Supply, support, and maintenance of an audit management system for airports company south africa (60-Month contract)

The tender is for the supply, support, and maintenance of an Audit Management System for Airports Company South Africa (ACSA) over a maximum period of 60 months. Key requirements:

• Integration with ACSA’s existing IT infrastructure, including Microsoft Active Directory (hybrid) for authentication.
• Compliance with ACSA’s IT standards for servers, storage, networking, and security.
• Adherence to ACSA’s resilience, maintenance, and data-sharing requirements.
• All designs and configurations must be approved by ACSA prior to implementation.

Evaluation will focus on two key areas:

General:

• Demonstrable experience in supplying, supporting, and maintaining enterprise-grade Audit Management Systems.
• Compliance with ACSA’s IT standards and proven ability to integrate with existing infrastructure (e.g., Active Directory, VMware, Cisco).
• Capacity to provide 24x7 support, OEM warranties, and maintenance for a minimum of 5 years.
• Financial and technical capability to meet the scope, including scalability for ACSA’s multi-site environment (ORTIA, CTIA, KSIA, etc.).
• Adherence to South African regulatory and security requirements.

Technical:

• Proven expertise in virtualized environments (VMware ESXi), HCI (Dell VXRail), and SAN/storage solutions (Dell EMC Unity).
• Experience with Cisco networking (LAN/WAN), wireless (Cisco Unified Wireless), and firewall (Check Point/Cisco) technologies.
• Ability to deploy solutions meeting ACSA’s resilience, redundancy, and security standards (e.g., dual fabrics, multi-path connectivity, encryption).
• Familiarity with ACSA’s data center and physical infrastructure standards (TIA-942, Uptime Institute).

Scope: Supply, support, and maintenance of an Audit Management System for ACSA for a maximum of 60 months.

System Requirements:

• Must integrate with ACSA's Microsoft Active Directory (hybrid: on-premise + Microsoft EntraID) for authentication. Single identity per user required.
• Must support Site-to-Site or Point-to-Site VPN connectivity:

• Point-to-Site: Checkpoint Mobile client (laptops), Checkpoint Capsule (mobile devices), Version 88.10.

• Site-to-Site: IKEv2, AES-256 (or higher) encryption, SHA255 (or higher) data integrity, DHG Group 14 (or higher).

• Must adhere to ACSA’s IT security standards: ACSA IT personnel must receive master system passwords and login details. ACSA IT administrators must have access to operating systems and servers (not the system itself).
• Must comply with ACSA’s existing IT standards and architecture. Deviations require approval during the RFP clarification phase.
• Resilience must be built-in to meet SLA/availability requirements per the Scope of Work.
• Maintenance plans must be included for new IT systems/software/infrastructure. Existing systems are covered by current contractors; new expansions must engage these contractors for handover. Maintenance costs must be included in the bid unless otherwise specified.
• Data sharing must use industry-standard formats (e.g., JPEG, PNG, TIFF, BMP for images; MS Word, PDF for documents; Microsoft Excel for spreadsheets; MP4, AVI for video; MP3, FLAC for audio).

Infrastructure Standards:

• Virtualization: VMware v8 (preferred). Hyperconverged (HCI) platforms with Dell VXRail hardware are standard. Multiple VXRail nodes required for N+1 redundancy.
• Servers: Dell PowerEdge (R660/R670 for dual CPU, R860/R960 for quad CPU). All hardware must have a minimum 5-year extended OEM warranty and 24x7x4 Dell ProSupport Plus.
• Operating Systems: Backend (servers) - Red Hat RHEL 8.10+, Ubuntu 22.x LTS+, Windows Server 2022 64-bit+. Frontend (end-user) - Windows 11 Latest Current Branch.
• Databases: Oracle 12c/11g (or latest equivalent), MS SQL 2022 R2 (or latest equivalent).
• Messaging: Microsoft Exchange Online/Hybrid Architecture.
• Storage: DELL/EMC SAN (Unity range) or vSAN for virtual servers. External storage may be required in certain cases.
• Backup & Replication: DELL/EMC Avamar with DataDomain appliances. Replication via VMware Replication or DELL/EMC RecoverPoint.
• Network: Cisco Systems (core routers, data centre switches, LAN access switches, wireless controllers, access points). Industrial Ethernet switches: Cisco or Rockwell Stratix.
• Firewall: Checkpoint 6600/5400/7000 Security Gateway Appliances (perimeter), Cisco ASA 5545X HA (ORTIA Data Centre). Firewall management: Checkpoint Smart-1 600 M. Required functionalities: Mobile Access Blade, User Directory Blade, Endpoint Security, IPv6, Anti-bot, Identity Awareness, IPS, URL Filtering, Application Control, Site-to-Site VPN.
• Wireless LAN: Cisco Unified Wireless Network. Lightweight Access Points (LAPs) only. Controllers: Cisco C9800-40 (large sites), C9800-L (large sites), C9105-AXI (low density). Access Points: C9105-AXI (low), CW9164i (medium), C9136i (high), C9124AXI (outdoor).
• Cabling: Cat7 SFTP for copper, OS2 Orange Sleeve for single-mode fibre, OM4 Purple/Aqua Blue for multimode fibre. Adhere to TIA/EIA568-B standards. Warning labels required every 15m for indoor/outdoor fibre.

Physical Infrastructure:

• IT facilities categorized into 3 types: Wire Centre (low heat), Core Centre (high heat), Data Centre (high heat).
• Availability ratings: Data Centre (99.999%), Core Centre (99.98%), Wire Centre (99.67%).
• Cabling schema: Campus distributor, building distributor, floor distributor, horizontal cable, consolidation points, etc. Consolidation points must be passive and accessible (not public).

Design & Approval:

• All designs and Bills of Materials must be approved by ACSA prior to ordering equipment/software.
• Network device configurations will be supplied by ACSA IT. No independent configuration by service providers.

