Information and communication Tenders

Comply with the following non-negotiable requirements, the bidders must submit bids with assurance that the requirements below can and will be met. Failure to comply with the criteria below will mean the bid will be deemed non responsive. Note: non-negotiable items in section d of the evaluation criteria. Condition description state security agency clearance at the time of submitting the bid, the bidder must have applied to the ssa an application for security clearance to perform onsite work at the precinct. Submit evidence as part of the bid. Service readiness the bidder must provide written confirmation that enterprise- grade connectivity is available and can be provisioned at the stipulated location wcpp RFP – managed internet, firewall, ids/ips, public dns and related services the successful bidder shall be responsible for conducting all site verification activities, including infrastructure availability and service feasibility assessments, prior to submitting the bid. NO claims relating to unavailable infrastructure, insufficient coverage, or site-related feasibility constraints will be accepted after the bid submission. Implementation dates solution to be deployed considering implementation dates specified below, with contingency for landlord and other 3rd party constraints. Start implementation by 30 april 2027 and go live by NO later than 15 june 2027 and final dns switch over by 25 june 2027. Functional requirements integration with wcpp sentinel siem. Bidder firewall team response handling with the wcpp soc team fully described and aligned on a 24 x 7 x 365 basis. 12 month log file retention and timeous forensic access when requested by wcpp addressed. Icasa compliant licensed spectrum wireless failover confirmed. 5. Current environment environment component current description 7 wale street, cape town location longitude latitude wcpp RFP – managed internet, firewall, ids/ips, public dns and related services 18.418750000000045 -33.92422 User base approximately 150 users devices fewer than 300 end-user devices including pcs, laptops, printers, tablets and cell phones. Remote sites NO remote sites network ethernet lan/wlan across four floors remote access hybrid environment. Remote access is critical 6. Corporate internet services 6.1.1 Primary and secondary connectivity 6.1.1.1 Primary 250 mbps fibre connection to the provider’s closest pop in cape town. 6.1.1.2 Secondary wireless: 250 mbps licensed band wireless backup link compliant with icasa regulations. 6.1.1.3 Implement failover: bgp and hsrp, or equivalent, to facilitate failover between primary and secondary links in the event of router or line failure. 6.1.1.4 Provide quality of service on both links to ensure application priority according to wcpp’s business requirements. 6.1.1.5 Provide fully outsourced customer edge equipment and router management to ensure reliability, security, reachability and availability. 6.1.1.6 Provide at least 99.9% Uptime for connectivity. 6.1.2 Internet breakout 6.1.2.1 250 mbps bandwidth. 6.1.2.2 Synchronous service with 1:1 contention required. 6.1.2.3 Uncapped internet breakout. 6.1.2.4 NO fair use policy. 6.1.2.5 NO broadband allowed for the corporate internet breakout. 6.1.2.6 At least 99.9 % Uptime. 6.1.3 Solution architecture compliance bidders must clearly state how the proposed architecture satisfies the specified bandwidth, contention, uptime, failover, qos and no-fair-use requirements. 7. Managed next generation firewall (ids/ips) 7.1 Minimum security service scope • provide managed firewall and ids/ips service. • Provide services compliant with the nist functions: identify, protect, detect, respond and recover. Wcpp RFP – managed internet, firewall, ids/ips, public dns and related services • detect and block data exfiltration attempts. • Implement rules as per wcpp security policy and in compliance with industry best practices and mitigation against known cyber threats. • Provide performance and high availability. • Provide evidence of operational monitoring. • Provide monthly security management reports detailing the source of threats, bad actors, mitigations and responses to incidents. • Provide expert-level support by certified security professionals responsible for management of firewall infrastructure to ensure reliability, security, reachability and availability. • Integrate with the existing wcpp microsoft sentinel siem. • Enable wcpp’s soc team to monitor independently. • Retain administrative and security logs for at least 12 months. • Integrate and comply with pam to monitor administrator activities. • Include pam reporting on a monthly basis. • Provide full firewall vulnerability management as a managed service. • Provide bug management, release management and configuration management. • Apply itil-compliant change management. • Provide backup and recovery, including monthly evidence of configuration and ruleset backups. • Propose a draft incident response policy in case of an incident and/or breach. • Provide at least 99.9% Uptime. 