Consultancy on “Development of a Regional Framework for Post-Quantum Cryptography in the Arab Region”

The incumbent will be responsible for: • The final Regional PQC Framework report, in Arabic or English, at least 30 pages; • A 2 to 4-page executive summary of the framework; • A PowerPoint presentation on the framework. The completed parts should be edited and saved in MS-Word (*.docx file) or an alternate compatible format. Note that PDF format will not be accepted. It should include a table of contents to be automatically updated followed by a list of all tables and figures. The various parts should be submitted in electronic form and sent to the email of the designated focal point. Attention is kindly drawn to the need to ensure that the final draft of the outputs be thoroughly reviewed prior to submission and to indicate the sources of tables and diagrams. References to reports and other substantive material should be clearly indicated within the text and noted at the end. It is also essential to send, with the completed output, photocopies or scans of at least the first page of books, reports and bulletins, used as reference material as well as copies of the pages quoted. The content of the generated document shall be the sole property of ESCWA. Their contents cannot and must not be presented, discussed or published without the express authorization of ESCWA. The consultant shall keep in mind that ESCWA routinely checks all deliverables for plagiarism using readily available electronic tools. All previously published content, even if written by the selected consultant, must be clearly referenced where required within the text and end-noted at the end of the study. The report submitted by the consultant must not contain quoted, previously published text equalling more than 20 per cent of the total number of pages. The consultant shall not publish or announce or reveal the content of the report, partly or entirely, on social media or any other public channel, without ESCWA permission.

