[bestbits] Digital Security for FH's Emergency Assistance Program

[myers at freedomhouse.org]

Dear all,

Freedom House's Emergency Assistance Program is seeking to engage a digital
security consultant/firm for a short to medium term opportunity. Please feel
free to share widely among your networks:
https://freedomhouse.org/content/digital-security-support-freedom-houses-emergency-assistance-program-1

Thanks,

Aaron Myers


Digital Security Support for Freedom House’s Emergency Assistance Program
Request for Proposals

Consultancy Overview

Freedom House’s Emergency Assistance Program (EAP) provides rapid financial
assistance to front line human rights defenders (HRDs) and civil society
organizations (CSOs) targeted because of their human rights work. Since 2007,
EAP has given over 4,000 grants in over 100 countries.

Freedom House seeks a firm, team, or individual capable of boosting the
digital security capacity of Freedom House’s Emergency Assistance Program
(EAP) through a short-term consultancy.

The consultancy first seeks to audit the current practices and infrastructure
of EAP as it pertains to the lifecycle of emergency assistance, including
intake of cases, communication with beneficiaries and stakeholders (including
donors), storage and collection of data, and current digital security tools
and procedures.

After completion of the audit, the selected firm/consultant will be expected
to develop a strategy for addressing EAP’s digital security needs, including
developing strategies for both internal and external components of the
program. Strategies will seek to address immediate low-hanging fruit, while
setting out plans of action for more resource intensive interventions in
consultation with EAP staff around labor/financial/programmatic restrictions.
The strategy will also propose and document digital security protocols for EAP
staff to follow through their case work, including developing strategies based
on working with a diverse set of beneficiaries in terms of culture, religion,
sexual orientation and gender identity, as well as technical capability and
level of risk.

After the strategy development, the firm/consultant will conduct a series of
staff trainings on the developed protocols. Training should include strategies
for determining the digital security risks/threat models of beneficiaries,
selecting tools/approaches based on these circumstances, and limited training
of trainers (ToTs) to enable regional specialists to remotely build the
capacity of potential beneficiaries to communicate securely during the course
of emergency assistance.

The consultancy will culminate with the development of final recommendations
on hiring a permanent staff member on EAP to address digital security, longer-
term recommendations to improve digital security that could not be completed
during the consultancy due to restrictions on time/labor hours/funding, and
any other additional thoughts on potential program development, including the
collection of digital security data.


ACTIVITY ONE:  AUDIT OF CURRENT PRACTICES AND INFRASTRUCTURE

Output: Audit/ Security Assessment report detailing findings delivered to the
EAP team


ACTIVITY TWO: ADDRESSING AUDIT FINDINGS- INTERNAL

Output: Internal strategy and plan of action for addressing digital threats
related to infrastructure, internal communications, and intersection of EAP
with other Freedom House units.


ACTIVITY THREE: ADDRESSING AUDIT FINDINGS- EXTERNAL

Output: Develop/Revise Digital Security Protocols for EAP


ACTIVITY FOUR:  DIGITAL SECURITY TRAININGS / BASIC TOTS FOR STAFF

Output: Digital security trainings conducted for EAP Staff Members


ACTIVITY FIVE:  FINAL RECOMMENDATIONS

Output: Final Recommendations Report


Evaluation Criteria

1.Proposal Narrative (35%)

2.Capacity and Past Performance (35%)

3.Timeline (5%)

4.Cost Proposal (25%)


Submission Instructions

Tuesday, November 30th, 2016 (11:59 PM EST) is the deadline for submitting
full proposals. Applications will be evaluated on a rolling basis. Interested
parties should request a full RFP at consultancy at freedomhouse.org. Requests to
receive the full RFP should include a short statement of qualifications, bio,
or CV.

Freedom House reserves the right to forgo sharing the full RFP based on
qualifications. Submission of a response to the RFP does not bind Freedom
House to engage the firm/consultant to provide the requested services. The
bidding party is solely responsible for the costs it incurs in responding to
this request for proposal.