Managed cyber security operations centre (soc) service – 36-Month contract

Closing date: Friday, 02 October 2026

Closing time: 11:00am

Compulsory clarification meeting: 7 September 2026 at 10h00, 2nd Floor Boardroom, Rennies House, 41 Margaret Mncadi Avenue, Durban (attendance mandatory; must sign attendance register in tendering entity name)

Queries from clarification meeting consolidated and posted on e-tenders/municipal website by 25 September 2026

Tender validity: 120 days from opening, plus further 12 months unless bidder notifies otherwise in writing

General/Contractual queries: Lethokuhle Ngcobo, Tel: 031-322-5214, Email: [email protected]

Technical queries: Mark Goad, Tel: 031-311-1810, Email: [email protected]

SSS (JDE System) queries: Lindo Dlamini, Tel: 031-322-7133 / 031-322-7153, Email: [email protected]

SSS Technical queries: Jabulane Chauke, Tel: 031-322-9535, Email: [email protected]

Appeals: Ms. S. Pillay, P.O. Box 1394, Durban, 4000, Email: [email protected] (within 14 days of decision/action)

Submission address: Tender Box, ground floor foyer, Municipal Buildings, 166 KE Masinga Road (Old Fort Rd), Durban

Submission method: Bidders must submit both a sealed hard copy and an electronic copy.

• Hard copy: Sealed, addressed to the City Manager, marked with Tender No. 36703-1i, deposited in the Tender Box at the ground floor foyer, Municipal Buildings, 166 KE Masinga Road (Old Fort Rd), Durban. The hard copy is the ruling version; a tender is only valid if the hard copy is submitted.
• Electronic copy: Identical to the hard copy, submitted via the eThekwini Municipality JDE System (SSS Module) at https://rfq.durban.gov.za/jde/E1Menu.maf. If the electronic copy differs from the hard copy, the tender is invalid.
• No fax, email, or posted tenders accepted. Couriered documents must be placed directly into the Tender Box.
• Closing date and time: Friday, 02 October 2026 at 11:00am. Late submissions will not be accepted.
• Tender validity: 120 days from tender opening, plus a further 12 months unless the bidder notifies otherwise in writing.
• Compulsory clarification meeting: 7 September 2026 at 10h00, 2nd Floor Boardroom, Rennies House, 41 Margaret Mncadi Avenue, Durban. Attendance is mandatory; bidders must sign the attendance register in the name of the tendering entity. Non-attendance invalidates the tender.

Returnable documents (all must be completed, signed and submitted with the tender):

• Authority of Signatory (with supporting board resolution)
• Tax Compliance Status PIN (TCS PIN) or original Tax Clearance Certificate
• Declaration of Municipal Fees (with account numbers; failure to include numbers or sign invalidates the tender)
• Declaration with respect to the Occupational Health and Safety Act
• MBD 4: Declaration of Interest
• MBD 5: Declaration for Procurement Above R10 Million (applicable as value exceeds R10m)
• MBD 6.1: Preference Points Claim (failure to submit means no preference points claimed)
• MBD 8: Declaration of Bidder's Past Supply Chain Management Practices
• MBD 9: Certificate of Independent Bid Determination
• Official Tender Form (Section 9) — must be fully completed and signed
• Additional schedules per Special Conditions: reference letters (minimum two contactable references for managed SOC/SIEM/Threat Detection services for SA organisations with >250 servers for >12 months each in last 8 years), valid ISO 27001, ISO 9001, ISO 22301 certificates, Data Centre Tier 4 certificate (Uptime Institute) or equivalent independent attestation, OEM/OSM authorisation letters (≤90 days old) for Agentic SIEM/EASM/DWM and Autonomous NDR, independent NDR Leader recognition report (≤5 years old), detailed proposal covering all scope requirements with implementation plan <50 days, comprehensive CVs and certificates for minimum six L1.5 SOC analysts (certified, ≥3 years exp) and one Senior Cybersecurity Specialist (CEH/Pentest/Incident Handler/CHFI + CISM/CISSP, ≥6 years exp), clear photographs of operational SOC.

Disqualification risks: missing or unsigned returnable forms, late submission, non-attendance at compulsory briefing, electronic copy not identical to hard copy, false declarations, failure to meet mandatory requirements.