Remote

4 Months

I. Background Digital transformation is a major focus of national development plans in many Arab countries․ Providing digital services such as e-government‚ digital identification‚ e-payment and online banking‚ e-commerce‚ and other digital infrastructure services‚ including water‚ electricity‚ and communications services‚ relies on encryption to foster public trust․ Advances in quantum computing research and technology pose a risk to these services because a person with access to a sufficiently powerful quantum computer could access many common forms of encrypted communications․ Although there are no commercial quantum computers‚ current and future threats include harvesting encrypted data today for future decryption by quantum computers‚ “harvest now‚ decrypt later․” Government and other information that is stored for 10 years or more is already vulnerable․ Implementing alternative‚ or post-quantum‚ cryptographic systems is difficult and costly for governments and other organizations that use supply chains and other legacy technologies․ International experience shows that implementing PQC can take many years and requires political commitment and other support‚ such as legal authorities and funding for trained staff․ Failure to plan for PQC implementation could cost governments and others business opportunities and cause disruptions to essential services․ PQC research efforts around the world have advanced to policymaking efforts․ The first PQC standards were published in August 2024 by the US National Institute of Standards and Technology (NIST)․ Other international standards bodies are adopting PQC standards for Internet and other commercial uses․ Deadlines for adoption of PQC standards have been set by governments around the world․ • United States: Proposed federal standards would eliminate or substantially reduce the use of quantum-vulnerable encryption by 2030 and eliminate all such use by 2035‚ with an earlier cutoff for national security applications of encryption․ • EU: The Coordinated Roadmap for Implementation (June 2025) provides national action plans for EU member states to start implementing protections for high-risk systems by the end of 2026 and finish implementation by 2030․ Implementation by 2035 is encouraged but not mandatory․ • Other countries‚ including the United Kingdom‚ Canada‚ Australia‚ Singapore‚ Japan‚ the Republic of Korea‚ and others‚ have produced national migration strategies․ The G7 and other groups representing the financial sector have promoted coordination in migration efforts․ These timeframes will impact other trading partners and financial and technology firms that do business with Arab countries․ Arab States are at different stages of readiness․ Some Arab States have begun to act․ • UAE: In November 2025‚ the government of the UAE approved a National Encryption Policy requiring government entities to prepare approved PQC transition plans․ Implementation of the policy is overseen by the UAE Cybersecurity Council and supported by a National Post-Quantum Migration Program․ • KSA: The National Cybersecurity Authority of the KSA has revised national cryptographic rules‚ and government services are piloting quantum-resistant technologies․ • Other Gulf Cooperation Council nations: Bahrain and Qatar‚ have started working with other groups on PQC pilot projects․ Most other Arab States have not yet begun to develop plans to transition to PQC․ Challenges to transitioning include a shortage of skilled and other personnel‚ use of older and imported technologies‚ and limited finances․ There is no regional mechanism to help coordinate policy efforts among Arab States transitioning to PQC․ If countries in the region adopt new cybersecurity measures at different speeds and in different ways‚ current cybersecurity systems may not be compatible or secure․ A regional approach can help Arab States coordinate cybersecurity policies and implementation plans‚ share research and testing resources‚ provide support to countries with less capacity‚ and gain other benefits in negotiations with technology suppliers․ Other advantages of a regional approach to cybersecurity include preventing harm to other regional digital and economic development goals from cybersecurity threats․ ESCWA will hire a consultant to conduct a survey of international and regional practices and assess PQC readiness in the region and its Member States and develop a framework for institutional PQC in Arab countries․ II. Duties and responsibilities The consultant will be responsible for the following: - Inception: o Hold a kick-off meeting with ESCWA to confirm scope, stakeholders, methodology, timeline and communication arrangements. o Map stakeholders in each Member State and at regional level: national cybersecurity authorities and CERTs, ICT and digital-government ministries, central banks and financial regulators, telecom regulators, national certification authorities and PKI operators, standards bodies, critical-infrastructure operators (energy, water, transport), academia and industry; and regional bodies such as the League of Arab States, the Arab ICT Organization (AICTO), the Regional Cybersecurity Centre (ITU-ARCC). o Prepare an inception report with a detailed workplan, methodology, readiness assessment tools and consultation plan. - Review of international and regional best practices o Review the PQC standards landscape and its maturity (such as Germany's BSI, France's ANSSI, Korea's KpqC, China's national programme) and implications for interoperability in a region that trades with all of them. o Analyze existing PQC strategies and roadmaps, (such as US, EU, UK). o Review existing PQC initiatives in the Arab region (such as UAE, KSA, Egypt). o Identify lessons learned, success factors and pitfalls relevant to Arab States at differing levels of cybersecurity maturity, including fragile and resource-constrained contexts. - Assessment of regional readiness o Develop a PQC readiness assessment framework, aligned where possible with the ITU Global Cybersecurity Index, covering Policy, strategy and legal/regulatory basis, Governance, Awareness and leadership commitment., Technical infrastructure, Human capacity) o Collect data, and desk review of national documents, and interviews or focus groups with key stakeholders, covering priority sectors (such as government, telecommunications) o Analyze gaps, barriers and risks - Drafting the Regional PQC Framework o The framework would include components such as Vision, principles, targets, Governance, phased regional roadmap. o Prepare a model national PQC roadmap template that Member States can adapt. - Consultation, validation and finalization o Present draft findings and the draft framework to Member States and stakeholders and organize (in person or virtually) a regional validation workshop. o Incorporate comments into a revised framework, with comments’ matrix. o Prepare an executive summary and a presentation suitable for senior officials or ministerial endorsement. ESCWA promotes gender equality, disability inclusion, and integration of youth through its publications and therefore the consultant should pay attention, with the help of ESCWA staff, to the inclusion of gender, disability, and integration of the youth dimension throughout the research work to ensure that it gives equal attention to the needs of both men and women, and girls and boys. Writing should use gender-sensitive and inclusive language.

A Master’s degree in ICT, computer science, information technology, computer engineering, cybersecurity, public policy or a related field is required; a Ph.D. is desirable. All candidates must submit a copy of the required educational degree. Incomplete applications will not be reviewed. A minimum of 10 years of professional experience including 5 years in research on, or the formulation of, digital, cybersecurity or development policies is required Excellent communication and writing skills are required. . Demonstrated experience in cryptography, cybersecurity policy or post-quantum migration planning is required; experience working with governments in the Arab region is desirable.

English and French are the working languages of the United Nations Secretariat; and Arabic is a working language of ESCWA. For this position, Fluency in Arabic and English is required; Knowledge of French is desirable. Note: “Fluency” equals a rating of ‘fluent’ in all four areas (speak, read, write, and understand) and “Knowledge of” equals a rating of ‘confident’ in two of the four areas

Recruitment for this position is on a local basis. The incumbent is required to have the legal right to live and work in the specified working location.

THE UNITED NATIONS DOES NOT CHARGE A FEE AT ANY STAGE OF THE RECRUITMENT PROCESS (APPLICATION, INTERVIEW MEETING, PROCESSING, OR TRAINING). THE UNITED NATIONS DOES NOT CONCERN ITSELF WITH INFORMATION ON APPLICANTS’ BANK ACCOUNTS.