Network Design:

• Preferred topology for large campuses (ORTIA, CTIA, KSIA): Three-tier hierarchical model (Core, Distribution, Access layers).
• Preferred topology for small campuses (PLZ, ELS, GRJ, BFN, KIM, UTN): Two-tier/Collapsed Core model (Collapsed/Core layer + Access layer).
• Collapsed Core: Distribution and Core layer functions implemented by a single device to reduce costs while retaining hierarchical benefits.
• Redundancy: High availability built into design using HSRP, Port Channels, Switch Stacking, Power Stacking, Redundant Power Supplies, and Dual Fibre Uplinks.

Network design must follow ACSA’s standards:

• Large campuses (ORTIA, CTIA, KSIA): Three-tier hierarchical model (Core, Distribution, Access layers).
• Small campuses (PLZ, ELS, GRJ, BFN, KIM, UTN): Two-tier/Collapsed Core model (Collapsed/Core layer + Access layer).
• Collapsed Core: Single device implements both Distribution and Core layer functions to reduce costs while retaining hierarchical benefits.
• Redundancy: High availability must be built into the design using HSRP, Port Channels, Switch Stacking, Power Stacking, Redundant Power Supplies, and Dual Fibre Uplinks.

Pricing must include:

• Cost of all software licenses (operating systems, database systems, productivity software like Microsoft Office). ACSA will advise post-award on procurement methods (some enterprise agreements may apply).
• Maintenance and warranty costs for new hardware/software, including handover to existing ACSA maintenance contractors where applicable.
• Extended OEM warranties (minimum 5 years) and support services (e.g., 24x7x4 Dell ProSupport Plus, 4-Hour Mission Critical On-site Response for storage/network devices).

General scope:

• ACSA invites proposals for the implementation, support, and maintenance of an Audit Management System (AMS) to support Internal Audit functions.
• The system will aid in audit planning, scheduling, documenting findings, and initiating investigations.
• It will manage compliance, facilitate walkthroughs, perform data analysis, identify weaknesses, inefficiencies, and non-compliance issues, and enable corrective actions.
• The system must comply with the latest global IIA standards.

Project milestones include:

• Software license procurement, installation of the new solution, hardware & software.
• Configuration and customization of the new solution to suit ACSA environment.
• Data migration.
• Integration.
• Solution Testing.
• User Training.
• Deploying solution to production environment.
• System’s post go-live support.
• Handing over the solution to Operations.

General criteria:

• Bidders must be legally registered entities capable of entering into a contract with ACSA.
• Experience in implementing and supporting Audit Management Systems (AMS) or similar solutions for large organizations, preferably in aviation or public sector.
• Demonstrated ability to comply with international audit standards (IIA).
• Financial stability and capacity to deliver the project within the 60-month timeframe.
• Compliance with South African legal and regulatory requirements (e.g., B-BBEE certification may be advantageous).

Technical criteria:

• Proven expertise in system integration, data migration, and customization.
• Ability to provide 24/7/365 support and meet SLAs (e.g., 99.9% uptime, RTO/RPO targets).
• Experience with secure hosting solutions (on-prem or cloud) and disaster recovery planning.
• Familiarity with ACSA’s IT infrastructure or willingness to align with ACSA’s standards (e.g., SSO, encryption).
• Capability to provide comprehensive training and change management support.

Project management criteria:

• Certified project managers (e.g., PMP, PRINCE2) with experience in large-scale IT deployments.
• Ability to adhere to ACSA’s project governance frameworks and reporting requirements.
• Track record of delivering projects on time, within budget, and with minimal disruption.

Additional system criteria:

• The system must comply with ISO/IEC 27001 for information security management.
• The system must be able to operate under partial system failures without losing overall functionality.

Purpose and objectives:

• ACSA seeks an Audit Management System (AMS) to support Internal Audit functions, complying with the latest global IIA standards.
• The system must aid in audit planning, scheduling, documenting findings, and initiating investigations.
• It must manage compliance, facilitate walkthroughs, perform data analysis, identify weaknesses, inefficiencies, and non-compliance issues, and enable corrective actions.

Scope of work:

• Software license procurement, installation, hardware, and software setup.
• Configuration and customization to suit ACSA’s environment.
• Data migration and integration.
• Solution testing and user training.
• Deployment to production environment.
• Post go-live support and handover to operations.

Functional requirements:

• Risk identification, assessment & prioritization: Define risk categories, collect data, use templates/checklists, assign scores, generate risk matrices/heat maps, assign mitigation actions, maintain a risk register.
• Audit planning: Set objectives and boundaries, track objectives, link to tasks, specify audit scope, create checklists, assign auditors, schedule tasks, send reminders, upload documentation, enable remote access, notify stakeholders.
• Audit execution: Log observations/findings/evidence in real-time, support mobile access, communicate with stakeholders, track queries, provide audit trails, log non-compliance, track corrective actions, categorize findings, track meeting notes, enable collaboration.
• Reporting and finalization: Generate audit reports, provide templates, track approval, share reports, track corrective actions, send alerts, schedule follow-ups, formally close audits, archive documentation securely.

Non-functional requirements:

• Hosting: Environment to be determined by the appointed Service Provider.
• Single sign-on: Use ACSA’s AD system for authentication (on-prem or cloud).
• Scalability: Accommodate future increases in functions/users.
• Availability: 24/7/365 operation with 99.9% uptime.
• Fault tolerance: Operate under partial failures without losing functionality.
• Recoverability: Disaster recovery with RTO of 24 hours and RPO of 4 hours.
• Usability: Intuitive, user-friendly UI for varying technical skill levels.
• Maintainability: Modular design for easy updates, comprehensive documentation, 24/7 vendor support with defined response times.
• Compliance: Adhere to ISO/IEC 27001 for information security.
• Environmental: Minimize environmental impact, promote energy efficiency, use eco-friendly materials, ensure durability for airport conditions.
• Encryption: Encrypt all sensitive data at rest and in transit.