Evaluation process:

1. Mandatory requirements (all must be satisfied; failure on any renders tender non-responsive):

• Company experience: two contactable reference letters (on official letterhead) for managed SOC/SIEM/Threat Detection services for at least two different SA organisations with ICT server infrastructure >250 servers, each for >12 months in last 8 years, with contactable email references and contract duration.
• Company accreditations: valid ISO 27001, ISO 9001, ISO 22301 certificates (municipality reserves right to verify validity).
• High availability: Data Centre Tier 4 certificate (Uptime Institute) or equivalent independent attestation confirming >99.995% uptime.
• Accredited partner letters: OEM/OSM authorisation letters (≤90 days old) for Agentic SIEM (with integrated Automation & Orchestration, UEBA, Analytics, Threat Intelligence, CTEM, EASM, DWM) and Autonomous NDR.
• Independent industry recognition: proposed Autonomous NDR solution recognised as Leader by independent accredited technology/software market research firm in published assessment/report within last 5 years.
• Proposal: detailed proposal for managed Agentic SOC service covering all Section 7 requirements, with data sheets, clear implementation plan with timelines <50 days.
• Resources: comprehensive CVs with qualifications/certificates for minimum six L1.5 SOC analysts (24x7, certified SOC/cybersecurity analyst or equivalent, ≥3 years relevant experience in monitoring, triage, deep analysis, investigation, incident response/mitigation, threat emulation, hunting, playbooks, malware/threat analysis, attacker timelines, log correlation, containment/remediation) and one Senior Cybersecurity Specialist (based at eThekwini Durban central office 5 days/week, standby 24x7, active CEH/Pentest/Incident Handler/CHFI certification, active CISM/CISSP or equivalent, ≥6 years relevant experience in monitoring, advanced investigation, proactive threat hunting, red teaming, penetration testing, prevention, malware/threat analysis, digital forensics, counterintelligence, incident response, reverse engineering across IT infrastructure/attack vectors, deep OS/network/cloud knowledge, SIEM/SOAR/UEBA/NDR/threat intelligence proficiency).
• SOC operational proof: clear photographs of operational Managed Cyber Security Operations Center (live large screen displays, central command monitors, analyst workstations); subject to verification/remote viewing.

2. Price and Preference: Only bidders meeting all mandatory requirements proceed. Evaluation uses either 80/20 or 90/10 preference point system (determined by lowest acceptable tender value relative to R50m threshold). Specific Goals for preference points: Ownership (Black ownership weighting 50%) and Location (address on CSD/vendor portal weighting 50%). Points: Ownership — 0% Black = 0, >0% to <51% = 4, >51% to <100% = 7, 100% = 10. Location — Not in SA = 0, SA = 4, KZN = 7, eThekwini Municipality = 10. Proof via CIPC, CSD report, B-BBEE certificate, consolidated B-BBEE certificate (JV/consortium/trust), JV/consortium/trust agreement. Financial offer scored per formula in Conditions of Tender.

Scope: Provision of a managed Cyber Security Operations Centre (SOC) service for a period of 36 months.

Key requirements:

• Managed SOC/SIEM platform hosted in a fully fault-tolerant Tier 4 data centre (>99.995% uptime).
• Next-generation Agentic SIEM with integrated Automation & Orchestration, UEBA, Analytics, Threat Intelligence, Continuous Threat Exposure Management (CTEM), External Attack Surface Monitoring (EASM), Dark Web Monitoring (DWM).
• Autonomous Network Detection and Response (NDR) solution recognised as Leader by independent market research firm (report ≤5 years old).
• 24x7 SOC operation with minimum six L1.5 SOC analysts (certified, ≥3 years experience in monitoring, triage, deep analysis, investigation, incident response/mitigation, threat emulation, hunting, playbooks, malware/threat analysis, log correlation, containment/remediation).
• One Senior Cybersecurity Specialist based at eThekwini Municipality Durban central office 5 days/week, standby 24x7, to act on escalations, respond to incidents, continuously optimise security posture (active CEH/Pentest/Incident Handler/CHFI + CISM/CISSP, ≥6 years experience in advanced investigation, threat hunting, red teaming, penetration testing, forensics, reverse engineering, deep OS/network/cloud knowledge, SIEM/SOAR/UEBA/NDR/threat intelligence proficiency).
• Implementation plan with timelines less than 50 days.
• OEM/OSM authorisation letters (≤90 days old) for proposed Agentic SIEM/EASM/DWM and Autonomous NDR solutions.
• Valid ISO 27001, ISO 9001, ISO 22301 certifications for MSSP/SOC infrastructure/services.
• Data Centre Tier 4 certificate (Uptime Institute) or equivalent independent attestation.
• Clear photographs of operational SOC (live large screen displays, central command monitors, analyst workstations) subject to verification/remote viewing.
• Company experience: at least two contactable references for managed SOC/SIEM/Threat Detection services for SA organisations with >250 servers for >12 months each in last 8 years.

Bidder must provide a detailed proposal for the implementation of the managed Agentic SOC service covering all requirements in the Scope of Supply/Services (Section 7), including data sheets for proposed solutions, demonstrating full understanding of the brief, with a clear implementation plan and timelines which should be less than 50 days. The proposal must address the Agentic SIEM (with Automation & Orchestration, UEBA, Analytics, Threat Intelligence, CTEM, EASM, DWM) and Autonomous NDR components, and the 24x7 SOC operation with specified resource allocation.

