fora, technical and advisory support as well as financial management and communications, public information and stakeholder engagement. APEC-funded projects are a key part of the APEC process. The Secretariat is responsible for managing the APEC project system and plays a central role in the development, implementation and evaluation of around 200 projects per year. This is done in close partnership with a range of external parties including project overseers, APEC fora, project participants and project contractors.
The purpose of this exercise is to solicit offers from qualified vendors to provide outsourced cybersecurity services to the APEC Secretariat. The services we are looking for is composed of two parts: cybersecurity consulting and annual Managed Security Service. Cybersecurity consulting will be a one-time service. For MSS, we will optionally enter into an annual contract depending on the approval from our governing body.

The successful vendor shall provide professional cyber security services including, but not be limited to, the following:

 Consulting Service (one time)
1. Analyze current cybersecurity state of the Secretariat through various way such as risk/vulnerability/threat assessment.
2. Provide cybersecurity enhancement plan or roadmap for the Secretariat d on the item 1. [This will be the tasks or investment that the Secretariat need to carry out in the short or long term]
3. Develop a model cybersecurity plans/policies, procedures; recommend tools and ensure coordination with the data privacy policy of the APEC Secretariat. [i.e.
technical policies and configuration (Acceptable Use, Change Management, Updates Management, Account Management, Network Security, Backup, Remote Access, Vulnerability Management, Email security, Clean Desk, Incident Response, Monitor & Logging)]

 Managed Security Service (annual)

1. Conduct periodic onsite visits (or reviews) to assist the Secretariat in tailoring the model cyber security plan to meet the changing situations.

2. 24/7 monitoring of systems and response/advice.
3. Regular reports on security status.
4. Incident response and forensics.
5. Prepare training materials and conduct training for the Secretariat staff as needed.
Deliverables
The successful vendor shall produce the documents while carrying out its tasks. The items 1 and
2 of the consulting service must be delivered by 15 July, 2022.
 Consulting Service (one time)
1. APEC Secretariat Cybersecurity Assessment Report
2. APEC Secretariat Cybersecurity Enhancement Plan/Recommendations
3. APEC Secretariat Model Cybersecurity plans/policies/procedures
 Managed Security Service (annual)
1. Update on the Secretariat Model Cybersecurity plans/policies/procedures
2. Regular reports on Security Status.
3. Incident response & Forensics report.

4. Training materials

Format for Proposal Submission
Proposal document can be either Word or PowerPoint format and shall comprise two parts:
1. Technical Competency
• technical reputation, methodology, proposed solution, work plan/timeline of
delivery of services, project team and details, existing clientele, relevant
experience, local presence, certifications.
2. Costing (Detailed breakdown)
• Consulting Service (one time)
• Managed Security Service (annual)

An outline of the Secretariat’s current IT systems:
- 75 ~ 85 users (on premise and remote)
- 75 ~ 85 end users with their issued computers and some users with their own devices (phones,
tablets, computers)
- 24 on premise servers (primarily Microsoft Windows servers and a few Linux servers)
- Microsoft Windows Server services (File & Storage, DNS, Active Directory, DHCP)
- Microsoft Hyper-V Cluster
- Microsoft Sharepoint Server
- Microsoft SQL server
- Sage AccPac
- Data Backup system
- VPN appliance for 75 users
- Palo Alto security appliance
- 3 internet gateways
- balancer
- Cloud services that Secretariat is subscribed to
o MS Office 365
o MS Azure
o Secondary DNS services
o AWS hosting the public web servers (www.apec.org)
o Satellite websites hosted outside APEC Secretariat (such as publications.apec.org)
o Outsourced payroll system (using eFrontier)