Solution guidelines:

• Provide required business functions/services.
• Avoid duplicating existing capabilities unless replacing them.
• Ensure security aligns with business requirements.
• Meet legal/conformance requirements, including privacy.
• Deliver adequate performance/responsiveness.
• Scale for 5 years without redevelopment.
• Ensure reliability and recoverability.
• Validate input data and maintain data integrity.
• Provide APIs conforming to ACSA’s industry standards (e.g., REST, SOAP).
• Avoid hard-coding; externalize variables to databases/parameter files.
• Trap and report errors meaningfully.
• Design intuitive, standards-based user interfaces to reduce training needs.

Referenced standards:

• The system must adhere to ACSA’s prescribed IT Standards (refer to Annexure A).
• The system must meet ACSA’s Service Level Agreement Standards for Service Management, Preventative, and Corrective Maintenance (refer to Annexure B).
• The system must comply with ACSA’s Web Application Security Standards for information security (refer to Information Security: Web Application Security Standards document).

Project management requirements:

• Utilize project management methodologies consistent with leading internationally recognized practices (e.g., PMBOK or PRINCE2).
• Perform project management review and oversight, attend scheduled meetings, ensure key milestones are achieved.
• Define the project team responsible for executing tasks and producing deliverables.
• Plan resources, allocate and schedule work based on team capacity.
• Provide, maintain, and update detailed integrated project planning, identify critical path dependencies.
• Baseline the project schedule within the first four weeks of project kick-off; any changes require project board approval.
• Track project activities to avoid delays, ensure project management activities are carried out, and provide updated communication to stakeholders.
• Report on project progress, budget, risk, and issues; escalate issues as required.
• Manage total projected costs.
• Ensure all assets are tagged and documented prior to installation.
• Conduct stakeholder identification, analysis, and management.
• Enforce project governance to ensure adherence to procedures and policies.
• Draft project charter for sign-off, complete all required project artifacts, and save all documentation in ACSA’s central repository.
• Minute all meetings within 48 hours and list actions in the RAID log.
• Include end-to-end asset management requirements aligned to ACSA policy.
• Provide weekly project reports and monthly Steerco reports in ACSA format.
• Ensure all close-out activities are completed for proper handover to operations.

Training requirements:

• Ensure all relevant stakeholders (internal staff, end-users, administrators) are proficient in using the system.
• Equip users with skills to utilize full functionality, perform tasks efficiently, and minimize errors or security breaches.
• Enable administrators to manage configurations, user access, and ongoing maintenance.
• Provide end-user training (basic navigation, task execution, troubleshooting), system administrator training (setup, user management, integrations, backup/recovery), and super user training (advanced features, customization, troubleshooting).
• Deliver training materials (documentation, guides, manuals with step-by-step instructions and screenshots).
• Conduct online and in-person training sessions, ensure effective knowledge transfer, and offer hands-on sessions.
• Provide post-training support through Q&A sessions, refresher courses, or a dedicated helpdesk.
• Schedule training in phases (administrators and super users first, then end-users) with minimal disruption.
• Conduct post-training assessments, gather feedback, and provide certificates of completion.
• Offer refresher training periodically and ongoing support through helpdesk services.

Change management requirements:

• Identify and analyze key stakeholders (auditors, compliance officers, IT support, managers, end-users).
• Develop clear messaging explaining the change, benefits, and impact; use multiple communication channels (emails, meetings, intranet).
• Engage stakeholders early through feedback, focus groups, or pilot testing.
• Assess impact on user roles, workflows, and responsibilities; identify and address potential resistance.
• Develop risk mitigation strategies (e.g., incentives, creating champions).
• Provide tailored training sessions and materials (manuals, guides, tutorials) for different user groups.
• Offer ongoing support via helpdesk, user forums, and peer-to-peer support.
• Involve end-users in design, implementation, and User Acceptance Testing (UAT).
• Set up feedback channels (surveys, suggestion boxes, focus groups).
• Implement a phased rollout (e.g., pilot department), appoint super-users/champions, and monitor adoption rates.
• Address concerns proactively, incentivize adoption, and offer personal support/coaching.
• Evaluate change impact post-implementation, document lessons learned, and maintain a continuous feedback loop.
• Reinforce adoption by emphasizing benefits, sharing success stories, providing refresher training, and celebrating success.

Environmental requirements:

• Design and operation must minimize environmental impact and promote energy efficiency.
• Use environmentally friendly materials wherever possible.
• System components must be robust enough to withstand the physical conditions of the airport environment, including variations in temperature, humidity, and handling.

