Red team assessment of tcta's ICT environment — six-month engagement

Appointment of a service provider to conduct a red team assessment. The available document only contains the B-BBEE EME sworn affidavit form (Annexure J).

Bidders must be an Exempted Micro Enterprise (EME) with annual total revenue of R10,000,000.00 or less. A sworn affidavit (Annexure J) confirming B-BBEE ownership status and level must be submitted. The affidavit must be valid, i.e. signed within 12 months of the closing date.

The scope is the appointment of a service provider to conduct a red team assessment. No further scope details are provided in the available document.

Bidder must be an EME as defined by the B-BBEE Act, with annual revenue of R10,000,000.00 or less. A sworn affidavit confirming B-BBEE ownership status (including black ownership percentage) and level must be submitted.

TCTA is a state-owned entity that finances and implements bulk raw water infrastructure, and depends on the confidentiality, integrity and availability of its ICT, financial and operational information.

Purpose of the engagement

• Independently identify and validate exploitable weaknesses across TCTA's agreed ICT environment.
• Test the effectiveness of technical, physical and human security controls.
• Go beyond automated scanning: demonstrate whether weaknesses can be exploited, how they combine into attack paths, and whether TCTA can prevent, detect and respond.
• Verify corrective actions through post-remediation retesting and identify residual or regressed vulnerabilities.

Threats of concern include ransomware, unauthorised access, credential compromise, website attacks, data theft, insider threats and social engineering.

Outcomes the assessment must support

• Validation of weaknesses before an unauthorised party exploits them.
• Evaluation of controls across technical, personnel and organisational processes.
• Assessment of privilege escalation, lateral movement and access to sensitive information.
• Evaluation of detection and response to simulated adversarial behaviour.
• Prioritisation of remediation by technical severity and business impact.
• Integration of findings into the enterprise risk register and cybersecurity improvement roadmap.
• Decisions on security investment and control improvements.
• Alignment with the NIST Cybersecurity Framework, ISO/IEC 27001, POPIA and the PFMA.

Scope coverage: external and internal networks, Active Directory, wireless infrastructure, critical web applications, physical access controls, and personnel susceptibility to social engineering.

• Briefing session (non-compulsory): 06 November 2026 at 11:00
• Briefing venue: online, Microsoft Teams
• Briefing pre-registration: email [email protected] to receive the invitation; registration closes 05 November 2026 at 14:00
• Clarification deadline: 06 November 2026 at 16:00
• Issue date: 30 October 2026
• Closing: 10 November 2026 at 11:00
• Bid validity period: 30 days

Enquiries and submissions

• Email: [email protected]

Submission

• Method: email
• Submission email: [email protected]

No named contact person or telephone number is given; bidding and technical enquiries are directed to the email address above.

Submission method: email

Submission email: [email protected]

Closing: 10 November 2026 at 11:00

Bid validity: 30 days

Mandatory returnables — omission disqualifies the bid

• ISO/IEC 27001 and ISO/IEC 27035 certificates issued by an accredited body.
• Technical Lead certifications: at least three current valid certifications, comprising one of OSCP, OSEP, OSWE or GIAC GPEN plus two from CREST, EC-Council ECSA, GIAC GXPN or GWAPT, CRTO, PNPT, CISSP or CEH Master. Copies must show the holder's name, certification title, issuing organisation and issue and expiry dates or lifetime status, and must be unexpired at closing.
• Financial proposal on the RFQ Pricing Schedule covering the full six-month assessment, reporting, skills transfer, remediation consultation and retesting, with amounts excluding and including VAT.

Non-mandatory returnables — no points are awarded for the linked criterion if omitted

• Annexure A (company experience): at least three Red Team projects, or three contactable client reference letters on official client letterhead.
• Annexure B (Red Team Lead experience): at least three Red Team or adversary-emulation engagements, supporting client references or close-out evidence, and copies of at least three current professional certifications.
• B-BBEE certificate from a SANAS-accredited verification agency, or a validly commissioned affidavit for an eligible EME or QSE; joint ventures and consortia must submit a consolidated certificate.
• SBD 1 (Invitation to Bid): signed offer and bidder particulars.
• SBD 4 (Declaration of Interest): discloses state employment or connections to the procuring institution.
• SBD 6.1 (Preference Points Claim): claims the 20 specific-goals points under the Preferential Procurement Regulations 2022.
• Proof of registration on National Treasury's Central Supplier Database.
• Proof of authority to sign, such as a company resolution.

