5-Year it/ot cybersecurity soc as a service for rand water

• Bidding procedure enquiries — Buyer:

– Contact person: Bonolo Ramohlala

– Telephone: 011 682 0815

– Email: [email protected] (submissions must be made to this address — note: this appears to be for enquiries only; physical submission is mandatory)

• Bidding procedure enquiries — Sourcing Manager:

– Contact person: Ntikane Radebe

– Telephone: 011 682 0208

– Email: [email protected]

• Physical submission address: Rand Water Head Office, 522 Impala Road, Glenvista, 2058 (Bid Submissions Box at Main Gate).

• Submit one (1) original bid document plus all returnables.
• USB flash drive with PDF copies may be provided in addition, but is not a substitute for the original.
• Seal the submission and endorse clearly with bid number (RW10405769/25) and full bid description.
• Submit physically at: Rand Water Head Office, 522 Impala Road, Glenvista, 2058 — place in the Bid Submissions Box at the Main Gate.
• Closing date and time: 09 March 2026 at 12:00 (document states 12:00; tender record states 10:00 — follow document time of 12:00 as ground truth).
• Bid validity: 180 days after closing date; Rand Water may extend this period.
• No telephonic, telegraphic, telex, facsimile or e-mailed bids accepted.
• No correction fluid or similar substances permitted on documents.
• No bid substitutions allowed after closing date and time.
• Clarification requests: submit no later than 15 calendar days before closing date.
• Rand Water will issue final clarification responses and any addenda no later than 10 calendar days before closing date; addenda published on eTender Portal.
• Disqualification risks: use of correction fluid, late submission, electronic submission, failure to submit mandatory returnables at closing (T2.1.1), or failure to respond to post-closing requests for non-disqualifiable returnables within 5 working days.

• Evaluation is four-stage: (1) Test for Responsiveness/Pre-qualification, (2) Functionality Evaluation, (3) Preference Point System, (4) Objective Criteria.

Stage 1 — Responsiveness/Pre-qualification (pass/fail, all must be met):

• Fully completed and signed Form of Offer.
• No correction fluid used.
• OEM partnership letter on registered OEM letterhead.
• Fully completed, signed and commissioned SOC Data Hosting Affidavit (Annexure B) confirming data hosted within South Africa.

Stage 2 — Functionality (minimum 70/100 required to proceed):

• A. Record of Previous Experience (weight 15): minimum 3 projects over 3+ years in IT/OT cybersecurity/SOC services; 3 signed client reference letters required with client name, address, contact person, contract duration.
• B. Human Resource Capacity (weight 20): Team Leader (CISM, CISA, CGEIT, 5+ years relevant, 3+ years management); Technical/Risk Lead (CEH/CASP/CISSP/CISM, 5+ years IT/OT security design/build/maintenance); 4 Cyber/Security Engineers/Specialists (cloud/server security, network security, senior security architecture, OT cybersecurity — SCADA/PLC/HMI). Submit company organogram, project team list, CVs, resource allocation.
• C. Equipment Resource Capacity (weight 10): detail SOC and SIEM tools, office space, resource utilisation, vehicles, working tools.
• D. Risk Introduced by Bid Qualifications (weight 5): significant qualifications that adversely change scope may render bid non-responsive; no qualifications = full marks.
• E. Project Risk Management (weight 5): submit risk register with relevant responses, classification, response strategies and actions.
• F. Detailed Project Programme (weight 5): Gantt chart per site, 6-month implementation period, start/end dates, milestones, draft SLA (availability/uptime, response times, resolution time, accuracy, first resolution), resources assigned, support and maintenance details (contact person, turn-around time, call logging, escalation, method statement, contractual alignment), monthly cost forecast.
• G. Method Statement (weight 40): specific method statement addressing all deliverables per scope of work, aligned with contractual requirements; fully completed and signed Annexure A. Due diligence includes solution demonstration at bidder's office to verify against Annexure A Table 3.2, plus presentation during site visit.