2. Functional Requirements The following are functional requirements that need to be delivered by the system. The Audit Management System (AMS) is expected to help streamline the audit process, improve efficiency, and ensure better compliance and reporting. Below are the internal audit requirements that shall be delivered by the system. BR # Requirement Description Available Not available, Priority but can be developed P1/P2/P3 BR 2.1 Risk Identification, Assessment & Prioritization BR 2.1.1 Risk Identification & Assessment BR 2.1.1.1 The system shall enable the user or auditor to define risk categories, criteria, and thresholds. P1 BR 2.1.1.2 The system shall be capable of collecting historical, current, and external data relevant to a risk. P1 BR 2.1.1.3 The system shall include templates, checklists, and collaboration features to assist in identifying potential risks. P1 BR 2.1.1.4 The system shall enable the user to assign likelihood, impact, and exposure scores to each risk and calculate a total risk score. P1 BR 2.1.1.5 The system shall be able to utilize risk matrices or heat maps to prioritize high-risk areas for attention. P1 BR 2.1.1.6 The system shall enable the user to assign mitigation actions, responsible parties, and timelines. P1 BR 2.1.1.7 The system shall enable the user to continuously track and reassess risks, adjusting mitigation strategies as needed. P1 BR 2.1.1.8 The system shall maintain a risk register and generate risk reports for stakeholders. P1 BR 2.1.2 Risk Prioritization BR 2.1.2.1 The system shall enable the user to define P1 risk assessment criteria for likelihood, impact, and risk appetite. BR 2.1.2.2 The system shall enable the user to identify P1 and list all risks in a centralized Risk Register. BR 2.1.2.3 The system shall enable the user to evaluate each risk’s likelihood and impact using predefined scoring systems. P1 BR 2.1.2.4 The system shall generate a risk heat map or risk matrix to visually prioritize risks based on their likelihood and impact. P1 BR 2.1.2.5 The system shall enable the user to rank risks by risk exposure to identify high, medium, and low-priority risks. P1 BR 2.1.2.6 The system shall incorporate organizational risk appetite to flag risks that exceed acceptable thresholds P1 BR 2.1.2.7 The system shall enable the user to assign owners and mitigate actions for high-priority risks, ensuring accountability. P1 BR 2.1.2.8 The system shall enable the user to regularly review and adjust priorities as the risk landscape evolves. P1 BR 2.2 Audit Planning BR 2.2.1 Defining audit objectives BR 2.2.1.1 The system shall enable the user to set objectives, goals, outcomes and boundaries for the audit. P1 BR 2.2.1.2 The system shall enable the user to track the objectives and scope throughout the audit lifecycle. P1 BR 2.2.1.3 The system shall enable the user to link the objectives to specific audit tasks. P1 BR 2.2.1.4 The system shall enable the user to specify departments, processes, or systems to be audited. P1 BR 2.2.1.5 The system shall enable the user to define what is not part of the audit scope. P1 BR 2.2.2 Audit Checklist: The system shall enable the user to create checklists based on audit standards or guidelines. These will serve as the audit framework. P1 BR 2.2.3 Assigning Auditors The system shall enable the user to assign roles and responsibilities to auditors to track team members, timelines, and milestones. P1 BR 2.2.4 Scheduling an Audit: BR 2.2.4.1 The system shall enable the user to schedule audit tasks P1 BR 2.2.4.2 The system shall be able to send reminders or notifications to auditors about upcoming deadlines. P1 BR 2.2.5 Audit Preparation (Pre-Audit Activities) BR 2.2.5.1 The system shall enable the user to create an audit checklist that specifies the steps, procedures, and tests that need to be followed during the audit. P1 BR 2.2.5.2 The system shall enable the user to upload and organize all relevant documentation (e.g., financial statements, compliance reports, policies, procedures, prior audit reports) for auditors to review. P1 BR 2.2.5.3 The system shall enable the user to access documents remotely and securely. P1 BR 2.2.5.4 The system shall enable the user to notify stakeholders (such as department heads or relevant teams) about the audit, including preparation requirements. P2 BR 2.3 Audit Execution BR 2.3.1 The system shall enable the user to log their observations, findings, and evidence in real- time, ensuring all information is captured electronically. P1 BR 2.3.2 The system shall support mobile access, allowing auditors to update findings on the go. P1 BR 2.3.3 The system shall enable the user to communicate with management, department heads, and other stakeholders P1 BR 2.3.4 The system shall enable the user to track and manage queries or follow-up requests P1 BR 2.3.5 The system shall provide audit trails, allowing for easy tracking and retrieval of supporting documents, comments, and observations P1 BR 2.3.6 The system shall enable the user to log non- compliance, discrepancies, or risks identified for further investigation or resolution. P1 BR 2.3.7 The system shall enable the user to track the status of the findings and ensure corrective actions are planned and implemented. P1 BR 2.3.8 The system shall enable auditors to categorize and rank findings based on their severity. P1 BR 2.3.9 The system shall enable the user to track meeting notes, actions, and outcomes. P2 BR 2.3.10 The system shall enable collaboration between auditors, management, and other relevant stakeholders. Documents, findings, and comments can be shared, discussed, and reviewed in real time. P1 BR 2.4 Reporting and Finalization BR 2.4.1 The system shall enable the user to generate comprehensive audit reports that detail the findings, issues, recommendations, and overall audit conclusions. P1 BR 2.4.2 The system shall provide templates for generating consistent and professional audit reports P1 BR 2.4.3 The system shall track the approval process and allow for comments or edits to be made before finalizing the audit report. P1 BR 2.4.4 The system shall enable the user to share audit reports with stakeholders, management, and other relevant parties P2 BR 2.4.5 The system shall enable the user to track corrective actions P2 BR 2.4.6 The system shall track the progress of corrective actions, ensuring that issues identified in the audit are addressed. P1 BR 2.4.7 The system shall send alerts to managers and auditors about the status of the actions P1 BR 2.4.8 The system shall enable the user to schedule follow-up audits or reviews to verify whether corrective actions have been effectively implemented and whether the issues have been resolved. P2 BR 2.4.9 The system shall enable the user to formally close the audit once all findings have been reviewed, corrective actions implemented, and any follow-up audits completed P1 BR 2.4.10 The system shall ensure that all documentation, reports, and audit records are archived for future reference and compliance requirements P1 BR 2.4.11 The system shall ensure that the records are securely stored and easily retrievable when needed. P1

General: Applicants must be legally registered entities capable of entering into a contract. Experience in supplying, supporting, and maintaining Audit Management Systems is likely required. Financial stability and ability to fulfill a 5-year contract may be assessed. Specific: Prior experience with airport or large-scale enterprise systems may be advantageous. Compliance with South African Broad-Based Black Economic Empowerment (B-BBEE) policies may be required. Technical and operational capacity to deliver the system and support must be demonstrated.

Scope: Supply, support, and maintenance of an Audit Management System for up to 60 months. Deliverables: Analysis and Design (Technical Specifications, Architecture Design, Functional Requirement Specification), Build/Development/Configuration, Testing (Functional and Performance Tests), Subscriptions, Hosting Environments (Development, Test, Production), Change Management (Training), Manuals (User and Operational), Project Management, Documentation, and Other related items.