Disqualification risks

• Any mandatory returnable omitted.
• Annexure A or Annexure B not completed in full, or submitted on a self-created template — no points are awarded.
• Bids received after the closing time.

Evaluation stages

1. Mandatory document compliance — bids missing a mandatory returnable are disqualified and not evaluated further.
2. Functionality — scored out of 50. Minimum qualifying score: 30/50. Bids below 30 are non-responsive and their pricing is not evaluated.
3. Price and specific goals — 80/20 preference point system.

Functionality scoring (50 points)

• Company track record in Red Team assessments: 30 points. Fewer than 3 qualifying projects = 0; 3 to 4 = 20; 5 or more = 30.
• Red Team Lead experience: 20 points. Fewer than 3 eligible projects = 0; 3 to 4 = 10; 5 or more = 20.

Qualifying company projects

• Delivered under formal Rules of Engagement.
• Covered multiple vectors such as external networks, internal networks, Active Directory, Wi-Fi, web applications or APIs, physical security or social engineering.
• Post-remediation retesting evidenced where it formed part of the engagement.
• Evidence: completed Annexure A, or three client reference letters on official client letterhead giving client name and industry, scope and phases performed, MITRE ATT&CK mapping where used, start and end dates or month and year of delivery, a contactable client representative, and signature of an authorised client representative. Confidential references must still confirm scope and satisfactory completion at a high level.

Qualifying Red Team Lead projects

• Delivered under formal Rules of Engagement.
• Covered external, internal, Active Directory, Wi-Fi, web application or API, phishing or social engineering, or physical vectors.
• Included executive and technical reports.
• Demonstrate the nominee's role as overall or technical lead.
• Evidence: completed Annexure B with at least three projects, month and year dates, scope and assessment vectors, the lead's responsibilities and key deliverables.

Price and preference points (100 points)

• Price: 80 points.
• Specific goals (B-BBEE): 20 points.
• B-BBEE scoring: Level 1 = 20, Level 2 = 18, Level 3 = 14, Level 4 = 12, Level 5 = 8, Level 6 = 6, Level 7 = 4, Level 8 = 2, non-compliant contributor = 0.
• A bidder that does not meet the specific goals is not disqualified but scores 0 for that element.
• Points are awarded only on submission of a valid B-BBEE certificate or sworn affidavit stating the status level; an affidavit that does not meet the Annexure C requirements scores no points.
• TCTA may decline to award to the highest-scoring bidder if the offered price is not market related.
• TCTA reserves the right to verify references, qualifications and project evidence.

Objective

• An independent Red Team Assessment of TCTA's agreed ICT environment, using controlled adversarial activity to show whether identified weaknesses can be exploited, how they combine into attack paths, and whether TCTA can prevent, detect and respond.
• Findings must feed TCTA's enterprise risk register, remediation tracking, cybersecurity improvement roadmap and incident response improvements.
• Alignment with the NIST Cybersecurity Framework, ISO/IEC 27001, POPIA and the PFMA.

Assessment modules (each independently executed and auditable)

• External network: unauthenticated black-box testing of agreed internet-facing systems — reconnaissance, asset and service enumeration, vulnerability analysis, manual validation, controlled exploitation, and attack-path or lateral-movement assessment. Approved source IP addresses and agreed testing windows apply.
• Internal network: on-site testing from both an untrusted device and a low-privilege authenticated domain user perspective; segmentation and access-control testing; privilege escalation, credential compromise and lateral movement; simulated data exfiltration where authorised.
• Active Directory: exploitable misconfigurations, weak credentials, excessive privileges and insecure permissions; validation that a low-privilege or compromised account can gain elevated rights; attack paths to privileged account or domain compromise.
• Wireless/Wi-Fi: corporate and guest networks — authentication, encryption, access controls, rogue access points, and segregation between guest, corporate and internal systems.
• Web applications: all exposed interfaces of each agreed in-scope application using the OWASP Testing Guide, OWASP Top 10 and business logic testing; authentication, authorisation, session management, input validation, injection and sensitive information exposure; supporting operating system, application server and database components.
• Physical and social engineering: approved attempts to access restricted areas, facilities or network connection points; pretexting and tailgating; phishing simulations by email, voice or SMS; USB key-drop exercises. All targets, scenarios and on-site activities require TCTA approval before execution.
• Retesting: post-remediation retesting within 30 working days of the agreed remediation period, with findings classified Fixed, Partially Fixed or Not Fixed.

