Appointment of service provider to render
Managed WAN, internet, security, unified
Email, web hosting services for a period of
Five years
Kznl 2/2026
Bid No: KZNL 2/2026
Specification for appointment of service provider to render managed WAN, internet, security,
Unified email, web hosting services for a period of five years
Purpose. This specification consolidates the current service scope, operational requirements, and service level expectations
contained in the existing contract
- Background and objective
1.1. The KwaZulu-Natal Legislature requires an integrated managed ICT service covering Internet connectivity, WAN
connectivity, perimeter and remote-access security, unified email security and archiving, and web hosting
infrastructure.
1.2. The successful bidder must provide end-to-end managed services, centralized monitoring, incident and request
fulfilment support, service reporting, governance participation, and continuous improvement aligned to recognized
IT service management practices.
- Tender scope
The tender shall provide for some or all of the following service towers, as specified in the bill of quantities: (a) Internet
Access and Connectivity, (b) Centralized MPLS / WAN Service, (c) Managed Firewall, DMZ, VPN, IPS, Proxy,
Remote Access and Web Content Filtering Services, (d) Unified Email Security and Email Archiving Services, (e)
Web Hosting / Infrastructure as a Service.
- Contracting model and term
3.1. The proposed agreement must comprise a master services agreement together with service schedules for each
awarded service tower and an approved pricing schedule.
3.2. The contract must define service commencement dates, service term, renewal / extension options, notice periods,
change control, service credits (where applicable), dispute resolution, confidentiality, data ownership, transition
assistance and termination support.
3.3. The bidder must accommodate the Clientβs right to issue written changes to scope through formal contract change
procedures.
- General service requirements
4.1. The bidder shall provide services with due skill, care, diligence, efficiency and in accordance with industry good
practice. The bidder may use subcontractors only when disclosed in the proposal, but remains fully accountable for
subcontracted services, and must manage subcontractors without recourse to the Client.
4.2. All services must be delivered with auditable operational processes for incident management, request fulfilment,
change management, configuration management, escalation management and reporting.
4.3. The bidder must provide adequate documentation, service descriptions, escalation matrices, technical standards,
implementation plans and operating procedures.
4.4. All Client data remains the property of the Client. On contract expiry or termination, the bidder must return Client
data in a readable, accessible format and support orderly transition to the Client or a replacement service provider.
- Internet access and connectivity requirements
5.1. The bidder must provide managed Internet access and connectivity services, including access line provisioning and
management, customer premises router management and maintenance, Internet breakout services, and network
monitoring and reporting.
5.2. Internet access must be centralized, unshaped and uncapped (No throttling), with bandwidths specified in the pricing
schedule. Internet breakout points must provide resilience against upstream failures.
5.3. The bidder must provide 24x7 monitoring and alerting, monthly trend analysis, transparent access to monitoring
information through a portal or dashboard, and coordination with third-party suppliers where relevant.
Bid No: KZNL 2/2026
5.4. Router support must include preventative maintenance, configuration management, backups, firmware/software
updates in line with OEM support policies, secure remote administration, and on-site diagnostics where remote
diagnostics are insufficient.
5.5. The bidder must state supported access technologies, resilience options, proposed topology, monitoring capability,
customer portal features, and implementation lead times for new circuits and upgrades.
- MPLS / WAN service requirements
6.1. The bidder must provide a managed MPLS or equivalent enterprise WAN service that supports secure end-to-end
VPN connectivity with quality of service suitable for data, voice and video traffic.
6.2. The scope must include MPLS core management / WAN services, access line provisioning and management, router
equipment and maintenance, 24x7 network monitoring, performance reporting, and service management.
6.3. The bidder must support QoS policy implementation, utilization and NetFlow or equivalent traffic analysis,
performance and availability monitoring, and daily / weekly / monthly reporting.
6.4. Managed router services must include configuration maintenance, backups, secure auditable remote access,
software updates subject to OEM policy, and on-site support where required.
6.5. The bidder must identify site categories, redundancy models, access options, installation dependencies, and
restoration commitments per site category.
- Firewall and VPN security requirements
7.1. The bidder must provide managed next-generation firewall services with support for IPSEC and/or SSL VPN,
intrusion prevention, anti-malware inspection, and web filtering and application control.
7.2. The bidder must provide and manage a Demilitarized zone (DMZ)
7.3. The service must include firewall rule configuration according to approved Client requirements, configuration
backup, notification of major security or health issues, and remediation recommendations.
7.4. The bidder must provide site-to-site VPN services, including design, configuration, installation and maintenance of
VPN tunnels to approved third parties over Client-supplied carrier medium.
7.5. Where requested, the bidder must provide or support network IPS, proxy services, remote access services,
certificate administration, and web content filtering including policy enforcement, patching and content category
updates.
7.6. The bidder must clearly distinguish included functions from optional services such as SIEM, advanced
investigations, expanded reporting or after-hours major architectural changes.