7.2 Firewall rule management the successful bidder must manage firewall rules in accordance with wcpp-approved change management, security policy and authorised requests. The bidder must provide a controlled, auditable and documented process for firewall rule creation, amendment, review and retirement. • Bidder must distinguish between operational service requests and security incidents. • All changes must be traceable to an approved request or authorised incident response action. • Firewall rules must be reviewed four times per year in accordance with agreed review dates and documented in the monthly report. • Evidence of ruleset backup must be provided monthly. 7.3 Monitoring and incident response the bidder must provide monitoring and response capabilities and must integrate with wcpp’s existing microsoft sentinel siem. • Wcpp’s soc team will facilitate independent monitoring. • Incidents will be classified, reported and responded to through the agreed SLA priority matrix. • Root cause analysis must be provided within three days of an incident or event. Wcpp RFP – managed internet, firewall, ids/ips, public dns and related services 7.4 Firewall vulnerability management requirement minimum standard critical vulnerabilities remediate within 7 days high vulnerabilities remediate within 14 days medium vulnerabilities remediate within 30 days patch reporting monthly security advisories and zero day as released, take action 8. Public dns services provide a web-based secure control panel for configuration. Requirement mandatory primary dns yes secondary dns outside western cape region dns redundancy yes dnssec required ddos protection required secure management portal /control panel required with mfa and management by wcpp admin staff. Availability 99.9% Real-time monitoring required bidders must explain how dns continuity will be maintained if the cape town environment or provincial internet service is unavailable. 9. Service management requirements 9.1 Account management • the bidder must provide a service escalation model and contact details to be used during service implementation and service operations. • Provide escalation protocols for the wcpp soc team to respond to incidents and remediation. • The bidder must distinguish between service requests and security incidents. Wcpp RFP – managed internet, firewall, ids/ips, public dns and related services 9.2 Monthly report pack the bidder must provide a monthly report pack section minimum information required executive summary overall service status, key issues, risks and decisions required. Incidents incident volumes, priority 1 and 2 details, root cause analysis status and breached tickets. Service requests requests received, completed, open and carried over by category. Breached tickets security incidents security events, incidents, mitigations, bad actors and responses. Breached tickets changes service improvements, ownership and target dates. Ids/ips summary of ips and ids activity and trends. Firewall rules rule changes, quarterly rule review status and exceptions. Backup evidence configuration and ruleset backup evidence. Vulnerability/risk posture, remediations , risk assessment and statuses lifecycle os lifecycle. 9.3 Monthly service review meetings • present the monthly report pack • the successful bidder must participate in virtual monthly meetings with wcpp to discuss service performance, service risks, continuous improvement and corrective actions. 10. Project management, implementation and transition • a dedicated project manager must be specifically identified. • A detailed project plan with indicative timelines must be submitted. • The bidder must demonstrate a mature project methodology. • The project plan must include implementation phases, milestones, dependencies, risks and acceptance criteria. • The bidder must provide a transition approach that minimises service disruption to wcpp. Running parallel and go live decisions. Wcpp RFP – managed internet, firewall, ids/ips, public dns and related services 10.1 Minimum project phases phase minimum expected deliverables phase 1: initiation and discovery kick-off meeting; confirmation of scope; validation of current environment; risk register; implementation governance structure. Phase 2: design and planning high-level and low-level design; implementation schedule; change plan; rollback approach; test plan. Phase 3: implementation and migration provisioning of connectivity, firewall, ids/ips, dns and monitoring integration; configuration backups; service