Research and development consultancy services

Tender description

The Ministry of Education and Research holds overall responsibility for the information security in the university and university college sector (the UH sector) in Norway and is directly responsible for the state owned parts of the sector. The Ministry monitors this responsibility through their management processes and formal guidelines. The objective is: Evaluation of UNINETT's cyber security capabilities. Evaluation of the purpose and resource efficiency of UNINETT's activity in the field of information security on a sector level. The objective of the evaluation is to achieve better knowledge on the state of information security in the UH sector and how UNINETT's information security activities have affected this. Evaluation of UNINETT's cyber security capabilities. Evaluate the purpose and resource efficiency of UNINETT's activities in the information security field on a sector level. Evaluate to what degree the activities of the secretariat have had an effect on the management of leadership of information security at the individual institutions, and to what degree this has lead to effective preventative measures, and provide suggestions for improvement. Evaluate the Ministry's efforts to reduce organisational vulnerabilities identified by the Office of the Auditor General. Evaluate fulfilment of the mandate to the Secretariat for information security. Evaluate to what degree UNINETT CERT's activities have lead to effective identified, corrective and compensatory measures (‘compensatory control’) and provide suggestions for improvement. Evaluate the organisation of the information security work to UNINETT in general, and particularly CERT and the secretariat, and provide suggestions for improvement. Evaluate the applied resources and the organisation of the information security work on a sector level against the available risk evaluations. Tenderers need not carry out their own risk evaluation. The evaluation of resources and organisation should be based on the open risk evaluations to the national intelligence, surveillance and security service where all relevant risks should be evaluated. Evaluate UNINETT CERT's capability of incident management and the internal and external pre-requisites for this, and provide suggestions for improvement.