- Unified email security and archiving requirements
8.1 The bidder must provide a cloud-based unified email management solution for inbound and outbound email security,
including anti-spam, anti-malware, zero-day threat protection, policy-based filtering, attachment controls, content
filtering and queue management.
8.2 The bidder must provide a web-based administration console, real-time visibility of SMTP traffic, message queue
functionality, blocked-mail retrieval, self-service user controls and policy administration.
8.3 The bidder must support secure email archiving / journaling, including setup of journaling connectors, monitoring of
journaling services, agreed retention periods and administrative access controls.
8.4 The bidder must define any prerequisites applicable to MX records, client mail configuration, Outlook add-ins, mobile
applications, relay restrictions and internet accessibility for self-service facilities.
8.5 The bidder must also describe service exclusions, technical conditions of service, suspension circumstances for
security events, and procedures for reinstatement after service interruption or compromise.
- Web hosting / IaaS requirements
9.1. The bidder must provide web hosting services as an infrastructure-as-a-service offering that includes virtual
computing capacity, storage and internet access for hosting institutional web services and related applications.
9.2. The service must include agreed computing instances, supported storage allocation, hypervisor support,
infrastructure monitoring, intrusion detection (or equivalent host / platform protection), and firmware maintenance
on underlying hardware in line with OEM recommendations.
Bid No: KZNL 2/2026
9.3. Where operating system licensing is included, bidders must identify the licensing model. The bidder must also
maintain supported software and tooling necessary to sustain a secure operational environment.
9.4. Storage services must cover provisioning, storage connectivity, monitoring of capacity / availability / performance,
trend reporting and troubleshooting of storage-related issues.
9.5. Bidders must specify optional backup, restore, business continuity and disaster recovery services separately where
these are not included in the base scope.
- Service management and governance requirements
10.1. The bidder must appoint a Service Delivery Manager / Service Manager as a single point of contact for service delivery
issues, escalations, operational coordination, service reviews and continuous improvement. The bidder must
participate in governance forums including monthly service review meetings, financial / demand meetings where
applicable, capacity and availability reviews, change advisory meetings on request.
10.2. Operational meetings must review service performance, incidents, problems, changes, risks, improvement actions,
deviations, web usage reports, cyber threat assessments, change logs report, admin activity events, firewall rules
backup, trend analysis and outstanding actions.
10.3. The bidder must conduct client satisfaction surveys at least twice per year and must participate in root cause analysis
for major incidents with tracked corrective actions to closure.
10.4. The service management function must align with recognized IT service management principles and include change
management, configuration management / CMDB support, incident management, request fulfilment, escalation
management and reporting disciplines.
- Service levels and support requirements
11.1. The bidder must define service hours, support hours, maintenance windows, escalation arrangements, service level
measurement periods and the settling-in period.
11.2. At minimum, the bidder must state and maintain availability targets of 99.9% for Internet, WAN/MPLS, firewall / security
platforms, unified email services and web hosting platforms, together with formulas, exclusions and measurement
methods.
11.3. Support hours must reflect business-hours support with 24x7 monitoring and after-hours standby / response for priority
incidents where required.
11.4. Maintenance windows must be pre-defined and communicated in advance. Planned maintenance and approved
downtime must be excluded from SLA calculations, together with downtime caused by factors outside the bidderβs
contractual control.
11.5. The bidder must include incident severity definitions, target response times, escalation times, restoration targets, and
service credit proposals where applicable.
- Reporting requirements
12.1. The bidder must provide standard reports through an online portal and/or scheduled email distribution. Reports must
cover availability, utilization, capacity, performance trends, incidents, requests, changes, change logs, security events,
cyber threat assessments, admin activities events, firewall rules backup, service management, VPN, service
exceptions and improvement actions.
12.2. Reporting frequency must be specified per report (e.g. daily, weekly, monthly, or online real-time access).
12.3. The bidder must identify standard reports available out of the box, any report customization options, self-service access
features, and named recipient groups.
- Client obligations and dependencies
Bidder responses must identify all Client dependencies, including site readiness, power, cooling / environmental
compliance, cabling, landlord approvals, remote access approvals, nominated service desk users, line upgrade
decisions, change control involvement and third-party contracts.
- Exclusions and assumptions
14.1. Bidders must provide a complete list of service exclusions, assumptions and optional items.
Bid No: KZNL 2/2026
14.2. Any assumptions that affect security, availability, supportability or service measurement must be prominently
disclosed.
- Bidder response schedules
Bidders must submit: (a) company profile and experience, (b) proposed service architecture, (c) implementation
methodology / Project Plan, (d) operating model, (e) service levels, (f) service reporting catalogue, (g) escalation matrix,
(h) subcontractor disclosures, (i) risk register and mitigation plan, (j) business continuity approach, (k) cybersecurity
controls, (l) POPIA / data protection controls, and (m) references for similar public-sector or enterprise deployments.
