Enterprise vulnerability scanning management solution: licensing, implementation, maintenance & support (5-Year contract)

All enquiries must be directed to: Tender Office, SCM Division, Radio Park Office Block, Henley Road, Auckland Park, Johannesburg, South Africa. Email: [email protected]. Unauthorised communication with SABC staff (outside this channel) may result in disqualification. Whistleblower hotline: 0800 372 831 (for reporting fraud, theft, or corruption). Submission email: [email protected].

Submit bids electronically to [email protected] in PDF format (write-protected). Separate financial and technical responses into distinct attachments. Email subject line must include: Bidder’s Name, Tender Number (RFP/IT/2026/10249272/11), and Tender Title. Submit at least 30 minutes before 17 June 2026 @ 12h00 to avoid transmission delays. Late submissions are rejected. SABC is not liable for incomplete bids, transmission failures, or misidentified submissions. Include all mandatory and required documents. Required forms: SBD 6.1 (Preference Points Claim), SBD 8 (Past SCM Practices), SBD 9 (Independent Bid Determination), and all annexures listed in the RFP. Non-compliance with submission rules (e.g., unsigned pages, altered bid forms, or missing documents) may result in automatic disqualification.

Automatic disqualification for: Non-submission of mandatory documents (OEM authorization, ISO 27000/27001, ISO 9001), invalid or missing CSD registration, unresolved tax/TV license issues, or misrepresentation/fronting. B-BBEE compliance is mandatory; winning bidder must maintain or improve their B-BBEE level. Bids must comply strictly with technical specifications; non-compliance results in disqualification. Evaluation stages: 1) Mandatory compliance check (CSD, tax, TV license, certifications, OEM authority), 2) Technical compliance (scope, deliverables, standards), 3) Functional evaluation (capabilities, reporting, remediation), 4) Financial evaluation (pricing, cost inclusivity). Preference points awarded per PPF 2017 regulations (SBD 6.1). SABC reserves the right to reject non-compliant bids, negotiate with preferred bidders, or award to the highest-scoring bidder (not necessarily lowest price).

Scope: Licensing, implementation, maintenance, and support of an Enterprise Vulnerability Scanning Management Solution for 5 years. Minimum capabilities: Flexible scanning options, unified endpoint agent, dynamic asset discovery, live/customizable dashboards, threat-aware risk prioritization (with active risk scoring), AI-driven CVSS scoring, expert-curated vulnerability research, integrated threat feeds, remediation projects/goals/SLAs, policy assessment (PCI, CIS, NIST), advanced report customization, dynamic discovery (VMware, Mobile), distributed scanning, Microsoft Azure/AWS support, dynamic asset groups/tagging, Real Risk score, integrated vulnerability validation (Metasploit), executive/remediation reporting, multi-OS support (Windows, Linux). Must scan and identify all vulnerabilities (manual, scheduled, or continuous; full/partial; non-intrusive). Subscription licensing for max 10,000 IP addresses. Implementation on new hardware (physical or virtual with redundancy), log production, and integration with SABC Enterprise Monitoring Tool. Managed service must include: Monthly vulnerability scanning/assessment, asset/risk prioritization, executive reports (trends, risk scores, heatmaps), technical remediation reports (exploitable/high-risk vulnerabilities), patch status/remediation progress tracking, attack surface monitoring, vulnerability exception/risk acceptance handling, solution maintenance/support, monthly remote meetings, training, and a detailed project plan. Reporting: Live dashboards, pre-formatted templates (Assets, Containers, Executive Summaries, Vulnerabilities), consolidated reporting (vulnerabilities, configurations, policy compliance, asset details), asset/vulnerability filtering, customizable queries, CSV exports, remediation tracking/validation, threat-aware prioritization, audit reports. Network vulnerability assessment: Discovery (all assets, OS, applications, services), unified vulnerability/configuration assessment, container assessment, authenticated scans, virtual/cloud environment support, network change adaptation, scheduled scanning (monthly/weekly/daily). Prioritization: Risk scoring, business context adjustment, threat feeds, vulnerability validation. Remediation: Automated/IT-integrated patching, automated containment, remediation workflows/planning, remediation analytics. Administration: Role-based access, exceptions management, application/coverage updates. Compliance: Templates for PCI, NIST, CIS; configuration/compliance assessments in single scan; controls assessment.

Pricing must be in South African Rand (ZAR) with VAT as a separate line item. Prices must be fixed for the first year; annual increases capped at CPI. All costs must be included: guarantee bonds, taxes, duties, customs, customs clearance, inland transportation, storage, unpacking, installation, integration, testing, packaging, and full project duration costs. Local suppliers quoting in foreign currency must convert to ZAR and provide exchange rate evidence. Payment terms: 60 days from invoice date. Foreign currency payments (if applicable) via telegraphic/wired bank transfer. Bidder must provide: Bank name/address, company account number, and SWIFT/sort code. Bid validity: 180 days from closing date. Schedule of Quantities required: Itemised descriptions, quantities, and unit prices. No price changes allowed post-submission unless negotiated with SABC. Prices for supplies requiring installation must include all delivery-on-site costs. Returnable packaging must specify credit amounts. Bid prices must cover the entire 5-year period.

Mandatory documents: CSD registration details (unique reference number), SARS Compliance Status PIN (for tax validation), valid B-BBEE certificate (SANAS-accredited) or sworn affidavit for EMEs/51% black-owned QSEs (confirming annual turnover ≤R10M for EMEs or R10M–R50M for QSEs, and black ownership percentage). Proof of valid TV license (company, shareholders, directors) or affidavit if none; SABC will verify internally. Certified company registration document (name, registration number, date, active directors/members), certified shareholders’ certificates, certified ID copies of directors/members, and last 3 years’ audited financial statements or management accounts. Mandatory certifications: ISO 27000/27001 (Information Security Management) and ISO 9001 (Quality Management) at company level, valid for 2026 and not expiring within 9 months of submission. Proof of authority from OEM to resell/distribute the proposed solution in South Africa (valid for 9 months from closing date). No contract awarded to bidders with outstanding tax/TV license issues or not registered on CSD. Winning bidder must maintain or improve B-BBEE level. IRBA-accredited auditors cannot issue B-BBEE certificates post-30 September 2016. Misrepresentation or fronting is prohibited; may result in criminal charges or blacklisting. Trusts/consortia/joint ventures must submit B-BBEE certificates under their name or consolidated scorecards. Start-ups may use EME or QSE/Generic Scorecard. Local content percentage must be stated for equipment/goods partially or fully manufactured in South Africa, with supporting documentation. Required forms: SBD 6.1 (Preference Points Claim), SBD 8 (Past SCM Practices), SBD 9 (Independent Bid Determination), Declaration of Interest (SBD 4), Acceptance of Conditions of Bid.