Development and delivery of departmental information security officer (diso) training programme for the public service

• DPSA seeks a service provider to develop and deliver a comprehensive DISO training programme to equip public service DISOs with knowledge and skills to implement information security governance, risk management, policy compliance, and strategic leadership.
• Programme must be online, self-paced, and include modules, case studies, practical exercises, and assessments.

• Closing date: 29 July 2026.
• Closing time: 11:00.
• No briefing, site visit, or clarification deadlines are stated.

• For SCM/bidding procedure enquiries: Lorraine Masenya / Mmapula Kotsokoane. Tel: 012 336 1126 / 012 336 1389.
• For technical enquiries: Alfred Mohlala. Tel: 012 336 1220. Email: [email protected].
• Submission address: Batho Pele House, 546 Edmond Street (C/O Hamilton Street), Arcadia.

• Submit by 11:00 on 29 July 2026. Late bids will not be accepted.
• Deliver to the bid box at Batho Pele House, 546 Edmond Street (C/O Hamilton Street), Arcadia.
• Use official forms provided (do not retype).
• Register your bid in the submission register at DPSA reception.
• Mandatory returnable documents: SBD1, SBD3.3, SBD4 (Declaration of Interest), SBD6.1 (Preference Points).
• Failure to submit required tax compliance documents or CSD registration will invalidate your bid.

• Mandatory documents: SBD1, SBD3.3, SBD4 (Declaration of Interest), SBD6.1 (Preference Points).
• Proof of CSD registration.
• Tax compliance certificate/PIN/CSD number (for each consortium member if applicable).
• B-BBEE supporting documents.
• Company profile, technical proposal with CVs, qualifications, references, project plan, detailed cost breakdown, online learning platform demonstration.

Bidder must be registered on Central Supplier Database (CSD) with valid tax compliance status (TCS pin or certificate). No bids accepted from persons in service of the state, companies with directors in state service, or close corporations with members in state service. Foreign suppliers must complete questionnaire and may need SARS registration. Consortium/joint venture members must each submit separate tax compliance documents. Must demonstrate advanced information security expertise, cybersecurity governance experience, curriculum development expertise, and online learning programme development experience.

• Scope: Develop and deliver a comprehensive online, self-paced DISO (Departmental Information Security Officer) training programme for the public service.
• Programme must cover 13 modules, from introduction to information security to strategic leadership.
• Content must align with Public Service ICT governance and information security directives.
• Deliverables: Learning materials (videos, guides, case studies), interactive assessments, quizzes, and quality assurance.
• Target audience: Current and prospective DISOs.
• Delivery mode: Online, self-paced, hosted by the National School of Government (NSG).
• Technical requirements: Compatible with Moodle 4.5; use Articulate 360 or any tool allowing DPSA to edit source files; videos in MP4, audio in MP3.
• Project schedule: Must be completed within 3 months of commencement.

• Course design must follow adult learning principles and specific online learning guidelines.
• Content must be structured into units, with overviews, manageable portions, and consistent media.
• Assessments must include knowledge checks (quizzes with various question types) and application checks (scenario-based activities).
• Each unit must have at least one quiz with a 75% pass mark and unlimited attempts.
• Use development tools compatible with Moodle; deliver source files editable by DPSA.

• Service provider must demonstrate: advanced information security expertise, cybersecurity governance experience, curriculum development expertise, knowledge of standards (e.g., ISO 27001, NIST), and experience developing online learning programmes.
• Key personnel minimum qualifications:

• Lead SME: CISSP or CISM or equivalent, with minimum 8 years in information security governance and risk management.
• Instructional Designer/eLearning Developer: Relevant qualification (NQF level 6+), minimum 5 years experience developing online courses.

• Submit company profile, technical proposal with abridged CVs, copies of qualifications, and at least three reference letters.
• Evaluation awards points for years of specific experience in designing DISO/CISO training.

• Provider must hold formal meetings with project team, provide progress evidence, and implement all team inputs.
• Quality assurance includes ensuring relevance and quality of all learning materials.
• Final product must be a fully-fledged training programme delivered within 3 months.

• Use SBD3.3 form for professional services.
• Quote total cost inclusive of VAT.
• Provide detailed cost breakdown.
• Indicate period to commence after acceptance and whether rates are firm.
• Bid must be valid for 90 days.

• Submit pricing on SBD3.3 form.
• Quote total cost inclusive of VAT.
• Provide a detailed cost breakdown covering curriculum development, video production, quizzes, workshops, quality assurance, and project management.
• Indicate if rates are firm for the full period; if not, specify adjustment basis (e.g., CPI).
• State period required to commence after acceptance.
• Offer must be valid for 90 days from closing date.

• Mandatory Central Supplier Database (CSD) registration. No award if not registered.
• Tax Compliance: Submit SARS PIN or CSD number. For consortia, each party must submit separate tax compliance proof.
• B-BBEE: Points awarded for equity ownership (Black, Women, Persons with Disabilities, Youth). Submit supporting documents: CIPC certificates, CSD report, B-BBEE certificate/sworn affidavit, medical declaration for disability.
• Declaration of Interest (SBD4) required, disclosing any state employment or conflicts.
• Persons in service of the state are disqualified.

• The successful bidder must sign a written contract (SBD7).
• Contract subject to Preferential Procurement Regulations and General Conditions of Contract.
• Definitions provided for tender, price, consortium, trust, youth, disability, and local content.
• Fraudulent claims can lead to disqualification, contract cancellation, cost recovery, restriction from public sector business for up to 10 years, and criminal prosecution.

• Foreign suppliers must declare residency, branch, permanent establishment, income source, and tax liability in RSA. If answer is 'no' to all, tax compliance registration not required.
• Bids must be submitted on official forms, by stipulated time, to correct address.
• Bidders must ensure tax compliance, submit SARS PIN or CSD number.
• Persons in service of the state are disqualified.
• Submit Declaration of Interest (SBD4) disclosing state employment or conflicts.
• Provide demonstration of online learning platform (screenshots/link) showing unit structure, quizzes, video integration, progress tracking.
• Mandatory CSD registration.

• 80/20 preference point system: 80 points for price, 20 for specific goals (B-BBEE equity ownership).
• Price scoring formula provided.
• Specific goals points: Black (8), Women (6), Persons with Disabilities (3), Youth (3).
• Submit proof: CIPC certificates, CSD report, B-BBEE certificate/affidavit, medical declaration for disability, consortium agreement if applicable.