The appointment of a qualified and experienced service provider to deliver comprehensive information security and cybersecurity services for a period of three (3) years.

Non-compulsory briefing: 31 August 2026 at 11:00 am via Microsoft Teams. Meeting ID: 353 842 123 818 395, Passcode: M8hs2Ye6.

Closing: 18 September 2026 at 11:00 am.

Bid validity: 180 days from closing.

Non-compulsory briefing session: 31 August 2026 at 11:00 am via Microsoft Teams. Meeting ID: 353 842 123 818 395, Passcode: M8hs2Ye6.

Submission email: [email protected]

Enquiries: Vusi Maditsi ([email protected]) and Thabo Mokhabi ([email protected])

Submission channel: email to [email protected].

Closing: 18 September 2026 at 11:00 am. Late bids not accepted.

Bids must be on official forms provided (SBD 1, SBD 7) and not re-typed.

Returnable documents: SBD 1 (Invitation to Bid), SBD 7 (Contract Form), proof of tax compliance (TCS PIN or CSD number), and mandatory documents: confirmation letter, team credentials (CISO, CISSP), proof of physical office in South Africa, technical response document, recovery assurance capability.

Disqualification risks: unsigned forms, missing mandatory documents, late submission, non-compliance with tax or CSD requirements.

Phase 1: Mandatory requirements (confirmation letter, team credentials, office, technical response, recovery assurance). Must pass.

Phase 2: Functionality scored out of 100 points. Four sub-criteria each 25 points: Cyber Defense & Ransomware Strategy, Recovery & Cyber Resilience, SOC & Incident Response Operating Model, Financial Sector Delivery Depth. Minimum 70 points to proceed.

Phase 3: Live demonstration for shortlisted bidders.

Phase 4: Commercial evaluation using 80/20 or 90/10 preference point system (price and specific goals).

Independent verification rights reserved.

Scope: Comprehensive managed cybersecurity services for Postbank for 3 years.

Key service areas: 24/7 Security Operations Centre (SOC), Endpoint Detection and Response (EDR/XDR), Zero Trust Network Security, Identity and Access Management (IGA, MFA, SSO), Privileged Access Management (PAM), Data Protection (DLP, encryption, HSM), Incident Response and Forensics, Threat Intelligence, Cybersecurity Governance, Awareness and Insider Threat Management, Audit and Compliance, Security Device Management, Email and Communication Security, Patch and Vulnerability Management, Cloud and Application Security.

Deliverables: Deployment roadmap, monthly/quarterly reports, annual threat intelligence report, ransomware readiness report, cyber recovery validation, knowledge transfer, and exit migration package.

SLAs: MTTD 15 min, MTTR 30 min, patch compliance 95% within 7 days (critical), SOC uptime 99.9%, ransomware recovery 100%, critical incident containment within 60 min, identity compromise containment within 15 min, critical asset log coverage >=95%, EDR/XDR coverage >=95%, overdue critical vulnerability rate <=5%, quarterly training attendance >=90%.

Insurance: Professional Indemnity minimum R20 million.

Certifications: Provider must be certified/partnered with at least 3 of ISO 27001, PCI DSS QSA, CISSP, CEH, OSCP.

Data sovereignty: All infrastructure and data within South Africa.

Personnel vetting: ITC and criminal clearance required.

Scope of work includes 15 service areas: SOC, Endpoint Security, Zero Trust Network, Identity and Authentication, PAM, Data Protection, Incident Response, Threat Intelligence, Governance, Awareness, Audit, Security Device Management, Email Security, Patch Management, Cloud Security. Deliverables include deployment roadmap, documentation, reports, knowledge transfer, and exit plan. SLAs: MTTD 15 min, MTTR 30 min, patch compliance 95% within 7 days, SOC uptime 99.9%, ransomware recovery 100%, etc.

Team credentials: minimum two certified resources - CISO and CISSP. References: Technical Response Document must demonstrate experience in managed cybersecurity services for a regulated financial institution (bank, payment institution, insurer) or equivalent in last 3 years. Evaluation criterion 'Financial Sector Delivery Depth' (25 points) assesses past experience with banking/financial clients.

Compliance with SARB, POPIA, PCI DSS, ISO 27001, NIST CSF. Must maintain ISMS, quarterly compliance assessments, support for PCI DSS certification, risk register, cyber resilience evidence packs. Quarterly risk and compliance reports. Control mapping required.

The bid must include a completed pricing schedule/costing model as per the provided format. No upfront payment. Professional Indemnity Insurance of R20 million required.

No upfront payment.

Pricing must be submitted on the provided Pricing Schedule/Costing Model.

Professional Indemnity Insurance of at least R20 million required.

Bid validity 180 days.

CSD registration required.

Tax compliance: Submit TCS PIN or CSD number. Must be valid.

B-BBEE: PPPFA applies. Preference points system (80/20 or 90/10) for price and specific goals.

Mandatory documents: proof of CSD, tax compliance, B-BBEE certificate.

Provider must have certifications: ISO 27001, PCI DSS, etc. as per technical specs.

Local content: Not specified.

Postbank supports B-BBEE. The PPPFA and Preferential Procurement Regulations 2022 apply. Bidders must demonstrate commitment to B-BBEE in ownership, skills transfer, employment equity, and procurement practices. Preference points will be awarded based on price and specific goals.

Joint Controls and Transparency: Postbank gets direct access to logs, dashboards, vulnerability results. Bidder must not obstruct audits or forensic investigations. Quarterly governance reviews. Annual cyber resilience stress testing. Exit and Handover: transition plan within 6 months, handover program 6 months before expiry, complete documentation, training, tooling portability. Final objective: seamless handover without degradation.

No upfront payment. Postbank may request written clarification, cancel or reject any proposal, not award to lowest bidder, or award parts. Bidders accept evaluation criteria. Postbank may conduct benchmarks. Changing wording will be evaluated as original. Subject to Government Procurement General Conditions and Special Conditions. Postbank may verify information, not accept any quotation, cancel or re-issue. Special conditions of contract: integrated operating model, personnel vetting (ITC and criminal clearance), participation in scenario-based reviews and simulations, full support during major incidents.

Mandatory requirements: 1) Confirmation letter on company letterhead confirming full compliance. 2) Team credentials: minimum two certified resources (CISO and CISSP). 3) Physical office in South Africa (preferably Pretoria or Johannesburg) with proof. 4) Technical Response Document demonstrating experience in managed services for regulated financial institution in last 3 years. 5) Recovery Assurance Capability: compliance reports for PCI DSS (ROC), ISO27001, and POPIA.

Evaluation Phases: Phase 1 - Mandatory Requirements (confirmation letter, team credentials, office location, references, recovery assurance). Phase 2 - Functionality (100 points: Cyber Defense & Ransomware Strategy 25, Recovery & Cyber Resilience 25, SOC & Incident Response Operating Model 25, Financial Sector Delivery Depth 25). Minimum 70 points. Phase 3 - Live Demonstration. Phase 4 - Commercial: Price and Specific Goals under 80/20 or 90/10 system. Independent verification rights reserved.