Supply, implementation and managed service of a human risk management and security awareness training platform (2,200 licences) for south african airways

SAA requires a single service provider to supply, implement, configure and manage an enterprise Human Risk Management and Security Awareness Training solution.

• The service must be fully managed and enterprise-grade, aimed at improving user behaviour, strengthening security culture and lowering human-related cyber risk.
• Delivery is a continuous awareness programme of adaptive, behaviour-driven micro-learning covering phishing, password management, data protection, mobile and remote working, cloud usage and secure digital behaviour.
• Training must run automatically and repeatedly, and adapt to each user's behaviour, risk profile and progress.
• Phishing simulation must support unlimited campaigns, automated scheduling, behavioural feedback and interaction reporting.
• The content library must be continuously updated and aligned to ISO 27001, NIST and CIS Controls.
• A minimum of 2,200 user licences is required, scalable during the contract without reimplementation.
• Behavioural analytics must include human risk scoring, security culture measurement, maturity assessment and trend analysis, with monthly and quarterly dashboards and reports.
• SAA may negotiate contract terms and pricing with a prospective provider, and awards at its own discretion.

Closing: 12 November 2026 at 16:00

Issue date: 03 November 2026

Quote validity: 180 days from closing

No compulsory briefing or site visit is stated.

Enquiries and submission

• Email: [email protected]
• Email: [email protected]
• Business unit: Global Supply Management, South African Airways (Pty) Limited
• Telephone: not stated

No physical delivery address is given; submission is by email only.

Submission method

• Email only, to both addresses: [email protected] and [email protected]
• Maximum email size: 2MB per message. Larger submissions must be split into parts or supplied as a downloadable link.
• SAA accepts no responsibility for links that are corrupt or cannot be opened.
• Late quotations are not considered. Incomplete submissions invalidate the quote and the bidder is disqualified.

Returnable documents (all must accompany the quote)

• SAA Vendor application and supporting documents (Annexure 1).
• SBD 4 (Declaration of Interest): discloses whether any director or shareholder is employed by the state or connected to anyone at SAA.
• SAA General Conditions of Contract (Annexure 3): signed acceptance of SAA's contract terms.
• Valid original Tax Clearance Certificate, where SAA does not already hold a current one on file.
• Signed written quote form with vendor details (name, postal address, telephone, cell, email, contact person, capacity).
• Statements of compliance, each marked Yes or No with supporting proof attached.
• Formal undertakings on the bidder's official letterhead for NIST Cybersecurity Framework compliance and for data protection compliance.
• CVs of key delivery personnel, ISO/IEC 27001 certificate or documented adherence evidence, vendor accreditation or reseller proof, client testimonial letters, sample dashboards and reports.

Quote validity: 180 days.

Bidders who decline to quote must notify the relevant procurement official by email.

Five-stage evaluation, run sequentially (SAA may run stages in parallel; passing one stage does not confirm earlier stages).

Stage 1 — Administrative responsiveness

• All returnable documents completed, signed by an authorised respondent and returned by the closing date and time.
• Validity of all returnable documents verified.

Stage 2 — Substantive (mandatory) responsiveness

• 100% compliance required on every statement of compliance, marked Yes with supporting evidence.
• A "No" answer is read as non-compliance and disqualifies the bid.
• Missing returnable documents (critical criteria) disqualify the bid.

