Objectives

The primary objective is to procure, implement, and support an automated ICT Security Awareness Training and Phishing Simulation solution over a 24-month period. Key goals include enhancing employee resilience against email-based cyberattacks, reducing successful phishing and Business Email Compromise incidents, and fostering a stronger organizational security culture. The solution aims to streamline security operations by consolidating training and monitoring into a single platform, thereby lowering administrative overhead, minimizing implementation risks, and ensuring compliance with information governance standards.

Scope

The project encompasses the national procurement, deployment, and ongoing support of an Enterprise Human Risk Management System. Implementation must achieve a go-live date within two weeks of purchase order issuance. The scope includes delivering a comprehensive project management plan, executing a structured rollout, providing continuous training and phishing simulations, and generating management reports to track user progress. The contract is renewable after the first year, contingent upon successful performance evaluation. Proposals will undergo a two-phase evaluation: a desktop assessment scoring functionality, experience, and methodology, followed by a mandatory live demonstration for shortlisted bidders.

Technical Requirements

• Seamless integration with the existing Mimecast email environment using native connectors, explicitly excluding custom or additional API development.
• Real-time detection of user security lapses during phishing simulations, triggering immediate assignment of tailored remedial training.
• Automated delivery of ongoing security awareness modules and simulated phishing campaigns.
• Centralized management reporting and visibility dashboards to monitor employee participation, progress, and organizational risk metrics.
• A unified security and support model requiring minimal administration and maintenance.
• Rapid deployment capabilities and reduced system complexity.
• Bidders must hold valid certification as an authorized partner for the proposed solution.
• Shortlisted vendors must successfully demonstrate all specified functional capabilities during a live presentation.

Skills Requirements

• Demonstrated expertise in designing, implementing, and rolling out enterprise security awareness and human risk management platforms.
• Submission of detailed CVs for the proposed project team, highlighting relevant qualifications, competencies, and a minimum of three years’ experience in comparable projects.
• Development of a robust project management framework outlining methodology, resource allocation, phased timelines, deliverables, and internal quality controls.
• Proactive risk identification with documented mitigation strategies and monitoring protocols.
• Provision of at least three verifiable client references from the past five years, confirming successful implementation of similar solutions integrated with Mimecast. Reference letters must appear on official letterheads, specify the service duration, and bear authorized signatures and dates.

Key Terms & Concepts

• Enterprise Human Risk Management System: A specialized platform that addresses cybersecurity risks stemming from human behavior, such as susceptibility to social engineering, rather than focusing solely on technical infrastructure vulnerabilities.
• No Custom API Integration: The solution must operate through pre-existing, vendor-supported compatibility layers with Mimecast, eliminating the need for bespoke software development or third-party middleware.
• 80/20 Preference Points System: A standardized procurement scoring model allocating 80% of evaluation weight to price competitiveness and 20% to socio-economic transformation goals. A minimum threshold of 70% total points is required to advance.
• Mandatory Live Demonstration: Shortlisted bidders must showcase a fully functional version of their proposed system. Achieving a perfect score on the functional demonstration is strictly required to qualify for the final pricing evaluation.