Mandatory experience and qualifications:

• Company: Minimum two contactable reference letters (official letterhead) for managed SOC/SIEM/Threat Detection services for at least two different South African organisations with ICT server infrastructure >250 servers, each for >12 months in the last 8 years. References must include contactable email addresses and contract duration.
• Certifications: Valid ISO 27001, ISO 9001, ISO 22301 for MSSP/SOC infrastructure/services.
• Data Centre: Tier 4 certificate (Uptime Institute) or equivalent independent attestation for high availability.
• Partner authorisations: OEM/OSM letters (≤90 days old) for Agentic SIEM/EASM/DWM and Autonomous NDR.
• NDR recognition: Independent Leader recognition report (≤5 years).
• Resources:

• Minimum six L1.5 SOC analysts (24x7): Certified SOC/Cybersecurity analyst or equivalent (entry/mid/advanced level), minimum 3 years relevant experience in cybersecurity monitoring, triage, deep analysis, investigation, incident response/mitigation, threat emulation, hunting, playbook execution, malware/threat analysis, attacker timeline building, log correlation, containment/remediation. Understanding of adversary TTPs, frameworks, kill-chain, malware analysis, log correlation. Ability to analyse obscure scripts, process logs, identify malicious activities from SIEM/endpoint/network tools.

• One Senior Cybersecurity Specialist (based at eThekwini Durban central office 5 days/week, standby 24x7): Active certification as Ethical Hacker/Penetration Tester/Incident Handler/CHFI, AND active advanced certification (CISM/CISSP or equivalent), minimum 6 years relevant experience in security monitoring, data analysis, advanced/deep investigation, proactive threat hunting, red teaming/hands-on, deep technical hacking/testing, prevention, malware/threat analysis, digital forensics, counterintelligence, incident response, reverse engineering across IT infrastructure/attack vectors. Deep knowledge of Windows/Linux servers, networking protocols, cloud infrastructure. Proficiency in SIEM/SOAR/UEBA/NDR/threat intelligence platforms, ethical penetration testing, forensic investigation. Strong understanding of adversary tactics, IoCs, unified kill-chain, security posture assessments.

• Comprehensive CVs with relevant qualifications and certificates attached for all proposed resources.
• Clear photographs of operational Managed Cyber Security Operations Center (live large screen displays, central command monitors, analyst workstations).

Quality management requirements: Bidder must hold valid ISO 9001 (Quality Management System) certification. ISO 27001 (Information Security Management) and ISO 22301 (Business Continuity Management) also mandatory. Data Centre Tier 4 certification (Uptime Institute) or equivalent independent attestation confirming >99.995% uptime. Proposed Autonomous NDR solution must be independently recognised as Leader by accredited market research firm (report ≤5 years). OEM/OSM authorisation letters for all proposed solutions (≤90 days old). Implementation plan with timelines <50 days. SOC operational proof via photographs subject to verification/remote viewing. Continuous security posture optimisation by Senior Cybersecurity Specialist. All certifications subject to municipality verification.

Pricing must be submitted on the Official Tender Form (Section 9) and Bill of Quantities/Schedule of Rates/Activities (Section 8). Prices in ZAR, nett after discounts. Unit prices only; one price per item; firm for contract duration subject to contract variation clauses. Firm prices per 12-month period permitted (no fluctuations). VAT shown separately (exclusive and inclusive). Deviation from Official Tender Form pricing structure disqualifies. Estimated quantities for information only; supplier bound to actual quantities required. Payment per Conditions of Contract; no factoring. Tender validity 120 days + 12 months. Withdrawal penalty R1,000 (waivable). Financial standing evidence may be requested. Audited financial statements (3 years) if legally required.

Pricing:

• Prices must be quoted in South African Rand (ZAR) as nett prices after deduction of any brokerage or discount allowed to the Municipality.
• Unit prices only; one price per item; price holds for full contract duration subject to variation only per specified criteria in Conditions of Contract.
• Firm prices for each 12-month period permitted (free from fluctuations including statutory increases).
• VAT must be stated separately (exclusive and inclusive) on the Official Tender Form.
• Pricing structure must conform to the Official Tender Form (Section 9) and Bill of Quantities/Schedule of Rates/Activities (Section 8); deviation precludes the bidder.
• Estimated quantities in Section 8 are for information only; supplier bound to supply actual quantities required (may exceed or be less than estimates).
• Payment terms per Conditions of Contract (General Conditions of Contract, NT Circular 52: July 2010). Payment made only to supplier; factoring arrangements not accepted.
• Tender validity: 120 days from opening plus further 12 months unless bidder notifies otherwise in writing.
• Withdrawal during validity period requires payment of R1,000 to Municipality (may be waived).
• Financial standing: Head of SCM reserves right to require evidence of adequate financial standing to meet contract obligations.
• Audited annual financial statements for past three years (or since establishment if <3 years) required if bidder legally required to prepare them.
• No bonds, guarantees, or insurance requirements explicitly stated in extracted text.