Pricing structure: Section A (Capex Cost Schedule), Section B (Opex Costs Schedule), Section C (Total Cost of Ownership). Itemized costs required for: Analysis and Design, Build/Development/Configuration, Testing, Subscriptions, Hosting Environments, Change Management, Manuals, Project Management, Documentation, and Other. Provide totals excluding and including VAT. OPEX costs must be broken down annually for 5 years. Final totals must include combined CAPEX + OPEX costs, excluding and including VAT.

• The tender is for the supply, support, and maintenance of an Audit Management System for Airports Company South Africa (ACSA) over a maximum period of 60 months.
• The system must align with ACSA’s Web Application Security Standards.
• The system must cover all web applications used by ACSA, including off-the-shelf, customized, bespoke, and mobile applications (tablets/smartphones), as well as internal and public-facing applications, including those hosted by external providers.

• Applicants must be legally registered entities capable of entering into a contract with ACSA.
• Applicants must demonstrate experience in supplying, supporting, and maintaining Audit Management Systems or similar enterprise-level software.
• Applicants must have a proven track record in implementing secure web applications compliant with international security standards.
• Applicants must provide references or case studies of similar projects completed successfully.
• Demonstrated expertise in web application security, including authentication, cryptography, and secure data handling.
• Experience with mobile application security for enterprise systems.
• Familiarity with compliance frameworks such as ISO 27001, NIST, or OWASP standards.
• Ability to integrate with existing IT infrastructure and adhere to ACSA’s security policies.
• Applicants must provide proof of financial stability to fulfill the 60-month contract.
• Applicants may be required to provide financial statements or bank guarantees.
• Compliance with South African labor laws and B-BBEE (Broad-Based Black Economic Empowerment) requirements, if applicable.
• Applicants must agree to ACSA’s terms and conditions, including confidentiality and data protection clauses.

Scope: Supply, support, and maintenance of an Audit Management System for Airports Company South Africa (ACSA) for a maximum of 60 months. The system must cover all web applications used by ACSA, including off-the-shelf, customized, bespoke, and mobile applications (tablets/smartphones), as well as internal and public-facing applications, including those hosted by external providers.

Technical Requirements:

• Architecture and Design: Only necessary components must be used. A high-level architecture must be defined and adhered to. No sensitive business logic, secret keys, or proprietary information may be exposed in client-side code.
• Authentication: Must verify digital identity, ensure only authorized users can authenticate, and transport credentials securely. Key requirements include:

• All pages/resources must require authentication by default unless public.
• Credentials must not be pre-filled by the application.
• Authentication controls must be server-side enforced and fail securely.
• Password fields must support secure, complex passwords (e.g., passphrases).
• Password recovery must not reveal current passwords or send new passwords in clear text.
• No default passwords (e.g., "admin/password") may be used.
• Anti-automation must prevent brute force and account lockout attacks.
• Administrative interfaces must be protected by secure encrypted channels.

• Session Management: Sessions must be unique, invalidated on logout, and timed out after inactivity. Session IDs must never be disclosed in URLs, error messages, or logs. Cookies must use "HttpOnly" and "secure" attributes.
• Access Control: Principle of least privilege must apply. Access to sensitive records must be protected. Directory browsing must be disabled. Access controls must fail securely and be enforced server-side.
• Input Validation: All input must be validated and sanitized. The system must protect against SQL injection, LDAP injection, OS command injection, XSS, XML attacks, and HTTP parameter pollution.
• Cryptography: Cryptographic modules must fail securely. Random number generators must be cryptographically approved. Keys must be managed securely and be replaceable.
• Error Handling and Logging: Logs must be high-quality, protected from unauthorized access, and not store sensitive data. Audit logs must support non-repudiation. Logs must be stored separately from the application with proper rotation.
• Data Protection: Sensitive data must be encrypted, not cached client-side, and not sent via URL parameters. Client-side storage (e.g., local storage, cookies) must not contain sensitive data.
• Communications Security: TLS must be used for all sensitive data transmissions. Strong algorithms and ciphers must be enforced. Certificate paths must be verified, and revocation checks (e.g., OCSP Stapling) must be enabled.
• HTTP Security: Application server must be hardened. HTTP responses must specify safe character sets. Unnecessary HTTP methods (e.g., TRACE, PUT, DELETE) must be blocked. Security headers (e.g., CSP, X-FRAME-OPTIONS, X-XSS-Protection) must be implemented.
• File Handling: Untrusted files must be stored outside the webroot with limited permissions. Uploaded files must be scanned for malware. Untrusted data must not be executed or embedded directly.
• Mobile Security: Mobile apps must enforce the same security controls as the server. Sensitive data must be stored securely on devices. TLS must be used for all sensitive data transmissions. Device identifiers (e.g., UDID, IMEI) must not be used as authentication tokens. Sensitive data must not be stored unencrypted or in shared resources.

Classification of Controls:

• All Applications: Compulsory for all web applications. Protects against easily discoverable/exploitable vulnerabilities.
• Medium Criticality Applications: Compulsory for applications handling sensitive data (e.g., internal info, employee data, intellectual property). Standard controls for modern web applications.
• High Criticality Applications: Compulsory for applications performing high-value transactions or storing highly sensitive data (e.g., trade secrets, critical organizational data). Advanced controls for highest security assurance.

Quality Management System: Compliance with ISO 9001 is required.

Related Procedures:

• Document Control Procedure (Z001 006M).
• Record Keeping Requirements Procedure (Z001 008M).

Monitoring and Review:

• Monthly reports and reviews by the IT Service Desk to ensure adherence to the procedure.
• Annual management review by the Senior Manager: Digital Infrastructure and Operations to measure implementation and adherence.
• The procedure is subject to a 3-year review cycle or earlier if necessary due to legal, business, or operational changes.

