3-Day onsite cybersecurity and governance awareness training for aidc employees

Returnable documents:

• SBD 4 (Bidder's Disclosure): must be completed, signed, and certified as true. Discloses employment by an organ of state, relationships with procuring institution staff, and all CSD-registered companies linked to directors. Non-disclosure of any active CSD company leads to disqualification.

Disqualification risks:

• Listing on the Register for Tender Defaulters or the List of Restricted Suppliers.
• False declaration in SBD 4.

Bidders must not appear on the Register for Tender Defaulters or the List of Restricted Suppliers; listing results in automatic disqualification.

SBD 4 (Bidder's Disclosure) must be completed, signed, and certified as true, covering employment by an organ of state and any relationship with persons employed by the procuring institution.

All active companies registered on the CSD and linked to all directors must be declared; non-disclosure leads to disqualification.

A bid found to be based on a false declaration will be disqualified, and suspicious bids may be referred to the Competition Commission or law enforcement.

No additional evaluation criteria beyond those in the standard evaluation section.

The department requires a suitably qualified and accredited training service provider to deliver a 3-day onsite training in cybersecurity and governance awareness to all AIDC employees at the Automotive Supplier Park in Rosslyn.

Returnable documents:

• SBD 6.1 Preference Points Claim Form: completed and signed, claiming B-BBEE preference points with supporting proof attached.

Disqualification risks:

• Failure to submit proof or documentation required to claim specific-goal points means no preference points are claimed for that goal.
• A bidder who fails to complete the claim form in full or completes it incorrectly receives a score of zero for that goal.

Evaluation split:

• Price: 80 points
• Specific goals (B-BBEE status): 20 points
• Total: 100 points

Preference point system: 80/20 (applicable to requirements with a Rand value up to R50 000 000, all applicable taxes included).

Specific goals points (B-BBEE status level):

• Level 1: 20 points
• Level 2: 15 points
• Level 3: 10 points
• Level 4: 5 points

Supporting evidence required to claim B-BBEE points:

• Valid affidavit issued by the DTI or CIPC (original or certified copy), or
• Certified copy of a SANAS-accredited verification certificate.

Failure to submit the required proof means no preference points are claimed for that goal.

The department requires a suitably qualified and accredited training service provider to deliver a 3-day onsite training in cybersecurity and governance awareness to all AIDC employees at the Automotive Supplier Park in Rosslyn.

B-BBEE requirements:

• Bidders must claim B-BBEE status on the SBD 6.1 Preference Points Claim Form.
• Supporting evidence must be an original or certified copy of a valid affidavit issued by the DTI or CIPC, or a certified copy of a SANAS-accredited verification certificate.
• B-BBEE status levels 1 to 4 qualify for specific-goal points (Level 1: 20 points, Level 2: 15 points, Level 3: 10 points, Level 4: 5 points).
• Bidders who fail to complete the claim form in full or incorrectly will receive a score of zero for that goal.

Evaluation split:

• Price: 80 points
• Specific goals (B-BBEE status): 20 points
• Total: 100 points

Preference point system: 80/20 (applicable to requirements with a Rand value up to R50 000 000, all applicable taxes included).

Specific goals points (B-BBEE status level):

• Level 1: 20 points
• Level 2: 15 points
• Level 3: 10 points
• Level 4: 5 points

Supporting evidence required to claim B-BBEE points:

• Valid affidavit issued by the DTI or CIPC (original or certified copy), or
• Certified copy of a SANAS-accredited verification certificate.

Failure to submit the required proof means no preference points are claimed for that goal.

AIDC is a developmental agency of the Gauteng Growth and Development Agency (GGDA) focusing on automotive and allied sector development in Gauteng. This RFQ seeks an accredited training service provider to deliver a 3-day cybersecurity and governance awareness training to all 156 AIDC employees at the Automotive Suppliers Park in Rosslyn. The training covers 13 modules including phishing, password security, data protection, malware, compliance, social engineering, secure email, governance, safe web browsing, AI risks, ransomware, and an interactive quiz. Printed manuals and certificates of attendance must be provided.

Closing date and time: 17 November 2026 at 11:00.