desk readiness. Phase 4: testing, handover and failover testing; security monitoring validation; reporting pack; stabilisation operational handover; acceptance sign-off. 11. Incident response priority matrix bidders must provide an incident response priority matrix that consider outages and security incidents. Priority description response time resolution time p1 critical security breach or service outage 15 minutes 4 hours p2 high major degradation 30 minutes 8 hours p3 medium partial impact 2 hours 24 hours p4 low service request 8 hours 5 business days 11.1 SLA measurement clarifications • bidders must define how uptime is measured for each service component. • Bidders must define maintenance windows and explain how planned maintenance is excluded or included in availability calculations. • Bidders must specify escalation arrangements for high priority incidents, security incidents and connectivity outages. Wcpp RFP – managed internet, firewall, ids/ips, public dns and related services 12. Security, compliance and critical infrastructure requirements 12.1 Critical infrastructure protection act IT is expected of the bidder to have or to have obtained, taking application timeframes into account, state security agency clearance to be able to work at a site declared as critical infrastructure in terms of the critical infrastructure protection act, act . The bidder must provide evidence of existing clearance or at the time of submitting the bid, the bidder must have submitted to the ssa an application for security clearance to perform onsite work at the precinct. 12.2 Security governance • bidders must describe how services will comply with wcpp security policy requirements. • Bidders must describe how known cyber threats will be mitigated through firewall, ids/ips, monitoring and reporting capabilities. • Bidders must describe how administrator activities will be monitored through pam. • Bidders must describe how logs will be retained for at least 12 months. • Bidders must describe how their support personnel are certified and qualified to provide expert-level security support. • Bidder must describe how firewall team will respond and integrate with the wcpp soc team 13. Bidder response requirements bidders must respond clearly and comprehensively to every requirement. Responses must include page references where indicated in the compliance schedules. Generic marketing material will not be sufficient unless IT clearly demonstrates compliance with a specific requirement. IT is recommended that bidders consult the evaluation criteria (section 16) to ensure their bids are compliant and assist them with self-scoring of the bid. Response area required bidder submission executive summary overview of the bidder’s proposed solution and service model. Technical architecture description of proposed internet, connectivity, firewall, ids/ips, dns, monitoring and failover architecture. Compliant response completed compliance tables sections 14 and 18, with page references. Security services description of nist-aligned firewall and monitoring services and interfacing with the wcpp soc team sentinel integration explanation of how the service will integrate with wcpp microsoft sentinel siem. Service management proposed account manager, escalation model, reporting pack and meeting cadence. Wcpp RFP – managed internet, firewall, ids/ips, public dns and related services project management project manager cv summary, project plan, methodology, milestones and risk approach. References written signed reference letters on official letterhead for similar services. SLA and msa SLA and alignment to the proposed wcpp msa and SLA critical infrastructure evidence of ssa clearance or submission for ssa clearance to work at the precinct (critical infrastructure precinct). 14. Bid specification compliance schedules the bidder must complete the tables below by indicating the page reference in the proposal where the bidder confirms that IT will meet the specified deliverable. 14.1 Connectivity / WAN iaas compliance item description bidder page REF 14.1.1 Primary fibre: 250 mbps fibre connection to the provider’s closest pop. 14.1.2 Secondary wireless: 250 mbps wireless backup link compliant with icasa regulations. 14.1.3 Implement bgp and hsrp protocols, or equivalent, to facilitate failover between primary and secondary links in case of router or line failure, inbound and outbound. 14.1.4 Quality of service on both links to ensure application priority according to wcpp’s business requirements. 14.1.5 At least 99.9% Uptime. 14.1.6 Fully outsourced customer edge equipment and router management; management of router infrastructure to ensure reliability, security, reachability and availability. 14.1.7 NO fair usage policy. 