Stage 3 — Technical functionality (100 points, minimum qualifying score 70%)

• Implementation lead time: 10% — 0 to 4 weeks = 10 points; 4 to 6 weeks = 5 points; more than 6 weeks = 0 points.
• Experience in cybersecurity awareness and human risk management projects over the last five years: 25% — 3 clients = 25 points; 2 clients = 10 points; 1 client = 5 points; none = 0 points. Testimonial letters on client letterhead with contactable details required.
• Platform capability and managed service delivery: 25% — 4 or more signed-off projects = 25 points; 3 = 15 points; 2 = 10 points; 1 = 5 points; none = 0 points. At least 3 different clients over 5 years is the stated minimum.
• Reporting, analytics and human risk measurement: 20% — comprehensive capability with advanced dashboards and measurable outcomes = 20 points; basic to moderate with sample dashboards = 10 points; none = 0 points.
• Skills and qualifications of the delivery team: 20% — 4 or more CVs = 20 points; 3 CVs = 15 points; 2 CVs = 10 points; 1 or no CVs = 0 points.
• Bids scoring below 70% on functionality are not evaluated on price or specific goals.

Stage 4 — Price: 80 points.

Stage 5 — Specific goals: 20 points

• B-BBEE Level 1 or 2: 10 points. Non-compliant bidders and Level 3 to 8 contributors score 0.
• 30% or more black women owned: 10 points.

Award is at SAA's sole discretion. SAA is not obliged to accept the lowest quotation and may withdraw the RFQ at any time. Post-tender negotiations may be held before the letter of award is issued.

Scope

• Supply, implementation, configuration and ongoing management of an enterprise Human Risk Management and Security Awareness Training solution for SAA.
• Fully managed, enterprise-grade service that improves user behaviour, strengthens security culture and reduces human-related cyber risk.

Licensing

• Minimum 2,200 user licences to cover the current SAA user population.
• Licensing model must scale to additional users during the contract without a full platform reimplementation.

Training content and delivery

• Continuous, automated, recurring cybersecurity awareness programme using adaptive, behaviour-driven micro-learning.
• Topics must cover phishing awareness, password management, data protection, mobile and remote working security, cloud usage and secure digital behaviour.
• Content tailored per user according to behaviour, risk profile and learning progress.
• Continuously updated content library aligned to ISO 27001, NIST and CIS Controls.

Phishing simulation

• Unlimited phishing campaigns with automated scheduling, behavioural feedback prompts and reporting on user interactions.

Analytics and reporting

• Human risk scoring, security culture measurement, maturity assessments and trend analysis.
• Dashboards and reports tracking user engagement, training completion, phishing performance, behavioural change indicators and overall human risk posture.
• Reporting on a monthly and quarterly basis.

Integration and managed service

• Integration with existing security operations and monitoring environments, including Active Directory, SSO and email.
• Full platform administration, content updates, phishing simulation management, reporting and technical support for the contract duration.

Implementation

• Initial planning and maturity assessment, requirements gathering, tenant setup, branding, policy configuration, Azure AD / SSO / email integration, and awareness and phishing campaign configuration.
• Implementation timeline to be supplied in table format.

Mandatory experience

• Proven deployment, implementation and management of a recognised Human Risk Management and Security Awareness Training platform in enterprise environments.
• Vendor partnership, accreditation, authorisation or reseller status for the proposed solution; where no formal programme exists, prior implementation and management experience with project references and client reference letters.

Scored experience (functionality)

• Cybersecurity awareness, phishing simulation or human risk management projects in the last five years: 3 clients = 25 points; 2 clients = 10 points; 1 client = 5 points; none = 0 points. Each must be backed by a testimonial letter on the client's letterhead with contactable details.
• Managed service delivery: 4 or more signed-off projects = 25 points; 3 = 15 points; 2 = 10 points; 1 = 5 points; none = 0 points. At least 3 different clients over 5 years is the stated minimum.
• Reporting and analytics capability: advanced dashboards with human risk scoring, behavioural analytics, culture measurement, trend analysis and executive reporting = 20 points; basic to moderate sample dashboards = 10 points; none = 0 points.

Team qualifications

• CVs of key personnel delivering and managing the platform, showing cybersecurity certifications, experience, references and a minimum qualification.
• 4 or more CVs = 20 points; 3 CVs = 15 points; 2 CVs = 10 points; 1 or no CVs = 0 points.
• Minimum qualification profile: 4 IT Diploma or higher qualifications plus 2 cybersecurity certifications.