• Compliance with ACSA Web Application Security Standards (G010 011M) is mandatory.
• Adherence to ISO 9001 Quality Management System.
• Compliance with ACSA’s Document Control Procedure (Z001 006M) and Record Keeping Requirements Procedure (Z001 008M).
• Non-conformance must be reported and addressed via Corrective and Preventative Measures (Non-Conformance and Non-Compliance Procedure Document - Z001 001M).
• Accountability for adherence lies with the Senior Manager: Information Security, Chief Information Officer, and Chief Executive Officer.
• Internal audits will be conducted to verify compliance.
• Records must be maintained for a minimum of 5 years, as per ACSA’s retention schedule.
• Contract Duration: Maximum of 60 months.
• Security Control Levels:

• All Applications: Mandatory baseline controls for all web applications to mitigate easily exploitable vulnerabilities.
• Medium Criticality Applications: Mandatory for applications handling sensitive data (e.g., internal info, employee data, intellectual property). Standard controls for modern web applications.
• High Criticality Applications: Mandatory for applications processing high-value transactions or storing highly sensitive data (e.g., trade secrets, critical organizational data). Advanced controls for highest security assurance.

• The contract will be monitored through executive committee oversight and internal audits.
• The procedure will be reviewed every 3 years or earlier if required by legal changes, business needs, or updates to practices.

• Contract Duration: Maximum of 60 months.
• Security Control Levels:

• All Applications: Mandatory baseline controls for all web applications to mitigate easily exploitable vulnerabilities.
• Medium Criticality Applications: Mandatory for applications handling sensitive data (e.g., internal info, employee data, intellectual property). Standard controls for modern web applications.
• High Criticality Applications: Mandatory for applications processing high-value transactions or storing highly sensitive data (e.g., trade secrets, critical organizational data). Advanced controls for highest security assurance.

• The contract will be monitored through executive committee oversight and internal audits.
• Non-conformance must be reported and addressed via ACSA’s Non-Conformance and Non-Compliance Procedure (Z001 001M).
• The procedure will be reviewed every 3 years or earlier if required by legal changes, business needs, or updates to practices.

Supply, support, and maintenance of an Audit Management System for Airports Company South Africa over a maximum period of 60 months. The system must cover modules including risk management, audit planning/execution, stakeholder relations, tenant management, traffic development, training academy, and data migration.

Bidders must be legally registered entities with compliance to South African procurement laws and ACSA policies. Financial and technical capacity to deliver over 60 months is required. Scoring: Minimum threshold of 1296 points (out of 1728) qualifies for evaluation points (30, 14, 8, or 0). For functional categories: ≥90% of total score (428/475) earns 50 points; 80–89% earns 30 points; 70–79% earns 20 points; <70% earns 0 points.

Supply, support, and maintenance of an Audit Management System for ACSA over 60 months. Key modules: Risk Identification, Assessment & Prioritization; Audit Planning; Audit Execution; Reporting and Finalization; Stakeholder Relations Management; Tenant Relationship Management; Traffic Development Unit; Training Academy; Data Migration. Each module has detailed business requirements (BR) with sub-requirements. Bidders must confirm for each BR whether functionality is available or can be developed.

Bidders must complete Annexure E (Business Requirements Compliance Response Document) by indicating for each listed business requirement (BR) whether the functionality is: - Available, or - Not available but can be developed. Requirements are prioritized as P1 (Mandatory) or P2 (Highly Desirable).

Bidders must complete Annexure E (Business Requirements Compliance Response Document) by indicating for each business requirement (BR) whether the functionality is: - Available, or - Not available but can be developed. This is a mandatory returnable document.

Evaluation will consider the following: - Legal registration in South Africa or local presence. - Compliance with South African procurement laws and ACSA vendor requirements. - Demonstrated experience in supplying, supporting, and maintaining Audit Management Systems for large organizations (preferably aviation or public sector). - Financial and technical capability to fulfill the 60-month contract. Technical criteria include: - Proven track record of delivering systems with P1-priority functionalities (e.g., risk assessment, audit planning, real-time logging). - Ability to customize or develop missing functionalities as proposed. - Compliance with data security and confidentiality standards (e.g., ISO 27001, POPIA). - Support for multi-user collaboration, mobile access, and secure document management. Documentation requirements: - Detailed proposal addressing all BR requirements (available/not available but can be developed). - Case studies or references from similar projects. - Project implementation plan with timelines and milestones. - Proof of technical support and maintenance capabilities for the 60-month period.

The Audit Management System must support the following core functionalities, categorized by priority (P1 = Mandatory, P2 = Highly Desirable): - Risk Identification, Assessment & Prioritization: Define risk categories, criteria, and thresholds; collect historical/current/external risk data; use templates/checklists/collaboration tools; assign likelihood/impact/exposure scores; calculate total risk scores; utilize risk matrices/heat maps; assign mitigation actions/responsible parties/timelines; track/reassess risks; maintain risk register; generate risk reports; define risk assessment criteria; rank risks by exposure; flag risks exceeding risk appetite; review/adjust priorities. - Audit Planning: Set audit objectives/goals/outcomes/boundaries; track objectives/scope; link objectives to tasks; specify departments/processes/systems to audit (and exclusions); create checklists based on audit standards; assign roles/responsibilities to auditors; schedule audit tasks; send deadline reminders/notifications; upload/organize/securely access audit documentation; notify stakeholders of preparation requirements. - Audit Execution: Log observations/findings/evidence in real-time; support mobile access; communicate with management/stakeholders; track/manage queries/follow-ups; provide audit trails; log non-compliance/discrepancies/risks; track status of findings/corrective actions; categorize/rank findings by severity; track meeting notes/actions/outcomes; enable real-time collaboration. - Reporting and Finalization: Generate comprehensive audit reports; use templates for consistency; track approval processes/allow edits; share reports with stakeholders; track/monitor corrective actions; send alerts on action status; schedule follow-up audits; formally close audits; archive all documentation securely for compliance/retrieval.

• Request for Proposal for the supply, support, and maintenance of an Audit Management System for up to 60 months at Airports Company South Africa.
• The system aims to implement a solution streamlining internal audit processes, aiding planning, scheduling, findings documentation, investigations, compliance management, inspections, data analysis, and corrective actions.