Eligibility and mandatory compliance:

• CSD registration: Bidder (and each JV party) must be registered on National Treasury Central Supplier Database (CSD); MAAA number to be provided.
• eThekwini Municipality supplier database registration (via https://ethekwinivendor.durban.gov.za/ and SSS).
• Valid SARS Tax Compliance Status PIN (TCS PIN) or original Tax Clearance Certificate (sufficient validity to cover evaluation process).
• Municipal fees: Fully paid or acknowledged debt agreements with Municipality; Declaration of Municipal Fees with account numbers must be signed (failure invalidates tender); applies to bidders outside eThekwini area too.
• Not in service of the state (Regulation 44 of Municipal SCM Regulations); breach allows immediate contract termination.
• Occupational Health and Safety Act undertaking (declaration required).
• Returnable forms: MBD 4 (Declaration of Interest), MBD 5 (Procurement >R10m), MBD 6.1 (Preference Points Claim), MBD 8 (Past SCM Practices), MBD 9 (Independent Bid Determination), Authority of Signatory with board resolution.
• Joint Venture requirements: acceptable JV agreement and consolidated B-BBEE certificate for JV.
• B-BBEE: Specific Goals for preference points — Ownership (Black ownership, 50% weighting) and Location (address on CSD/vendor portal, 50% weighting). Points as per evaluation criteria.
• Mandatory certifications: ISO 27001, ISO 9001, ISO 22301 (valid).
• Data Centre Tier 4 certificate (Uptime Institute) or equivalent independent attestation.
• OEM/OSM authorisation letters ≤90 days old for Agentic SIEM/EASM/DWM and Autonomous NDR.
• Independent NDR Leader recognition report ≤5 years old.
• Company experience: two contactable references for managed SOC/SIEM/Threat Detection for SA orgs with >250 servers, >12 months each, last 8 years.
• Resources: minimum six L1.5 SOC analysts (certified, ≥3 years exp) and one Senior Cybersecurity Specialist (CEH/Pentest/Incident Handler/CHFI + CISM/CISSP, ≥6 years exp) with CVs and certificates.
• SOC operational proof: clear photographs of operational SOC.
• Compulsory clarification meeting attendance (7 September 2026, 10h00, Rennies House, Durban).
• Audited financial statements (past 3 years) if legally required.
• No outstanding undisputed municipal commitments >3 months or other overdue >30 days (declaration required).
• Disclosure of state contracts in past 5 years and any non-compliance/disputes.
• Disclosure of any goods/services sourced outside RSA and payments transferred out.

Occupational Health and Safety Act compliance: Bidders must sign a Declaration with respect to the Occupational Health and Safety Act (Act No. 85 of 1993) and relevant Regulations, accepting the undertaking. This is a mandatory returnable document (Section 4, item 4). The contract is governed by the OHS Act and eThekwini Code of Conduct. No further specific HSE plans or safety file requirements detailed in extracted text.

Contract duration: 36 months. Governed by General Conditions of Contract (NT Circular 52: July 2010), Special Conditions of Contract, Occupational Health and Safety Act, and eThekwini Code of Conduct. Special Conditions of Tender take precedence over Standard Conditions. Successful tenderer must sign MBD 7 Contract Form. Municipality not bound to accept lowest or any tender; may accept whole or part; may award to multiple compliant bidders. No minimum order quantities; successful bidder bound to supply stipulated quantities. Tender validity 120 days plus 12 months. Withdrawal during validity requires R1,000 payment (waivable). Financial standing evidence may be required. Change of ownership/major policy must be disclosed. Municipality may purchase from other sources. Capability and past breach history considered. Negotiations with preferred bidders per Regulation 24 of MFMA (no unfair advantage, no higher price). Cancellation at any time before award without liability. Appeals within 14 days to City Manager (Ms. S. Pillay). Payment per Conditions of Contract; no factoring. Municipal fee arrears set off against payments due. JV requires acceptable agreement and consolidated B-BBEE certificate. Audited financial statements (3 years) if legally required. Declaration of no outstanding municipal commitments >3 months/other >30 days. Disclosure of state contracts past 5 years and any disputes. Disclosure of foreign sourcing and outward payments.

See main evaluationCriteria section. Extended evaluation_criteria section in input contains only fragmented boilerplate; no additional tender-specific criteria beyond those already captured.