Security Culture Programme

The contract is set to commence on December 1, 2026, and conclude on November 30, 2027. The initial duration of the contract is one year, with an option for the client to extend it for an additional year.

Key milestones and phases include:

• Implementation Phase: The solution must be fully implemented, tested, and operational within three months following the contract's signing. A specific plan for this establishment phase is part of the agreement.
• Temporary Extension: The supplier is required to extend the contract for up to six months post-termination if requested by the client, provided a minimum of 60 calendar days' notice is given.

The core scope of work for this tender involves providing a tool and/or executing phishing tests to raise awareness and train approximately 2900 employees (internal staff and those at county governor's offices) on identifying fake emails.

The Statement of Work (SOW) summary and core deliverables include:

• Phishing Test Tool/Execution: Delivery and implementation of a tool or service for conducting phishing tests.
• Awareness and Training: Providing awareness and training related to identifying fake emails.
• Implementation and Configuration: Assisting with the necessary establishment and configuration of the service.
• Administrator/Superuser Training: Conducting training for 1-2 administrators/superusers.
• System Readiness: The solution must be implemented, tested, and ready for use within three months of contract signing.
• Service Level Agreement (SLA): Adherence to a standard service level agreement provided by the supplier.
• Technical Requirements:
• Administrator and end-user interfaces must function in Microsoft Edge.
• The solution must operate without requiring exceptions in security filters.
• Support for role-based access control.
• Data protection during transfer and storage, adhering to NSM recommendations or equivalent standards.
• Logging of relevant security and administrator events.
• Established processes for vulnerability management, security updates, and incident handling in line with NSM principles or equivalent standards.
• Notification of security incidents affecting client data or service.
• Data Handling: Deletion of client data upon agreement termination, according to client instructions.
• Optional: Provision of a test environment for evaluating central functionality.