• Bid Closing Date and Time: 10 July 2026 at 12:00.
• Compulsory Briefing Session: 12 June 2026 at 10:00 via Microsoft Teams (link: https://teams.microsoft.com/meet/361395049765900?p=o1juTAuPEkvh07MRqu, Meeting ID: 361 395 049 765 900, Passcode: et3d9Bd9). Dial-in: +27 21 834 0841, conference ID: 525 637 91#. Attendance is mandatory; register online by providing your name, email, and telephone number in the chat.
• Query Closing Date: 29 June 2026.
• Clarification Deadline: Requests for clarity must be submitted by 19 June 2026 at 17:00.

• For bidding procedure enquiries: Contact Sydney Mfeka, SCM Category Specialist. Email: [email protected]. Telephone: 011 723 1483.
• General ACSA contact: Tel: +27 11 723 1400, Fax: +27 11 453 9354.
• Physical address for submission: Airports Company South Africa, Western Precinct, Aviation Park, O.R. Tambo International Airport, 1 Jones Road, Kempton Park, Gauteng, 1632.
• Postal address: P O Box 75480, Gardenview, Gauteng, 2047.
• Website: www.airports.co.za.
• Clarifications: Strictly via email to [email protected] until 19 June 2026 at 17:00. Do not contact other ACSA employees.
• Fraud and corruption hotline: Tip-offs Anonymous at 0800 00 80 80 or 086 726 1681, email: [email protected].

• Submit your bid by hand delivery only to Tender Box C at Airports Company South Africa, 3rd Floor, North Wing, OR Tambo International Airport, Kempton Park, by 12:00 on 10 July 2026.
• The bid must include an original printed copy and a USB, with the Bid Offer in a separate sealed envelope.
• The original document is legally binding; in case of discrepancies, the original takes precedence.
• Clearly label the outside of your submission with your return address, bid description, bid number, and SCM department details.
• Ensure the Tender Deposit Register is completed and signed by the person depositing the bid.
• Late submissions will not be accepted.
• Do not alter the bid document; any changes may lead to disqualification.
• ACSA may subject bidders to security vetting due to National Key Point regulations; non-compliance may result in disqualification.
• Alternative bids are generally not accepted unless specifically requested by the Accounting Officer.

BID RESPONSE DOCUMENTS MAY BE DEPOSITED IN THE BID BOX SITUATED AT (STREET ADDRESS) Tender box: C The Tender box is located at: Airports Company South Africa 3rd Floor, North Wing OR Tambo International Airports Kempton Park (NB: Tender Deposit Register must be completed and signed by person depositing the bid documents)

• Evaluation follows a staged approach: Mandatory Requirements, Functionality/Technical, Price and Preference.
• Stage 1 Mandatory Requirements: Must provide OEM accreditation/certification proving partnership with the OEM for the Audit Management System, complete Annexure D (Self Scoring), Annexure E (Business Requirements), the Pricing Schedule, and attend the compulsory briefing session. Failure to meet these leads to disqualification.
• Stage 2 Functionality: Scored out of 100 points with a minimum threshold of 80 points. Weighting: Bidders Experience (30), Business Requirements (50), Solution Delivery Timelines (20).
• Stage 3 Price and Preference: Uses the 80/20 preference point system (80 points for price, 20 for specific goals). Price points calculated using formula Ps = 80(1 - (Pt - Pmin)/Pmin).
• Preference Points: Up to 20 points for specific goals: B-BBEE status level (Level 1: 5 points, Level 2: 4.5, Level 3: 4, Level 4: 3, Level 5: 2, Level 6: 0.5, Level 7: 0.3, Level 8: 0.1, Non-compliant: 0), Black youth majority-owned entities (5), Black women majority-owned entities (5), Company majority owned by people with disabilities (5).
• Provide proof for preference claims: valid sworn affidavit or SANAS-accredited B-BBEE certificate (consolidated for JVs).

• Scope: Supply, support, and maintenance of an Audit Management System for a maximum period of 60 months at Airports Company South Africa.
• The system aims to streamline internal audit processes, including audit planning, scheduling, risk assessment, fieldwork, findings management, reporting, workflow controls, document management, compliance alignment, analytics, and user security.
• The solution must assist with audit execution, compliance management, walkthrough inspections, data analysis, and identifying weaknesses to implement corrective actions.
• The contract will be for 60 months, with ACSA retaining the right to terminate, postpone, or delay upon written notice.
• Detailed scope is provided in Annexure A (Scope of Work).

• Evaluation uses a staged approach: check documents, evaluate functionality/technical aspects, evaluate price and preference, conduct post-tender negotiations, and perform security vetting.
• Stages must be completed sequentially; ACSA may allow reasonable time for submitting required information.

• Bidders’ experience is weighted at 30 points out of 100 in the functionality evaluation.
• No further details on specific experience or personnel qualifications are provided in the extracted text.

• Submit a completed Pricing Schedule (Annexure C) as a mandatory requirement.
• No further details on pricing format, rates, or payment schedules are provided in the extracted text.

• Submit a completed Pricing Schedule (Annexure C) as part of mandatory requirements.
• Prices must remain firm and valid for a validity period of 120 business/working days from submission.
• The evaluation includes a price scoring component using the 80/20 preference point system.
• No specific payment terms, bonds, or guarantees are detailed in the extracted text.