Issue date: 10 November 2026.

Validity period: 90 business days from closing date.

SCM contact:

• Name: Dane Visagie (Requested By SCM)
• Telephone: (012) 564-5003

Department requested for: HR Department

General RFQ and submissions:

• Email: [email protected]

No briefing session (not applicable).

Submission method: email to [email protected]. Do not copy any AIDC personnel (including the SCM official) on the email — responses with AIDC employees copied will be disqualified.

All required documents must be attached. Bidders who only submit a quotation on letterhead without completing the RFQ documents will not be considered.

RFQ reference: PR00000016452.

Returnable forms (must be completed, signed and attached):

• SBD 4 (Declaration of Interest) – full completion and signature required; incomplete or unsigned forms lead to disqualification.
• SBD 6.1 (Preference Points Claim) – must be completed in full to claim points; errors result in zero points for specific goals.
• SBD 6.2 (Declaration for Local Production and Content) – required; incomplete forms lead to zero points.
• Pricing schedule – must be fully completed and signed; incomplete forms lead to disqualification.
• Integrity Pact – must be fully completed and signed; incomplete forms lead to disqualification.
• SARS PIN to verify tax status.
• Valid B-BBEE affidavit (DTI/CIPC template) or SANAS accredited verification certificate.
• POPIA consent – respondents must provide consent for processing of personal information.
• Pre-qualification documents: training accreditation certificate, cybersecurity professional certification, and facilitator CV.

Disqualification risks:

• Submission after closing time.
• Incomplete or unsigned SBD 4, pricing schedule or Integrity Pact.
• Missing mandatory or pre-qualification documents.
• Quoting conditional or non-firm prices.

Evaluation stages:

1. Compliance – all mandatory and administrative documents must be submitted.
2. Pre-qualification – must meet all pre-qualification requirements.
3. Price (80 points) and Specific goals (20 points) – 80/20 preference point system per PPPFA and PPR 2022.

Specific goals points (out of 20):

• B-BBEE Level 1 – 20 points
• B-BBEE Level 2 – 15 points
• B-BBEE Level 3 – 10 points
• B-BBEE Level 4 – 5 points

Supporting evidence: a valid DTI/CIPC affidavit (original or certified copy) or a SANAS accredited verification certificate. Points are only awarded if SBD 6.1 is fully completed and the evidence attached.

Functionality is not applicable (N/A).

No minimum qualifying score is stated.

The appointed accredited training provider must deliver a 3-day cybersecurity and governance awareness training programme to all 156 AIDC employees.

Training format:

• Three consecutive days; employees split into three groups of about 52 per group.
• Each group attends one full day, one group per day, daily from 09:00 to 16:00.
• All 156 employees must receive the same comprehensive content.

Location: boardroom at the Automotive Suppliers Park, Rosslyn, Pretoria. AIDC provides the venue.

Training content must cover:

• Introduction to cybersecurity, South African cyber threat landscape, psychological warfare and tactics, social engineering and spam vectors, preventing cyber threats, real-time video demonstrations.
• Phishing awareness: types, identifying red flags, safe email practices, reporting suspicious emails.
• Password security: best practices, password management, multi-factor authentication.
• Data protection: types of sensitive data, handling, storage and disposal, VPN.
• Malware awareness: types, spread methods, detection and removal.
• Compliance and regulations: relevant laws, requirements, consequences of non-compliance.
• Social engineering: definition, types, identifying attempts, safe communication.
• Secure email communication: secure connections, avoiding suspicious links and downloads, software updates.
• Governance: principles, frameworks, compliance with policies, accountability, transparency, risk management.
• Safe web browsing: secure connections, avoiding malicious content.
• Use of AI and Risk: AI risks, governance, ethics, regulatory compliance, safe use, mitigating AI-related risks.
• Ransomware: definition, types, spread, prevention and response.
• Interactive quiz: random cyber quiz for participants.

Deliverables:

• Printed training manuals/materials for all delegates.
• Training certificates of attendance for every participant who completes the training.

Service period: 3 days only.

Bidders must hold a valid training accreditation certificate for IT training from a recognised South African regulatory body (MICT SETA, DHET, QCTO, SAQA, ETDP SETA).