- Pricing schedule requirements
16.1. Pricing must be supplied in a clearly structured schedule, separated by service tower and by once-off and recurring
charges.
16.2. Pricing must separately identify access circuits, bandwidth tiers, router / firewall equipment, software licensing,
management charges, optional services, project / transition charges, after-hours work rates if any, and any third-party
pass-through costs.
16.3. The pricing schedule must state assumptions, currency, annual escalation mechanism, contract term alignment, and
whether rates are fixed for the initial term.
- Transition and handover requirements
17.1. The bidder must provide a transition-in plan describing discovery, due diligence, knowledge transfer, onboarding,
implementation, testing, acceptance, and service commencement.
17.2. The bidder must also provide a transition-out plan covering data return, configuration export, knowledge transfer, asset
return (where applicable), revocation of access, and support to a replacement provider during handover.
- Mandatory deliverables
As part of the contract, the successful bidder must deliver at minimum: service design document(s), implementation
plan(s), contact list and escalation matrix, asset / configuration inventory, service level schedule, maintenance
calendar, governance calendar, reporting catalogue, risk and issue log, and operating procedures relevant to the
awarded scope.
- Bill of Quantities (BOQ)
Purpose. This BOQ depicts the service items, components, bandwidth, support hours and term information. Bidders must
insert all fixed monthly costs in appropriate fields.
19.1. Recurring Service Items (Cost Excluded)
Service Component Bandwidth Support Hours Variable / Fixed Bidder
Description Monthly Price
Internet Access Enterprise Internet 200Mbs 24/7 Fixed
and connectivity Access
Centralized Pietermaritzburg 200 Mbs 24/7 Fixed
MPLS / WAN (PMB) main fiber
Network link
PMB backup link 50 Mbs 24/7 Fixed
Cape Town (CPT) 50 Mbs 24/7 Fixed
Fibre Link
Dube connect 100 Mbs 24/7 Fixed
DMZ 24/7 Fixed
Bid No: KZNL 2/2026
Service Component Variable / Fixed Quantity Bidder Monthly
Description Price
Firewall and VPN Secure remote Access for 50 50
connection concurrent users
Hosted Firewall Services 1
Cloud Web Security Service 1
Unified Email Mimecast 400
solution
Web Server
Hosting Services
Service Service Level Management,
Management Technical support, & Monthly
reporting
Firewall Management
Firewall threats hunting and
vulnerability remediations
DR / Failover site Configure and enable active DR
failover for the existing DR site.
19.2. Once-Off Implementation Item (Cost Excluded)
Once off Charges Once off cost
Setup, Configuration & Equipment Cost on all sites (PMB, CTN & Dube
TRadePort)
19.3. Overall monthly costs
Summary Year 1 Year 2 Year 3 Year 4 Year 5 Total β 5 Years
(Incl. VAT)
Grand Total
(Monthly
charges + Once
Off Charges)
19.4. Total Bid Price
Once off cost Total β 5 Years (Incl. VAT Total Bid Price
- Tender Completion Notes
Bidders must clearly state annual escalation costs if there are any.
Bid No: KZNL 2/2026
- Bid Evaluation Criteria
21.1. Stage 1: Mandatory Requirements
(i) A valid copy of Electronic Communications Service (ECS) or Electronic Communications Network Service
(ECNS) license certificates issued by ICASA.
(ii) A minimum of five (5) signed contactable reference letters showing that you have provided Internet services
and firewall Management for enterprise or public-sector.
(iii) Proof of OEM / partner accreditation with FortiGate and Mimecast.
A bidder who fails to comply with any of the above mandatory requirements will be disqualified.
21.2. Stage 2: Technical Functionality Evaluation (100 Points)
Bidders must score a minimum of 75 points to pass the functionality evaluation.
Requirement Points Allocation Maximum Points (100)
Technical Solution and Internet and WAN topology, 30
Architecture β 30 points redundancy, QoS (Management of
Network traffic and bandwidth),
Provide a network architecture monitoring, and reporting β 6 points
showing all solutions
Security architecture (FortiGate
firewall, VPN, DMZ, IPS, proxy,
web filtering) β 6 points
Mimecast Email security and
archiving solution capability β 6
points
DR failover capability for the existing
DR site β 12 points
Project plan/ Implementation Detailed Project plan with timelines 30
Methodology and Transition Plan and dependencies. The project plan
β 30 points must demonstrate the ability to
complete the implementation within
30 days. β 20 points
Risk management project plan to
include anticipated risks and how
they will be mitigated β 10 points
Clearly defined SLA showing Internet outages (Target <=1hour) β 20
incident priority, SLA Resolution 5 points
Targets Mean Time to Restore Firewall rule changes (Target <=
(MTTR) in respect and 1hour) β 5 Points
Continuous Improvement β 20 Security operations, patching, threat
points management, and remediation
approach (Target < = 4 hours) β 5
points