Digital and Cyber Security Helpdesk for Civil Society Organisations

_Background

SOUTNA is a 24-month civil society strengthening programme implemented by Cordaid in Iraq across Baghdad, Erbil, Basra and Ninawa. It works with 180 civil society organisations (CSOs), selected in three cohorts, and runs CSO Resource Hubs in the four governorates. Under Activity 1.4, SOUTNA sets up three specialised helpdesks for CSOs: digital security, legal advice and protection, and psychosocial first aid.

_Purpose

To provide practical, accessible and confidential digital and cyber-security assistance to participating CSOs, helping them prevent, identify and respond to common digital risks, incidents and unsafe practices.

_Objectives

• Provide timely first-line digital-security guidance and incident triage.
• Help CSOs secure accounts, devices, communications and data.
• Support containment, recovery and referral for incidents.
• Build practical cyber-hygiene skills.
• Support CSO staff and volunteers facing online extortion, harassment, impersonation or hacked personal accounts linked to their work.
• Provide proportionate digital-security assessments and action plans.
• Coordinate with legal and MHPSS helpdesks where incidents overlap.

Scope of Services

Basic digital security

• Password/passphrase and MFA guidance.
• Secure configuration of email, cloud, messaging and collaboration accounts.
• Updates, encryption, screen locks, backups and secure storage.
• Phishing, social engineering and account-takeover prevention.
• Secure communications and safer public-Wi-Fi/removable-media practices. 

Incident response

• Triage suspected compromise, phishing, malware, unauthorised access or data exposure.
• Containment guidance including recovery and session/credential management.
• Evidence-preservation guidance where safe.
• Recovery and post-incident recommendations.
• Referral to specialist digital-forensics, legal or platform support where required.

Security assessment

• Rapid review of accounts, devices, access control, backups, communications and basic policies.
• Priority risks and practical mitigation plan.
• Follow-up review where requested.

Training

• Cyber hygiene and phishing awareness.
• Account/device security.
• Secure communications and data handling.
• Incident reporting and first response.

Organisational support

• Basic digital-security policy/checklist.
• Incident-response and escalation procedure.
• Access-control, backup and staff onboarding/offboarding guidance.
• Protecting the personal data of the people CSOs serve, in line with each CSO's protection and safeguarding policies.

Online extortion and harassment affecting staff

• Immediate safety advice: do not pay, do not negotiate, do not delete messages.
• Securing and recovering personal accounts, including social media accounts.
• Guidance on documenting evidence safely for reporting.
• Reporting to platforms and requesting removal of content or fake accounts.
• With the person's consent, referral to the legal helpdesk for a complaint to the competent authorities, and to the MHPSS helpdesk for psychosocial support.
• A female specialist is available on request.

Service Levels

Eligibility and Provider Profile

• Individual cyber-security, information-security, digital-safety and IT specialists may apply.
• Small specialist firms, consultancies, NGOs and companies may apply.
• One qualified specialist or a small team is acceptable.
• Relevant technical qualifications/certifications may be provided; equivalent demonstrated experience is acceptable.
• Experience with NGOs, civil society, humanitarian actors, journalists, activists or comparable users is preferred.
• Demonstrated experience handling online extortion, harassment or account-takeover cases, including reporting to social media platforms.
• Ability to provide a female specialist on request is an advantage.
• Arabic is required; Kurdish capacity is strongly preferred for Erbil.
• Applicants must accept Cordaid security, confidentiality, data-protection, safeguarding and code-of-conduct requirements.

Flexible delivery, service requests and verification

• The service is on-demand; no minimum volume is guaranteed.
• Cordaid may contract one or several providers by location, specialisation, language, availability and value for money.
• Applicants may offer the full scope or selected service categories.
• Services may be delivered remotely, at SOUTNA hubs or another agreed safe location.
• Travel is undertaken only when requested/approved.
• Services are requested only through SOUTNA. A cohort CSO contacts its hub focal point, and the SOUTNA team issues a written service order stating the case code, service level and agreed number of units. Work done without a service order is not paid.
• For confidential cases the service order carries only the case code. The provider keeps the identity of the person or organisation served in its own records and does not pass it to Cordaid.
• Each completed service is documented in a short service record, signed by the provider and confirmed by the requesting CSO focal point or, for confidential individual sessions, by the service user against the case code. The confirmed service record is the basis for payment.
• With the consent of service users, Cordaid may run spot checks to verify delivery and quality.