A recognised cybersecurity professional certification is required (CompTIA Security+, CISSP, Microsoft Security, ISO 27001, CISM, CISA, CGEIT or similar).

The facilitator must provide a CV demonstrating at least 5 years of relevant experience as a training facilitator.

Pricing must be submitted on the provided schedule. Only firm prices in South African Rand (excl. VAT) are accepted; conditional quotes will not be considered.

Line items:

• Cybersecurity and governance awareness training for 156 employees (3 days) – unit and total price.
• Printed training materials for 156 attendees – unit and total price.
• Training certificates for 156 attendees – unit and total price.

Sub-total, VAT at 15%, and total must be shown.

Prices must be valid for at least 90 days from closing. A firm delivery period must be indicated.

No price alterations after closing are permitted without AIDC's specific provision.

Pricing must be quoted in South African Rand and must be firm and valid for at least 90 days from the closing date.

All prices must be inclusive of all costs and VAT; VAT must be shown separately by VAT vendors. Non-registered or deregistered vendors must exclude VAT.

A detailed pricing schedule must be submitted based on the following items (quantities given):

• Cybersecurity and governance awareness training for all AIDC employees (3 days, quantity 156 employees) – unit and total price exclusive of VAT.
• Printed training materials for 156 attendees – unit and total price.
• Training certificates for 156 attendees – unit and total price.

Sub-total, VAT at 15%, and total must be computed.

A firm delivery period must be indicated.

Conditions:

• No price alterations after closing or after award are accepted.
• Quotes subject to confirmation or qualified by own conditions will not be considered.
• Government Procurement General Conditions of Contract apply and may not be amended.
• Prices are fixed for the contract period; negotiation with the preferred supplier is possible where applicable.
• Purchases are made only via an official AIDC purchase order or letter of award; the supplier must ensure these are received before delivering or rendering services.

No bid security, bond or guarantee is stated.

The 80/20 preference point system applies as the contract value is between R2,000 and R50 million.

CSD registration: bidders must be registered on the National Treasury Central Supplier Database (CSD) with an active status. A CSD number must be provided. AIDC cannot do business with suppliers not registered on CSD per National Treasury SCM Instruction No. 17.

Tax compliance: a valid SARS PIN must be submitted to verify tax status.

B-BBEE evidence:

• EME (revenue ≤ R10 million): sworn affidavit confirming annual total revenue and level of black ownership.
• QSE (revenue between R10 million and R50 million): sworn affidavit or B-BBEE level verification certificate.
• Above R50 million: valid B-BBEE certificate (recognisable by SANAS logo).
• The affidavit must use the approved DTI or CIPC template and be an original or certified copy.

Training accreditation:

• Company must hold a valid training accreditation certificate for IT training from a recognised South African regulatory body (MICT SETA, DHET, QCTO, SAQA, ETDP SETA).

Cybersecurity certification:

• Company or facilitator must hold a recognised cybersecurity professional certification (CompTIA Security+, CISSP, Microsoft Security, ISO 27001, CISM, CISA, CGEIT or similar).

Facilitator experience:

• Facilitator must provide a CV showing at least 5 years of relevant experience as a training facilitator.

CIDB and safety file: For any construction-related work (not directly applicable), a Safety File would be required before work commences. CIDB grading is not specified for this training tender.

SBD 6.2 (Declaration for Local Production and Content) must be signed; non-compliance scores zero.

For construction-related services/work, a Safety File will be required on appointment and must be submitted to AIDC before any work commences. Bidders must comply with relevant CIDB grading where required. This is not construction work, so no specific health and safety plan is required for this training RFQ.

Evaluation follows: Compliance, Pre-qualification, then Price (80) and Specific goals (20) under the 80/20 system.

Administration criteria: SARS PIN, valid B-BBEE affidavit/certificate, SBD 6.1.

Mandatory documentation: SBD 4, pricing schedule, Integrity Pact (incomplete forms disqualify).

Pre-qualification documents: training accreditation certificate, cybersecurity certification, facilitator CV.

Functionality: N/A.

Specific goals: B-BBEE level based points as detailed above.