Diso training programme development and delivery (SCM003/2026)

The Department of Public Service and Administration (DPSA) draws its legislative

mandate from section 197, read with section 195(1) of the Constitution, the Public

Service Act of 1994, and the Public Administration Management Act of 2014. The

functions of the Minister of Public Service and Administration, as enshrined in the

Public Service Act, 1994, include the responsibility to develop the norms and

standards for governance and management of electronic government in the public

service.

The Directive on Public Service Information Security requires departments to establish

and maintain an effective information security capability through the appointment of

Departmental Information Security Officers (DISOs). The DISO plays a critical role in

protecting government information assets, providing assurance in the effectiveness of

information security controls, managing cyber risks, promoting information security

awareness, and ensuring compliance with applicable legislation, policies, and

standards. The term DISO refers to the role equivalent to that of a Chief Information

Security Officer (CISO) in the private sector.

To support departments in implementing the Directive on Public Service Information

Security, the DPSA intends to develop (customize) a comprehensive DISO Training

Programme that will equip current and prospective DISOs with the knowledge, skills

and competencies required to effectively execute their responsibilities.

2. Purpose of the request for proposal

The purpose of this Request for Proposal (RFP) is to source a service provider to

develop (customize) and deliver a comprehensive DISO training programme.

The programme must provide a structured learning pathway that enables

Departmental Information Security Officers to establish, implement, monitor, and

continuously improve departmental information security programmes aligned with

government requirements, cybersecurity best practices, and international standards.

The programme must include learning modules, case studies, practical exercises,

reflection activities, assessments and quizzes.

of 24

Restricted

3. Objectives of the training programme

The objectives of the training program are to equip the DISOs in the public service to

effectively execute their assigned duties as follows:

i. Establishing Governance and Strategic Alignment: The DISO acts as a

strategic advisor who establishes and matures the department's information

security governance framework, ensuring that security initiatives align with

corporate governance, business strategies, and national directives.

ii. Information Risk Management: Operating as an independent risk advisor, the

DISO establishes structured risk management processes, oversees ongoing

threat and vulnerability evaluations, and guides the implementation of

appropriate control measures to mitigate risks.

iii. Policy Creation and Enforcement: The DISO is responsible for developing,

maintaining, and enforcing comprehensive departmental information security

policies and standards, ensuring they reflect changes in threats, technology,

and organizational missions.

iv. Regulatory and Legal Compliance: The role involves ensuring the

department complies with all legal, regulatory, and internal policy requirements,

tracking these obligations, resolving non-compliance issues, and supporting

security-related audits.

v. Cultivating Security Awareness and Training: To mitigate human-factor

risks, the DISO oversees a continuous security awareness, education, and

training program designed to help all employees recognize cyberattacks and

handle sensitive data correctly.

vi. Operational and Technical Control Assurance: While day-to-day technical

execution is managed by the ICT team, the DISO oversees the effectiveness of

these controls, specifically governing privileged access, identity management,

and emergency access protocols.

vii. Third-Party and Supply Chain Oversight: The DISO guides the risk

assessment process for outsourced contracts, mitigates supply chain risks, and

regularly reviews external party access to ensure ongoing business

justification.

of 24

Restricted

viii. Resource Justification: The DISO develops business cases and determines

financial priorities to justify security investments, ensuring that the necessary

resources are available and utilised efficiently.

The appointed provider shall develop (using the below design checklist) specialised

learning content for the DISO programme. The programme will be hosted by the

National School of Government.

The scope includes training on emerging security trends, best practices, and the

technologies essential to information security, including network, application, and

cloud security. The course must integrate real-world case studies, hands-on practical

exercises, and provide practical insights into information security best practices.

The course must:

• Be aligned to the Public Service Corporate Governance of ICT Policy

Framework, Information Security and ICT Service Continuity directives and

other relevant directives.

• Be optimised for self-paced learning.
• Be presented in manageable learning units.
• Include public sector case studies.
• Include practical exercises and assessments.
• Promote application of concepts in departmental environments.

The content must include:

• Video presentations.
• Learner guides and handbooks.
• Interactive assessments and quizzes.
• Practical exercises.
• Case studies and scenarios.

