> **MEMORANDUM** > > **To:** Security Assessment Consultant > **From:** Tshering Pem, Director of Digital Services, Bhutan Tourism Council > **Date:** [Current date] > **Subject:** Request for Security Assessment and Monitoring Implementation > > **1. Background** > > The Royal Government of Bhutan has issued Directive 2026/CS-04 requiring all ministries and agencies operating public-facing digital services to implement continuous security monitoring and undergo an independent security assessment by the end of the current fiscal quarter. > > **2. Scope of Engagement** > > The Bhutan Tourism Council operates three digital portals: > - Tourism Services Portal (tourist-facing -- booking coordination, information) > - Guide Management System (guide licensing, credential verification, employment records) > - Internal Operations Platform (staff communications, document management, reporting) > > These systems were developed at different times by different vendors and store sensitive data including tourist passport numbers, guide credentials, and internal communications. > > **3. Requirements** > > We require: > (a) An assessment of the security posture of all three portals > (b) Implementation of a centralized monitoring and detection system as specified by the directive > (c) Detection rules for the most critical threats > (d) A compliance report for submission to the Ministry of Information and Communications > > **4. Constraints** > > All three portals must remain operational throughout the assessment. Tourist season is ongoing and service disruption would affect our international commitments. > > Please confirm receipt and advise on your proposed approach. **Discovery mode:** Primary client -- the memo provides institutional context and portal names but minimal technical information. The student discovers the security architecture through conversation. No suggested message buttons (P8 is at mid-late scaffolding).