• Tax Compliance: Submit a valid Tax Compliance Status (TCS) PIN from SARS or a Central Supplier Database (CSD) number. Foreign bidders must declare if they have a branch, permanent establishment, or income source in RSA; if not, TCS PIN registration may not be required.
• B-BBEE: Provide a B-BBEE certificate from a SANAS-accredited rating agency or a sworn affidavit for QSE/EME. Joint ventures must submit a consolidated certificate.
• Company Registration: Provide a certificate of incorporation showing ownership split.
• Central Supplier Database: Submit a CSD report.
• VAT: Complete a VAT questionnaire if applicable.
• Other Documents: Declaration of Interest and Politically Exposed Persons form, SBD 4 Bidder’s Disclosure Form, SBD 6.1 Preference Points Claim Form, Confidentiality and Non-Disclosure Agreement, Information Security Standards Framework, ACSA Terms and Conditions, and a letter of good standing.
• Ensure all submitted documents remain valid for the contract duration; update ACSA if any expire.

• Contract Duration: 60 months upon appointment, based on ACSA’s contract template.
• Termination: ACSA may terminate, postpone, or delay the contract upon written notice as per prescribed process.
• Validity Period: Bid prices must remain firm for 120 business/working days.
• Confidentiality: ACSA will not disclose bidder information without written approval; bidders must not disclose ACSA information and must have third parties sign confidentiality agreements if consulted.
• Security Vetting: ACSA is a National Key Point; bidders may be subject to security vetting, and non-compliance may lead to disqualification.
• Disclaimers: ACSA reserves rights to award whole or part of the bid, split awards, negotiate with shortlisted bidders, award to other than the highest scorer, reject the lowest acceptable bid, or cancel the bid.
• Changes to the bid document are prohibited and may lead to disqualification.

• Alternative bids are generally not accepted unless requested by the Accounting Officer.
• Late bids will not be accepted.
• Bid responses must strictly comply with the document; non-compliance may lead to disqualification. No changes allowed after closing.
• Bidders may not have interests in other bidders/consortia.
• ACSA is a National Key Point; security vetting may apply, and non-compliance may disqualify bidders.

• Foreign bidders must declare residency, branch, permanent establishment, income source, and tax liability in RSA; if none, TCS PIN registration may not be required.
• Bids must be submitted on official forms, not retyped, and comply with the Preferential Procurement Policy Framework Act and regulations.
• Successful bidder must sign a written contract post-award.
• Tax compliance is mandatory; provide TCS PIN or CSD number, with separate submissions for consortia/JVs.
• Failure to provide required particulars may render the bid invalid.

Submit the following returnable documents as part of your bid:

• Signed/stamped original contactable reference letter(s) from client(s) where the Audit Management System or similar solution was implemented. Each letter must include: clear letterhead, client’s contact details, scope of services rendered, contract duration (start and end date), and signature by the client’s authorized official.
• Implementation plan detailing: executive overview, critical path, development approach, testing approach (unit, functional, performance, stress, vulnerability), evidence of a complete Project Management Life Cycle, and reporting areas, mechanisms, and frequency during project management.
• System architecture diagram including: solution overview (key components), environments (Dev, QA, Pre-prod, Test, Production), communication protocols (e.g., HTTP, HTML, XML, REST API, JSON), backup requirements (process, storage, restoration), and business continuity configuration.

Required returnable documents:

• Signed/stamped original contactable reference letter(s) from client(s) where the Audit Management System or similar solution was implemented.

Evaluation is scored out of 100 points with the following breakdown:

1. Bidder’s Experience (30 points):

• 5+ cumulative years of relevant experience in implementing, supporting, and maintaining an Audit Management System: 30 points.
• 3 to <5 years: 20 points.
• 1 to <3 years: 10 points.
• <1 year: 0 points.

2. Business Requirements (50 points):

• Score ≥200 points: 50 points.
• Score ≥150 and <200 points: 40 points.
• Score ≥125 and <150 points: 20 points.
• Score <125 points: 0 points.

3. Solution Delivery Timelines (20 points):

• Delivery in <10 months: 20 points.
• Delivery in exactly 10 months: 10 points.
• Delivery in >10 but <12 months: 5 points.
• Delivery in ≥12 months: 0 points.

Additional Rules:

• Minimum 80 overall points required to proceed to the demo evaluation stage.
• Only bidders meeting the 80-point threshold will be invited for a demo. The demo must clearly show the Audit Management solution, and only P1 requirements will be evaluated.

Scope: Supply, support, and maintenance of an Audit Management System for Airports Company South Africa for a maximum period of 60 months.

Technical Requirements:

• System must support multiple environments: Dev, QA, Pre-prod, Test, and Production.
• Must utilize communication protocols such as HTTP, HTML, XML, REST API, or JSON.
• Backup requirements: Define how backups are performed, stored, and restored, including user request processes.
• Business Continuity: System must be configured to ensure uninterrupted business operations.
• System architecture diagram must illustrate structure, components, and interactions.

Testing Requirements:

• Testing approach must cover unit, functional, performance, stress, and vulnerability testing.

System Architecture Diagram must illustrate the structure and components of the system, showing how its various parts interact. Include:

• Solution Overview (key components).
• Environments (Dev, QA, Pre-prod, Test, Production).
• Communication protocols (e.g., HTTP, HTML, XML, REST API, JSON).
• Backup requirements (process, storage, restoration).
• Business Continuity configuration.

Bidder’s Experience Requirements:

• Provide signed/stamped original contactable reference letter(s) from client(s) where the Audit Management System or similar solution was implemented. Each letter must include:

a) Clear letterhead.

b) Client’s contact details.

c) Scope of services rendered.

d) Contract duration (start and end date).

e) Signed by the client’s authorized official.

Evaluation Criteria for Experience:

• 5+ cumulative years of relevant experience: 30 points.
• 3 to <5 years: 20 points.
• 1 to <3 years: 10 points.
• <1 year: 0 points.

Quality requirements:

• System must support multiple environments: Dev, QA, Pre-prod, Test, and Production.
• Backup requirements: Define how backups are performed, stored, and restored, including user request processes.
• Business Continuity: System must be configured to ensure uninterrupted business operations.

Solution Demo Evaluation:

• Only bidders meeting the overall minimum score (80 points) will be invited.
• Bidders must present a demo clearly showing the Audit Management solution.
• Only P1 requirements will be evaluated.