5. Design checklist

Adult Learning Principles

• Tell learners why they need to learn the new knowledge, skills and values

of 24

Restricted

• Allow for flexibility
• Ground content and activities in experience
• Give learners the opportunity to absorb and apply learning (as opposed to

memorising content)

Online Learning Materials

• Write at a level of detail that will make content accessible for learners
• Structure content into units
• Provide an overview of each unit
• Group content for each unit into manageable portions
• Place similar content together and exclude unrelated information from each

content section

• Use relevant tools to organise information (e.g. diagrams and graphics)
• Reference all materials where appropriate
• Be consistent

Media

• Align media with the NSG look and feel (provided)
• Use NSG colours consistently
• Keep the target audience and context of implementation in mind
• Keep it simple (NSG courses may be delivered in low-bandwidth areas)

Formative Assessment Activities

• Provide a clear assessment brief for all activities
• Provide knowledge checks per unit

o Present as an online quiz

o Base questions on course content

o Question types: Multiple choice – single answer, Multiple choice –

multiple answers, Match columns A and B, Fill in the blank (select

missing words), Drag and drop onto text, Drag and drop onto image,

True/False.

o Develop computer-graded questions to ensure learners know and

understand key content related to the course outcomes

of 24

Restricted

o Quizzes typically consist of 10 – 20 questions, depending on the

complexity of the module.

o Provide general feedback for each question to support learning

• Provide application checks per unit (if applicable)

o Present as an online quiz or hand-in activity

o Base questions/activities on real-life scenarios

o Develop activities to ensure that learners will be able to apply new

knowledge and skills to solve real-life challenges, related to the course

outcomes, in the workplace

o One activity per unit is typically required

o Learners should be able to complete hand-in activities in approximately

an hour

o Provide a suggested answer for all hand-in activities

• Provide learners with the opportunity to reflect on key learning points, where

relevant

o Provide guidance on the key learning points that should be included in

the reflection (this is distributed after the activity has been completed)

• Each unit should have at least one quiz. These quizzes are computer-marked,

and students get their results immediately. They must achieve a minimum

score of 75% on a quiz, but they have unlimited attempts to complete it.

• The NSG eLearning Platform (LMS) is based on Moodle 4.5. All course

activities and resources will be delivered on this platform.

• The NSG has standardised on Articulate 360 for the development of interactive

learning materials; however, service providers may use any available

development tool that is fully compatible with deployment on the Moodle e-

learning platform to develop the learning materials. This will allow the DPSA to

edit learning objects once the service provider hands over the source files.

• The service provider must develop the training program in a format that will

allow the DPSA to modify, maintain, and republish the training without requiring

redevelopment.

• Video should be uploaded in MP4 format. Audio should be uploaded in MP3

format.

of 24

Restricted

6. Target audience and delivery mode

The programme is intended for Departmental Information Security Officers (DISOs)

and must be delivered as an online, self-paced learning programme, supported by

practical exercises and assessments. The appointed service provider will not be

required to host the training course as such will be hosted by NSG.

7. Deliverables / products

7.1. Learning Materials

Learning materials that meet the specified requirements and enable the achievement

of identified learning objectives. The types of materials must include:

• Learning materials to explain key concepts in line with the course outline and

the identified modules.

• The development of fictional case studies for each level of participation, which

are used throughout the course to contextualise key concepts and assess their

application.

• An example of a successful public service project/case to anchor each module.
• Objective tests (e.g., flashcards, crossword puzzles, and quizzes) to evaluate

learner engagement and understanding of the materials and

• Questions (based on the above-mentioned selected case studies) to assess

learners' analytical and application skills.

7.2. Quality Assurance

The provider will hold formal meetings with the project team, provide evidence of

project progress, ensure the relevance and quality of all learning materials, and

implement all project team inputs, recommendations, and decisions within the scope

of the project.

8. Training programme modules

The DISO training programme is intentionally non-technical in its core delivery,

designed specifically to align with the strategic and governance mandate of the DISO

role. The DISO primarily functions as a governance authority, serving as an

independent assurer, risk advisor, and strategic advisor, while the day-to-day technical

execution of security controls remains the responsibility of the ICT team.

