RFP - Independent IT Security Audit for Egmont Group Secretariat

Detected April 7th, 2026

Summary

The Egmont Group Secretariat issued a Request for Proposals inviting qualified vendors to conduct an independent external security audit of its IT system. The audit will assess compliance with Egmont Group security, confidentiality, and access control requirements. The IT infrastructure is built on Microsoft Entra ID, Microsoft 365, and Microsoft Azure platforms.

View original document View source feed page

What changed

The Egmont Group Secretariat has released an RFP for an independent external security audit of its IT system. The scope includes assessment of security controls, confidentiality measures, and access control requirements across Microsoft Entra ID, Microsoft 365, and Microsoft Azure platforms. Vendors must demonstrate capability to evaluate secure communications, controlled access, and encrypted data handling.

This procurement action is administrative in nature and does not create compliance obligations for regulated entities. The RFP affects potential bidders in the IT security audit and cybersecurity consulting space. Other stakeholders are not directly impacted by this solicitation.

What to do next

Review RFP requirements and submission guidelines
Prepare and submit proposal if qualified to perform IT security audits
Ensure proposal demonstrates expertise in Microsoft Entra ID, M365, and Azure security assessment

Source document (simplified)

The official version of the website is the English version. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, or correctness of any translations made from English into any other language.

Select Language

English Spanish French Arabic
- About
- Organization and Structure
- Egmont Group Funding
- ECOFEL
- Leadership
- Financial Intelligence Units
- Money Laundering and Terrorist Financing
- News and Events
- Working Groups
- The Information Exchange Working Group (IEWG)
- The Membership, Support and Compliance Working Group (MSCWG)
- The Policy and Procedures Working Group (PPWG)
- The Technical Assistance and Training Working Group (TATWG)
- Members by Region
- Member FIU Information
- Become a Member
- Affiliates
- Become an Observer
- Resources
- Careers

News and Events

Request for Proposals: Independent IT Security Audit for the Egmont Group Secretariat > News and Events

Request for Proposals: Independent IT Security Audit for the Egmont Group Secretariat

The Egmont Group Secretariat (EGS) invites qualified vendors to submit proposals to conduct an independent external security audit of the Egmont Group IT system. The audit will assess compliance with Egmont Group security, confidentiality, and access control requirements.

The IT system is built on Microsoft Entra ID, Microsoft 365, and Microsoft Azure, supporting secure communications, controlled access, and encrypted data storage.

Scope of the Audit

The External Security Audit must include:

Manual testing, including external penetration testing in line with Microsoft Cloud Penetration Testing Rules of Engagement
Technical configuration and automated security assessments
Risk analysis of threats such as malware, viruses, and phishing A core requirement is that only designated users may access system data. Administrators, third parties, and service providers must not have access.

The audit will focus on:

Identity and access management and audit trails
Key generation and key management
Virtual machine access controls
End‑to‑end encryption and secure data storage
Hardware Security Module hardening
Compliance gap analysis against NIST, ISO/IEC 27001, and other applicable standards Deliverables must include documented findings, recommendations, and a proposed Plan of Action.

Timeline

The audit, including the final report, must be completed within three weeks of project kick‑off. A minimum of two draft review rounds is required.

Proposal Requirements

Proposals must include:

Scope of work and project plan
Fees, currency, timeline, and payment schedule
CVs demonstrating at least five years of relevant experience
Relevant security certifications
Proof of appropriate security clearance
Bios of all staff conducting the audit
Examples of similar work for government or security‑sensitive organizations All audit staff must be directly employed by the vendor.