Quote on the three-line schedule, exclusive of VAT, showing unit cost and total cost per line.

• Item 1 — Licensing, quantity 2,200: full platform licence covering security awareness, phishing simulation, behavioural analytics and content library.
• Item 2 — Implementation and integration, quantity 1: planning and maturity assessment, requirements gathering, tenant setup, branding, policy configuration, Azure AD / SSO / email integration, and awareness and phishing campaign configuration.
• Item 3 — Managed service (support and maintenance), quantity 12: end-to-end management of the awareness programme including phishing simulations, campaign execution, reporting, risk scoring and content customisation.

Pricing conditions

• All prices exclusive of VAT.
• Prices must be firm and fixed; only VAT changes are allowed.
• Pricing must be itemised by individual solution component against the technical and functional requirements.
• Service, pricing and availability are all weighed.
• Purchases proceed only against an official SAA purchase order.

Pricing format

• Quote per line item, exclusive of VAT, with unit cost and total cost.
• Item 1: 2,200 platform licences (security awareness, phishing simulation, behavioural analytics, content library).
• Item 2: 1 implementation and integration package.
• Item 3: 12 months of managed service (support and maintenance).
• Pricing must be broken down by individual component of the solution.
• All prices must be firm and fixed; only VAT changes are permitted.
• Service, pricing and availability are all taken into consideration.

No bid security, performance guarantee, retention or turnover threshold is stated.

Payment and ordering

• All purchases are made against an official SAA purchase order; no goods or services may be delivered before an official order or contract is received.
• SAA reserves the right to negotiate contract terms and prices with a preferred service provider.

Mandatory eligibility

• Demonstrated experience deploying, implementing and managing a recognised Human Risk Management and Security Awareness Training platform in enterprise environments.
• Proof of partnership, accreditation, authorisation or reseller status with the proposed solution vendor; where no such programme exists, evidence of prior implementation and management experience with project references and client reference letters.
• Alignment with internationally recognised cybersecurity standards such as ISO/IEC 27001 — a certificate from an accredited certification body, or documented evidence of adherence (information security policies, operational procedures, governance frameworks, independent third-party security assessments).
• Professional certifications and minimum qualifications: 4 IT Diploma or higher qualifications plus 2 cybersecurity certifications.
• Formal undertaking on the bidder's official letterhead confirming compliance with the NIST Cybersecurity Framework.
• Formal undertaking on the bidder's official letterhead confirming compliance with applicable data protection regulations, covering collection and use, safeguarding, transfer to third parties, retention, data subject rights, and personal data breach notification and response procedures.
• Evidence of fully managed service capability, including previous reports.
• Evidence of integration capability with Active Directory, phishing reporting and SSO.

Tax and registration

• A valid original Tax Clearance Certificate must be submitted where SAA does not already hold a current one; the vendor carries the onus of keeping SAA supplied with a valid certificate. Failure may invalidate the quote.

B-bbee

• B-BBEE certificate, sworn affidavit or CIPC certificate per DTIC guidelines; a consolidated scorecard is accepted for joint ventures.
• EMEs or QSEs that are 51% black owned may submit a B-BBEE certificate, sworn affidavit or CIPC certificate.
• B-BBEE Level 1 or 2 earns 10 specific-goal points; Level 3 to 8 and non-compliant bidders earn 0.
• 30% or more black women ownership earns 10 specific-goal points.

Disqualification risks

• Any statement of compliance answered "No" or left without supporting proof.
• Any returnable document missing, unsigned or invalid.
• Late or incomplete submission.
• Apparent deviation from the RFQ requirements or conditions.

Evaluation runs in five steps: administrative responsiveness, substantive (mandatory) responsiveness, technical functionality, price and specific goals, then award and conclusion of contract.

