Cybersecurity & Data Protection Awareness Training System

Can you bid?

Background

The scope of work includes the design and implementation of a Cybersecurity & Data Protection Awareness Training System for CIÉ, which encompasses its four subsidiary companies. The platform must deliver role-based training, automated policy dissemination, and robust reporting capabilities. It should also integrate with existing enterprise systems and support data migration from current solutions. The contract duration is five years, with an optional three-year extension.

What this involves

{'scope': 'Supply and ongoing operation of a unified Cybersecurity and Data Protection Awareness Training SaaS platform for the CIÉ group (5 operating entities). Platform must support phishing simulation, adaptive learning, policy attestation, role-based content, GDPR/data protection training, EEA hosting, and per-company environment segregation.', 'timeline': '5-year initial contract term with optional 3-year extension (maximum 8 years total)', 'citations': {'timeline': ['Pre Qualification Questionnaire Final.docx:5'], 'deliverables': ['Pre Qualification Questionnaire Final.docx:4'], 'scope_summary': ['Pre Qualification Questionnaire Final.docx:3', 'Pre Qualification Questionnaire Final.docx:4']}, 'deliverables': ['SaaS platform for cybersecurity and data protection awareness training (EEA-hosted)', 'Phishing simulation tool with adaptive training interventions', 'Data protection training content repository (covering all 7 data protection principles)', 'Policy distribution, attestation and compliance tracking capability', 'Role-based training deployment and comprehensive reporting/analytics', 'Per-Operating Company environment segregation', 'In-house content development tooling (including video and gamification)'], 'scope_summary': 'CIÉ (via Iarnród Éireann) requires a unified cybersecurity and data protection awareness training platform for use across the CIÉ group (CIÉ, Iarnród Éireann, Bus Éireann, Dublin Bus, CIÉ Tours International).', 'summary_brief': 'CIÉ/Iarnród Éireann (ref 7540780, Utilities Directive) is procuring a Cybersecurity & Data Protection Awareness Training System via a two-stage PQQ+ITT process. The platform must cover GDPR, cybersecurity policy compliance, phishing simulation, adaptive learning, role-based content deployment, policy distribution/attestation, and comprehensive reporting. EEA-hosted cloud SaaS. Data must be segregated by Operating Company. Contract: 5 years + optional 3-year extension. Current incumbent platforms: Meta Compliance and KnowBe4. PQQ closes 20 March 2026.', 'summary_detailed': 'CIÉ operates through four wholly owned subsidiaries: Iarnród Éireann, Bus Éireann, Bus Átha Cliath (Dublin Bus), and CIÉ Tours International. The platform must support environment segregation by Operating Company while providing a unified group-level view. Required capabilities: (1) Policy Distribution, Attestation & Compliance Tracking — automated dissemination of mandatory/non-mandatory policies with user acknowledgment capture; (2) Phishing Simulation & Adaptive Training — dynamic phishing tool with targeted training interventions on failure; (3) Data Protection Repository — training content covering all seven data protection principles plus technical/organisational measures; (4) Localised Training Content — modules for both cybersecurity and data protection, customized to local requirements with completion tracking; (5) Content Refresh & In-House Development — bespoke content creation including videos and gamification; (6) Role-Based Deployment — intelligently assigned materials based on user roles; (7) Reporting & Analytics — visibility into completion rates, acknowledgments, compliance gaps; (8) Robust SaaS — cloud-based, always accessible; (9) EEA Hosting — data within EEA; (10) Environment Segregation by Operating Company. The procurement is two-stage: PQQ shortlisting, then ITT with award criteria and contract form. Award criteria/weightings are not disclosed at PQQ stage.'}

Scoring

Lots (1)

Documents (2)