14.2 Internet services compliance item description bidder page REF 14.2.1 Uncapped internet breakout. 14.2.2 250 mbps bandwidth. Wcpp RFP – managed internet, firewall, ids/ips, public dns and related services 14.2.3 Synchronous contention required 1:1. 14.2.4 At least 99.9% Uptime. 14.2.5 NO fair use policy. 14.2.6 NO broadband. 14.2.7 Wireless failover 14.3 Managed firewall, ids/ips iaas compliance item description bidder page REF 14.3.1 Implement rules as per wcpp security policy and compliance with industry best practices and mitigation against known cyber threats. 14.3.2 Performance and availability management. 14.3.3 Real-time threat response with wcpp soc team 14.3.4 On-demand security and compliance reporting. 14.3.5 Expert support and management of firewall infrastructure to ensure reliability, security, reachability and availability. 14.3.6 At least 99.9% Uptime. 14.3.7 Change management. 14.3.8 Backup and recovery. 14.3.9 Services compliant with nist functions. 14.3.10 Evidence of real-time operational monitoring. 14.3.11 Quarterly security management reports detailing sources of threats, bad actors, mitigations and responses. 14.3.12 Root cause analysis report relating to all incidents within three days of the event. 14.3.13 Integration with existing wcpp microsoft sentinel siem. 14.3.14 Wcpp soc team must be able to monitor independently. 14.3.15 Administrative and security logs retained for at least 12 months. 14.3.16 Pam to monitor administrator activities. Wcpp RFP – managed internet, firewall, ids/ips, public dns and related services 14.3.17 Firewall vulnerability management as a managed service. 14.3.18 Patch, bug, release and configuration management. 14.3.19 Itil-compliant change management policy. 14.3.20 Review of firewall rules four times per year according to agreed specific dates. 14.3.21 Monthly evidence of configuration and ruleset backups. 14.3.23 Draft incident response policy. 14.4 Public dns saas compliance item description bidder page REF 14.4.1 Primary dns server. 14.4.2 Secondary dns server hosted outside the core cape town environment to ensure continuity of name resolution in case of local disaster or provincial internet outage. 14.4.3 Dnsec required 14.4.4 Ddos 14.4.5 At least 99.9% Uptime. 14.4.6 Web-based secure control panel for configuration. 14.4.7 Mfa 15. Bidder response checklist NO. checklist item compliant? Page REF yes / NO 15.1 Proposal includes executive summary. 15.2 Proposal includes completed compliance schedules. 15.3 Proposal includes technical architecture. 15.4 Proposal confirms 36-month managed service offering and go live date. Wcpp RFP – managed internet, firewall, ids/ips, public dns and related services 15.5 Proposal addresses bandwidth and contention 15.6 Proposal addresses primary fibre and secondary wireless connectivity. 15.7 Proposal addresses bgp / hsrp or equivalent failover. 15.8 Proposal addresses qos. 15.9 Proposal confirms NO fair usage policy where specified. 15.10 Proposal addresses managed firewall and ids/ips requirements. 15.11 Proposal addresses nist identify, protect, detect, respond and recover functions. 15.12 Proposal addresses microsoft sentinel siem integration. 15.13 Proposal addresses pam 15.14 Proposal addresses 12-month log retention. 15.15 Proposal addresses vulnerability, patch, bug, release and configuration management. 15.16 Proposal addresses itil-compliant change management. 15.17 Proposal includes rule review approach four times per year. 15.18 Proposal includes backup and recovery evidence approach. 15.19 Proposal includes public dns requirements. 15.20 Proposal includes dedicated project manager and project plan. 15.21 Proposal includes key account manager and summarised cv. 15.22 Proposal includes monthly report pack approach. 15.23 Proposal includes completed SLA matrix. 15.24 Proposal includes signed reference letters on official client letterhead. 15.25 Proposal addresses critical infrastructure protection act / ssa clearance requirement. Wcpp RFP – managed internet, firewall, ids/ips, public dns and related services

Returnable documents:

Returnable documents: 3.4.1 A copy of the trust, consortium or joint venture agreement duly signed must be attached.

Submission channel: email to [email protected]. Closing: 18 september 2026 at 11:00 AM. late bids not accepted. Bids must be on official forms provided (sbd 1, sbd 7) and not re-typed. Returnable documents: sbd 1 (invitation to bid), sbd 7 (contract form), proof of tax compliance (tcs pin or csd number), and mandatory documents: confirmation letter, team credentials (ciso, cissp), proof of physical office in south africa, technical response document, recovery assurance capability. Disqualification risks: unsigned forms, missing mandatory documents, late submission, non-compliance with tax or csd requirements.