• Administrative stage: all returnable documents present, signed by an authorised person and valid.
• Substantive stage: 100% compliance with the mandatory statements of compliance, each answered Yes with proof attached. A "No" answer or missing returnable document disqualifies the bid.
• Functionality stage: scored out of 100 with a minimum qualifying score of 70%. Weightings are implementation lead time 10%, project experience 25%, platform capability and managed service delivery 25%, reporting and analytics 20%, and delivery team skills and qualifications 20%.
• Bids below 70% on functionality are excluded from price and specific goals evaluation.
• Price carries 80 points; specific goals carry 20 points (B-BBEE Level 1 or 2 = 10 points; 30% or more black women owned = 10 points).
• SAA may run stages in parallel; being evaluated at one stage does not mean earlier stages were passed.
• SAA is not bound to accept the lowest quote and may withdraw the RFQ at any time.

Returnable documents:

• SBD 4 (Bidder's Disclosure): discloses whether the bidder or any director, trustee, shareholder, member, partner, or controlling person is employed by an organ of state, has a relationship with anyone employed by the procuring institution, or has an interest in any other related enterprise. All CSD-registered active companies linked to all directors must be disclosed. Failure to disclose all such companies leads to disqualification.
• The form must be completed, signed, and submitted with the bid.

Disqualification risks:

• Being listed on the Register for Tender Defaulters or the List of Restricted Suppliers.
• Submitting a false or incomplete disclosure.

Bidders must complete and submit the Bidder's Disclosure form (SBD 4). Bidders listed on the Register for Tender Defaulters or the List of Restricted Suppliers are disqualified. Bidders must disclose any employment by an organ of state, any relationship with a person employed by the procuring institution, and any interest in other related enterprises. All CSD-registered active companies linked to all directors must be disclosed.

Bidders must complete and submit the Bidder's Disclosure form (SBD 4). Bidders listed on the Register for Tender Defaulters or the List of Restricted Suppliers are disqualified. Bidders must disclose any employment by an organ of state, any relationship with a person employed by the procuring institution, and any interest in other related enterprises. All CSD-registered active companies linked to all directors must be disclosed.

This document is a vendor application form for local and domestic stations, used to register a supplier with South African Airways. It collects vendor information, bank and tax details, B-BBEE details, and ownership information. No description of the human risk management and security awareness services is provided in this document.

Submission email: [email protected]

Internal sign-off contacts (not for bidder enquiries):

• Bertus Steyn, Vendor Master Authoriser (GSM Admin Manager, SAP)
• Tricia Ally, Vendor Master Authoriser (Finance Manager, Accounts Payable)

Submission method: email the completed vendor application form with all supporting documents to [email protected].

Returnable documents:

• Vendor application form (AP Form 07), completed and signed by an authorised representative.
• Cancelled cheque or stamped bank confirmation letter not older than one year.
• Latest valid B-BBEE certificate or affidavit.
• Latest valid tax clearance certificate or SARS PIN on official SARS documentation.
• CSD registration report.
• Certified company registration documents.
• Certified copies of identity documents of shareholders.
• Certified shareholders' certificates.

No evaluation criteria are stated in the document. The document is a vendor application form, not a bid evaluation document.

The document is a vendor application form for local and domestic stations. It collects vendor information, bank and tax details, B-BBEE details, and ownership information. No technical specifications for the human risk management and security awareness services are provided in this document.

Payment terms: 15 days from invoice, subject to GSM approval schedule.

The form requests the company's annual turnover for the previous financial year.

CSD registration report required.

Valid tax clearance certificate or SARS PIN required.

Valid B-BBEE certificate or affidavit required; indicate applicable scorecard (EME, QSE, or General/Large).

B-BBEE details required: status level, enterprise development, value adding, percentage black ownership, black women ownership, black people with disabilities.

Certified company registration documents, certified ID copies of shareholders, and certified shareholders' certificates required.

Cancelled cheque or stamped bank confirmation letter not older than one year required.