Title: Security and Operational Risk Consultancy (Organization/ Individual)

Organization: Legal Aid Society (LAS)

Location: Islamabad, with travel to Karachi and programme districts in Punjab and Sindh

Position Type: Consulting Assignment (Contractual)

Duration: 12 months from the date of contract signing

Reporting Line: Program Manager

BACKGROUND

The Legal Aid Society (LAS) is a Karachi-based non-profit organisation that provides free legal aid, strengthens justice sector institutions and advocates for access to justice in Pakistan.

LAS is implementing a multi-year access to justice programme on fair trial standards across Punjab, Sindh and Islamabad Capital Territory, together with national and international partner organisations. The programme combines legal representation, capacity building of justice sector actors, research and advocacy, and community engagement.

Programme staff, lawyers, partners and beneficiaries work on sensitive criminal justice matters in a complex operating environment. Safe and uninterrupted delivery depends on robust security risk management, secure information systems and sound operational readiness, including effective coordination with relevant institutions and stakeholders.

To support this, LAS requires the services of an experienced Islamabad-based firm to provide security risk management and operational readiness support during the first year of the programme, and to assess security practices across LAS as an organisation.

OBJECTIVES OF THE ASSIGNMENT

The objectives of this consultancy are: (i) to finalise a Programme Security Plan and Incident Reporting Protocol covering in-person event safety, online programme security, staff emergency procedures and contingency arrangements; and (ii) to conduct an IT vulnerability assessment of the three information platforms used in programme delivery (case management system, Enterprise Resource Planning software and the programme digital helpline) and produce an IT Vulnerability Assessment Report.

SCOPE OF WORK AND EXPECTED DELIVERABLES

The consultant will undertake the following tasks:

A. Programme Security Risk Assessment and Plan

• Finalise the programme Security Plan, covering in-person event safety, safe movement and field travel protocols, online programme security, staff emergency procedures and contingency arrangements.
• Finalise the Incident Reporting Protocol, defining incident categories, escalation thresholds, reporting templates, documentation standards and response timelines.
• Deliver security induction for programme staff, covering key protocols, safe movement procedures and emergency response steps.
• Conduct a mid-term review of the Security Plan (at approximately Month 6) to assess any material changes in the operating environment and update the plan accordingly.
• Provide brief monthly security situation updates to the Program Manager throughout the assignment, flagging emerging risks and advising on any adjustments required.

B. IT Vulnerability and Platform Security Assessment

• Conduct a targeted vulnerability assessment of the three information platforms used in programme delivery: the case management system, the Enterprise Resource Planning software and the programme digital helpline. The assessment will cover access controls, data storage and transmission security, user authentication and configuration vulnerabilities relevant to the sensitivity of programme data.
• Engage LAS technical teams and relevant platform administrators to review current configurations, understand any prior assessments and identify remediation actions already underway.
• Produce an IT Vulnerability Assessment Report documenting findings by severity level (Critical, High, Medium, Low), with a prioritised remediation plan.
• Verify remediation: confirm that all Critical and High findings are resolved

Note: The total duration of this consultancy will be 08-12 months from the date of contract signing.
A detailed work plan with deliverable milestones will be finalised within the first month of the assignment.

REQUIRED QUALIFICATIONS AND EXPERIENCE

The consultant should meet the following minimum criteria:

• A registered firm or an experienced individual consultant with at least 5 years of standing in Pakistan in security risk management or related consultancy.
• A team lead with at least 10 years of experience in security risk management, including advising non-profit, development or human rights organisations in high-risk environments.
• Established professional networks with public institutions in Islamabad and the provinces, and proven experience supporting organisations with operational and administrative requirements.
• Familiarity with international donor standards on duty of care, security and data protection.
• Capacity to maintain strict confidentiality and to apply a do-no-harm approach to sensitive information.
• Demonstrated capacity to conduct basic digital security reviews, including familiarity with access control standards, data protection requirements and platform-level security assessment methodology 
• An office or established presence in Islamabad.
• Demonstrated capacity to conduct basic digital security reviews of web-based or cloud-hosted platforms, including familiarity with common vulnerability assessment methodologies.
• Relevant professional certification in security risk management or information security (such as CPP, CEH, CompTIA Security+ or equivalent) is an added advantage.

Reporting and Coordination

The firm will report directly to the Program Manager, Legal Aid Society, and will coordinate closely with the programme security focal person, the Head of Litigation, and the IT, Administration and Finance departments for guidance and progress validation.

Deliverables Schedule

REQUIRED DOCUMENTS FOR APPLICATION

Interested consultants are requested to submit the following documents:

1. Firm/ consultant Profile (including registration and tax registration details).
2. CVs of the Team Lead, and other proposed team members.
3. Evidence of Similar Assignments (security risk assessments, security planning, IT vulnerability assessments), with at least two references.
4. Technical Proposal (methodology, work plan, team composition and data protection approach).
5. Financial Proposal (itemised costing, including travel).

CONFIDENTIALITY AND OWNERSHIP

All data, documents and materials collected or produced under this consultancy, including security assessments, plans and information on staff, partners, beneficiaries and systems, shall remain the exclusive property of the Legal Aid Society. The firm must treat all information as strictly confidential, use it solely for the purposes of this assignment, sign a non-disclosure agreement, and return or securely destroy all LAS information at the end of the assignment.

PAYMENT TERMS

Payment will be made in installments linked to deliverables approved by LAS, as per the deliverables schedule above, the agreed contract terms and applicable financial policies.