Consequently, the required curriculum must equip candidates for high-level oversight,

of 24

Restricted

risk management, policy compliance, and resource justification rather than technical

administration. The successful service provider must develop content that empowers

DISOs to function effectively as strategic advisors to departmental leadership,

enabling them to seamlessly integrate information security into the department's

broader business strategy and corporate governance.

The learning journey map for the Departmental Information Security Officer (DISO)

Training Programme shall be structured as follows:

8.1. Module 1: introduction to information security in government

Upon completion of this module, participants should have a sound understanding of

the fundamental principles of information security, including confidentiality, integrity

and availability, and the role of governance and risk management within the South

African Public Service. Participants should understand the evolving threat landscape,

the importance of protecting government information assets, and the strategic role of

the Departmental Information Security Officer (DISO) in supporting secure service

delivery and organisational resilience.

8.2. Module 2: public service information security legislative and

Policy framework

Participants will develop a comprehensive understanding of the legislative, regulatory

and policy framework governing information security within the South African Public

Service. The module will enable participants to interpret applicable legal and policy

requirements, understand departmental compliance obligations, and appreciate the

organisational, legal, and governance implications of non-compliance.

8.3. Module 3: directive on public service information security

Participants will gain a comprehensive understanding of the Directive on Public

Service Information Security, including its objectives, governance requirements and

implementation expectations. The module will equip participants with the knowledge

and practical skills required to implement, coordinate and monitor compliance with the

Directive within their respective departments while promoting consistent and effective

information security management practices.

8.4. Module 4: minimum information security standards (miss) and

Government security prescripts

of 24

Restricted

Participants will understand the purpose, structure and application of the Minimum

Information Security Standards (MISS) and other government security prescripts

relevant to departmental information security programmes. The module will enable

participants to align departmental security initiatives with government requirements,

integrate prescribed controls into governance processes, and support consistent

implementation of national security standards across the Public Service.

8.5. Module 5: information security governance

Upon completion of this module, participants will understand the principles of

information security governance and how governance supports organisational

objectives, accountability and risk management. The module will equip participants to

establish, implement and continuously improve governance structures, policies, roles

and oversight mechanisms that enable effective management of departmental

information security programmes.

8.6. Module 6: directive on the public corporate governance of ICT

Participants will understand how information security integrates with the Directive on

the Public Corporate Governance of ICT and contributes to effective ICT governance

within government institutions. The module will enable participants to align information

security initiatives with organisational strategy, governance structures and ICT

decision-making processes while supporting enterprise-wide accountability and

performance.

8.7. Module 7: information security risk management

Participants will acquire the knowledge and practical skills required to establish,

implement and maintain departmental information security risk management

processes. The module will enable participants to identify, assess, evaluate, treat and

monitor information security risks using a risk-based approach that supports informed

decision-making, regulatory compliance and organisational resilience.

8.8. Module 8: security architecture, technology and controls

Participants will develop an executive-level understanding of security architecture,

technology and information security controls required to protect departmental

information assets. Rather than focusing on technical administration, the module will

prepare DISOs to provide governance oversight, evaluate the effectiveness of security

of 24

Restricted

controls, support secure technology decisions, and ensure that technical safeguards

align with organisational risk management and government security requirements.

8.9. Module 9: information security incident management and cyber

Resilience

Participants will understand the principles of incident management, cyber resilience

and organisational preparedness. The module will equip participants to coordinate

departmental responses to information security incidents, support investigation and

recovery activities, facilitate stakeholder communication, and contribute to continuous

improvement through lessons learned and resilience planning.

8.10. Module 10: security awareness, culture and human factors

Participants will understand the critical role of people in maintaining information

security and the importance of fostering a security-conscious organisational culture.

The module will equip participants to design, implement and evaluate departmental

security awareness and education programmes that promote responsible user

behaviour, reduce human-related security risks and strengthen organisational

resilience.