Stage 3 — Preference Points (80/20 system):

• Price: 80 points calculated as Ps = 80 × (1 − (Pt − Pmin)/Pmin), where Pmin = lowest acceptable bid.
• B-BBEE Specific Goals: 20 points based on status level (Level 1 = 20, Level 2 = 18, Level 3 = 16, Level 4 = 12, Level 5 = 8, Level 6 = 6, Level 7 = 4, Level 8 = 2, Non-compliant = 0).
• Bidders not submitting B-BBEE proof score zero but are not disqualified.

Stage 4 — Objective Criteria:

• Rand Water applies PPPFA objective criteria. Supplier rotation threshold: aggregate value of R250 million awarded in a financial year. If awarding to the highest-scoring bidder would exceed this threshold, Rand Water may award to another bidder. If the over-threshold bidder is the only successful respondent, Rand Water reserves the right to assess risk and evaluate accordingly.
• Rand Water does not bind itself to accept the lowest price or highest total points.

• Scope: Provision of Digital Technology (IT & OT) Cybersecurity/Security Operational Centre (SOC) as a Service at Rand Water for 5 years.
• Deliverables and standards:

– IT and OT cybersecurity/SOC professional services.

– Level 2 cybersecurity/security operational centre service covering: dedicated contact person, turn-around time, call logging process, escalation process, specific method statement per scope of work, contractual alignment.

– Draft SLA covering: availability/uptime, response times, resolution time, accuracy, first resolution.

• Capacity requirements:

– Minimum 3 years' track record in IT/OT cybersecurity/SOC services with at least 3 completed projects.

– Team Leader: CISM, CISA, CGEIT; 5+ years relevant experience, 3+ years in management.

– Technical/Risk Lead: CEH or CASP or CISSP or CISM; 5+ years in IT/OT security solution design, build and maintenance.

– Four Cyber/Security Engineers/Specialists with expertise in: (1) cloud and server security, (2) network security, (3) senior security architecture, (4) operational technology cybersecurity (SCADA, PLC, HMI, etc.).

– Equipment: SOC and relevant SIEM tools; adequate office space, resource utilisation, vehicles, working tools.

• Service levels: Draft SLA must specify availability/uptime, response times, resolution time, accuracy, first resolution.
• Implementation period: 6 months per site per Gantt chart.
• Due diligence: Solution demonstration at bidder's office to verify against Annexure A Table 3.2; presentation during site visit.

• Pricing format: Pricing Schedule / Bill of Quantities (BoQ) required as returnable.
• Pricing assumptions must be documented in C2.1.
• Alternative bids: pricing of alternative may not exceed pricing of main bid; all assumptions must be reflected.
• Price evaluation: 80 points under 80/20 preference point system; formula-based scoring against lowest acceptable bid.
• Financial returnables (non-disqualifiable but mandatory for evaluation): 3-year audited financial statements (or independent review at minimum assurance level), plus current year management report (income statement, balance sheet, cash flow statement).
• No specific bonds, guarantees, or payment terms detailed in extracted text.
• No explicit solvency or minimum turnover requirements stated in extracted text.

• Central Supplier Database (CSD): CSD number required (format MAAA……); tax compliance status verified via SARS.
• Tax compliance: Supplier Tax Compliance Status System PIN required; Rand Water will verify tax clearance status with SARS.
• B-BBEE: SANAS-accredited B-BBEE certificate, or sworn affidavit for QSE/EME, or dtic B-BBEE certificate. Points awarded per status level; non-compliant contributors score zero but are not disqualified.
• CIPC: Company registration number or Close Corporation number required on Compulsory Enterprise Questionnaire.
• OEM partnership: Letter or certificate on registered OEM letterhead confirming partnership required for responsiveness.
• Data residency: Fully completed, signed and commissioned Security Operation Centre Data Hosting Affidavit (Annexure B) confirming all data hosted within South Africa borders — mandatory for responsiveness.
• Legal declarations: SBD 4 (Bidder's Disclosure) and SBD 6.1 (Preference Points Claim Form) must be completed and signed.
• Compulsory Enterprise Questionnaire: must be completed; includes declarations on tender defaulters, fraud/corruption convictions, conflict of interest, collusion.
• Resolution letter: Letter authorising signatory to bid on behalf of company required.
• Declaration of Insurance: required returnable (T2.2.6).
• No CIDB grade mentioned in extracted text.
• No specific professional registration beyond the listed cybersecurity certifications.