Safeguarding / Security Boundaries

• Only authorised defensive security activity is permitted.
• No unauthorised access, exploitation, credential theft, surveillance or destructive activity.
• No access to third-party systems without explicit authorisation.
• Do not request or retain passwords, OTPs or private keys except under an exceptional authorised secure process.
• Security testing must have a defined written scope.
• No software, monitoring or remote-access tools are installed on a CSO device without the written consent of the CSO, and remote-access sessions are closed once the task is done.
• The provider never asks for, views or keeps intimate images or similar material, and never contacts or negotiates with the perpetrator.
• Nothing is reported to the authorities without the informed consent of the person affected.

Confidentiality and Data Protection

• All case information is confidential and handled on a need-to-know basis.
• Collect only information necessary to provide the service.
• Use coded/anonymised case records where possible.
• Report relevant safeguarding or security incidents through the agreed Cordaid channel.
• Use secure communication, storage and file-transfer methods appropriate to the sensitivity of the information.

Expected Deliverables

• Helpdesk contact/response protocol.
• Coded case/service log.
• Security assessment and action-plan template.
• Incident-response/escalation protocol.
• Short service records for payment and monitoring.
• Periodic anonymised summary of recurring risks.
• Awareness materials/session content where requested.

Service Standards

Financial Proposal

Applicants shall submit unit-based rates in USD, inclusive of applicable taxes and directly associated costs. No fixed monthly retainer or minimum service volume is guaranteed. Services will be requested on an as-needed basis, and payments will be made only for cases received, services delivered, and outputs accepted by Cordaid, at the agreed unit rates.

The agreed rates shall apply to the relevant service units outlined below. Any travel or other reimbursable costs must be approved by Cordaid in advance and supported by appropriate documentation.

Evaluation

Only offers scoring at least 56 of the 80 technical points go forward to financial evaluation. The lowest compliant financial offer receives the full 20 points and other offers are scored in proportion to it. Where applicants offer only some service categories, Cordaid compares prices within each category. Cordaid may interview shortlisted applicants before final selection.

Contracting and Payment

Payment will be made against accepted services delivered at agreed unit rates. Cordaid may contract multiple providers and may stop assigning services where quality, safeguarding, confidentiality, availability or value-for-money requirements are not met.

General Conditions

• Conflicts of interest must be declared before accepting a case.
• Providers shall comply with Cordaid Code of Conduct, safeguarding, PSEAH, anti-fraud and data-protection requirements.
• Providers shall not use SOUTNA/Cordaid information for unrelated purposes.
• Cordaid and its authorised auditors may inspect relevant records as required.
• Cordaid may suspend or terminate services for serious quality, safeguarding, security, confidentiality or compliance concerns.
• Payments are subject to any tax deductions Cordaid is legally required to make in Iraq or the Kurdistan Region.
• Cordaid may cancel this call or decide not to contract, without obligation to applicants. Applicants bear their own costs of preparing an offer.

Application Requirements

Technical proposal, maximum 8 pages, covering services, methodology, response model and referral/escalation.

CV(s) of proposed specialist(s), qualifications and relevant experience.

Professional/company registration or licence where applicable.

Two relevant references, where available.

Unit-rate financial proposal using the table above.

Signed declaration covering independence, conflicts of interest, confidentiality, safeguarding and acceptance of Cordaid policies.

Declaration of honour that the applicant is not in any situation of exclusion and is not on any international sanctions list. Cordaid screens all selected providers before contracting.

You can apply through the link: Application Form

For further information or any additional inquiries, please feel free to contact us by email: project_soutna@cordaid.org