8.11. Module 11: security monitoring, metrics and reporting

Participants will develop the capability to monitor, measure and report on departmental

information security performance using meaningful metrics and key performance

indicators. The module will enable participants to evaluate the effectiveness of security

controls, communicate risk and performance information to management, and support

evidence-based decision-making and continual improvement of information security

programmes.

8.12. Module 12: business continuity, disaster recovery and

Resilience

Participants will understand the relationship between information security, business

continuity and organisational resilience. The module will equip participants to

contribute to the development, implementation and continual improvement of business

continuity and disaster recovery capabilities that enable departments to maintain

critical services and recover effectively from disruptive events.

8.13. Module 13: strategic leadership and stakeholder management

FOR DISOs

of 24

Restricted

Upon completion of this module, participants will be prepared to perform the strategic

leadership responsibilities of a Departmental Information Security Officer. The module

will strengthen participants' ability to provide executive advice, influence organisational

decision-making, communicate information security risks effectively, manage

stakeholder relationships, promote a culture of governance and accountability, and

align departmental information security programmes with organisational objectives

and government priorities.

9. Description of the final product

The final product shall consist of the complete DISO Training Programme, an online

self-paced course, learner materials, videos and multimedia content, assessments

and quizzes and public sector case studies and reference materials.

10. Project schedule

The development of the training programme shall be completed within three (3)

months of the project commencement date. During this period, the appointed service

provider shall undertake all activities required for the design, development, review,

quality assurance and finalisation of the training programme and its associated

learning materials.

11. Competencies and experience required

The service provider must demonstrate:

• Advanced information security expertise.
• Experience in cybersecurity governance.
• Curriculum development expertise.
• Knowledge of information security standards and frameworks.
• Experience developing online learning programmes.

12. Mandatory documents to be submitted

12.1. Company Profile: Outlining background, history, and areas of business. Must explicitly

demonstrate advanced information security expertise, cybersecurity governance

experience, curriculum development expertise, and experience in developing online

learning programmes. Identify existing clients for whom the development of similar

government or corporate security training has been developed.

of 24

Restricted

12.2. Technical Proposal & Abridged CVs: Proposal responding to all sections of the DISO

Training RFP. Attach abridged CVs of key personnel to be deployed, clearly indicating

qualifications and relevant experience in information security frameworks (ISO 27001,

NIST) and online learning development.

12.3. Required Qualifications for Key Personnel: Submit copies of qualifications for each

proposed resource as outlined below

Resource Role Minimum Qualification / Experience

Lead Information Security Certified Information Systems Security Professional

Expert / Subject Matter Expert (CISSP) or CISM or equivalent. Minimum 8 years’

(SME) experience in information security governance and

risk management.

Instructional Designer / Relevant qualification in instructional design or

eLearning Developer educational technology (NQF level 6 or higher).

Proven experience developing online courses.

Minimum of 5 years’ experience.

12.4. References: Provide at least three (3) reference sites that DPSA can contact to assist

in the evaluation of performance under paragraph 13 under Detailed Functionality

Criteria. The service provider is required to provide at least three (3) reference letters

on the referee’s letterhead, which are duly signed and complete and submit Annexure

A for each reference site. DPSA reserves the right to contact these references directly

and without prior consultation with the Service Provider.

12.5. Demonstration of Online Learning Platform: Screen shots or a link to a demo of a

previously developed online course showing: unit structure, quizzes (multiple choice,

drag-and-drop, match columns), video integration, and learner progress tracking.

12.6. Proof of CSD Registration: Proof of registration on the Central Supplier Database

(CSD) with National Treasury. No bid will be awarded to a supplier not registered on

Csd.

12.7. Project Plan: A Plan detailing how the service provider will engage with DPSA to

develop the DISO training programme, including stakeholder consultation and quality

assurance checkpoints, to deliver the requirements in terms of the duration of the

appointment as to reach the final objective of a fully-fledged training program within a

3 month period.

12.8. Detailed Cost Breakdown: A detailed cost breakdown that includes all costs associated

with: curriculum development, video production, quiz creation, stakeholder workshops,

of 24

Restricted

quality assurance, and project management. The cost structure must be all-inclusive

(no hidden costs).