Bhutan National Cybersecurity Risk Assessment Consultancy Services

GovTech/ACCESS/PMU/2025-26/ January 14, 2026 ACCELERATING TRANSPORT AND TRADE CONNECTIVITY IN EASTERN SOUTH ASIA (ACCESS) – BHUTAN PROJECT REQUEST FOR EXPRESSION OF INTEREST (REoI) (CONSULTING SERVICES – FIRMS SELECTION) Country: Bhutan Name of Project: Accelerating Transport and Trade Connectivity in Eastern South Asia (Access) – Bhutan Project Loan No/Credit No/ Grant No: IDA 77560 (Credit)/IDAE4310 (grant) Assignment Title: Selection of consultancy firm for National Cybersecurity Risk Assessment (NCRA) Deployment Reference No: GovTech/CS-3/6

• Royal Government of Bhutan has received financial assistance in the form of Credit and Grant from the World Bank towards the cost of the proposed Accelerating Transport and Trade Connectivity in Eastern South Asia (ACCESS)-Bhutan Project , to be implemented partly by the GovTech Agency , and intends to apply a part of the proceeds of this financing for the services of Selection of consultancy firm for National Cybersecurity Risk Assessment (NCRA) Deployment.
• The broad scope of services (“the Services”) includes

(i) Reviewing the NCRA Methodology and NCRA Guide (ii) Kick-off the NCRA process (iii) Institutional Risk Assessments (iv) Preparation of reports/documents (v) Dissemination workshops/presentations (vi) Training/knowledge transfer

• Detail Terms of Reference (TOR) and other information will be available upon request from the address provided below either through email or in person. ToR is also available on www.tech.gov.bt
• The GovTech Agency now invites eligible consulting firms (“Consultants”) to indicate their interest in providing the Services. Interested Consultants should provide information demonstrating that they have the required qualifications and relevant experience to perform the Services. The shortlisting criteria are:

a) General Experience of the firm in providing similar services (core business and years in business); b) Experience in similar assignments of compatible size, complexity and technical specialty in the required area including demonstrable track record or relevant project success, regional work experience and understanding; c) Technical and managerial capability of the firm, staffing and logistics. Consultants are requested to submit, but not limited to, the following supporting documents in support of the above-mentioned criteria: (i) The Firm's Incorporation/Trade/registration documents from the country of the firm; (ii) Firm’s brochures; (iii) description of similar consultancy contracts, including the scope, contract amount, name of Client, period of the contract (date of contract signing to date of completion), location/ country of the services, etc. Key Experts will not be evaluated at the shortlisting stage .

• The attention of interested Consultants is drawn to Section III, paragraphs, 3.13, 3.15, and 3.16 of the World Bank’s “Procurement Regulations for IPF Borrowers” September 2023 (“Procurement Regulations”), setting forth the World Bank’s policy on conflict of interest. In addition, please refer to the following specific information on conflict of interest related to this assignment as per paragraph 3.17 of the Procurement Regulations: Consultants shall not be hired for any assignment that would be in conflict with their prior or current obligations to other clients, or that may place them in a position of being unable to carry out the assignment in the best interests of the Borrower.
• Consultants may associate with other firms to enhance their qualifications but shall indicate clearly whether the association is in the form of a joint venture (i.e. all members of the joint venture shall be jointly and severally liable) and/or a sub-consultancy (i.e. the Consultant will be responsible, including for the services of the sub-consultant). In case of an association, the Consultant must explain in the EoI submission (a) the rationale/ justification for the proposed inclusion of the JV members and/or sub-consultants; and (b) the anticipated role and relevant qualifications of each member of the Joint Venture and/or of each sub-consultant for carrying out the assignment. Failure to provide the above explanation in the EoI may risk the association not being shortlisted for the assignment. However, the qualifications/ experience of sub-consultants will not be considered in the evaluation of Expressions of Interest for Shortlisting. The total number of firms in the association will be limited to a maximum of Two (02).
• A Consultant will be selected in accordance with the Consultants Qualification Based Selection (CQS) method as set out in the Procurement Regulations.
• The expected duration of the assignment is 40 weeks.
• Further information can be obtained at the address below during office hours [0900 to 1700 hours]
• The authority reserves the right to accept or reject any or all EoIs without assigning any reason, whatsoever.
• Expressions of interest must be delivered in a written form to the address below (in person, or by mail, or by e-mail) by 1500 hours (Bhutan Time) (GMT + 6 hours) on or before February 13, 2026. Please clearly mention “Expression of Interest (EoI) for Selection of consultancy firm for National Cybersecurity Risk Assessment (NCRA) Deployment in the e-mail’s subject line or on the top of the envelope.

Ms. Dechen Chhoeden, ICT Analyst Cyber Security Division Government Technology Agency Street Address: Thori Lam, Upper Chubachu City: Thimphu ZIP/Postal Code: 11001 Country: Bhutan Telephone: PABX No.: +975-2-323215 Email id : dchhoeden@tech.gov.bt Website : www.tech.gov.bt Agency: GovTech Agency Procurement method: Consultant Qualification Selection Notice type: Request for Expression of Interest Status: Published Value: 150000.0 USD