Deliverables

• Planning: kick-off minutes, agreed scope and asset list, test plan, Rules of Engagement, schedule, contact and escalation arrangements, change-control approach.
• Phase reporting: reconnaissance, exploitation and post-exploitation reports.
• Executive summary: business impact, key risks, prioritised recommendations, target owners and dates, risk heatmap, comparison with prior tests where available, attestation statement.
• Technical and final reports: unique finding IDs, affected assets, root causes, CVSS v3.1 scores and severity, likelihood, business impact, sanitised evidence, reproducible steps, compensating controls, remediation guidance, OWASP or MITRE ATT&CK mapping, and detailed scan results per asset.
• Evidence pack and findings register: sanitised payloads, screenshots and logs, attack-path diagrams, and a CSV or XLSX register with owner, due date, status and retest result.
• Skills transfer: over-the-shoulder knowledge sharing, a session on reproducing findings and validating fixes, a technical workshop and a management presentation.
• Retest validation or delta report: original and retested findings, status, residual risk, revised executive and technical summaries, improvement plan and attestation letter.

Acceptance

• Agreed scope and all deliverables completed.
• Critical and High findings fixed or formally risk-accepted by TCTA.
• TCTA sign-off of the executive summary and technical report.

Operating requirements

• All activity within TCTA-approved Rules of Engagement, scope boundaries and testing windows; testing must be controlled and non-destructive, with emergency stop procedures and a safe word.
• POPIA and data protection compliance; a mutual non-disclosure agreement must be signed before testing; only the minimum necessary evidence is retained, under chain-of-custody arrangements.
• Immediate reporting of service degradation, sensitive-information access, bypassed controls or business disruption; imminent critical risks reported within 24 hours of discovery.
• MITRE ATT&CK techniques and OWASP guidance must be used; each module must be independently auditable with reproducible evidence.
• Suitably qualified and experienced personnel; replacement staff must be equally or better qualified and pass TCTA vetting and approval.
• Test accounts, payloads and temporary configurations removed at closure; assessment information returned, retained or securely destroyed as instructed.
• DoS/DDoS and stress testing are excluded unless authorised in writing; automated vulnerability spraying, password brute force, high-impact traffic floods and exploitation of production-critical systems require explicit authorisation.
• Production changes require an approved Change Request and rollback plan.
• TCTA provides authorised access, test accounts, subject-matter experts and approvals, and implements remediation.
• Ongoing platform maintenance, software upgrades and routine system health checks fall outside this service unless separately scoped.

Approach

• A structured sequence covering planning, OSINT and reconnaissance, automated scanning, manual validation, controlled exploitation, post-exploitation, remediation consultation and retesting.
• MITRE ATT&CK for adversarial emulation and OWASP guidance for application testing.
• The bidder must propose an approach tailored to TCTA's ICT environment and business priorities.

What the proposal must describe

• Methodology, tools and techniques for each assessment phase.
• Coverage of external networks, internal networks, Active Directory, wireless/Wi-Fi, web applications, and physical and social engineering.
• Applicable MITRE ATT&CK techniques and OWASP testing guidance.
• Assumptions, dependencies, exclusions, limitations and deviations from the specified requirements.
• Access, documentation, test accounts and support required from TCTA.
• Measures to minimise operational disruption and protect sensitive information.
• The approach to controlled exploitation, evidence collection, reporting and post-remediation retesting.
• Any deviation must state its justification, impact on coverage, risks, costs and timeline implications.

Rules of engagement

• Agree scope boundaries, named authorisers, target lists, maintenance windows and source-IP whitelisting in writing before testing.
• Sign the mutual non-disclosure agreement; retain only the minimum necessary evidence and maintain chain of custody.
• Define emergency stop criteria and a safe word.
• Coordinate with TCTA's cybersecurity representatives, infrastructure teams, application owners and SOC personnel, and agree in-scope systems, testing windows, test accounts, communication channels, escalation contacts, emergency stop procedures, and the treatment of third-party-managed systems.
• Restrictions on advance disclosure of individual test scenarios must be agreed during planning so detection and response can be evaluated meaningfully.
• Testing must be non-destructive; DoS/DDoS and stress testing are excluded unless authorised in writing, and automated vulnerability spraying, password brute force, high-impact traffic floods and exploitation of production-critical systems require explicit authorisation.
• Report service degradation, sensitive-information access, bypassed controls or business disruption immediately, and imminent critical risks within 24 hours of discovery.
• Remove test accounts, payloads and temporary configurations at closure.

Company experience

• At least three completed Red Team, adversary-emulation or assumed-breach projects, evidenced through Annexure A or three contactable client reference letters on official client letterhead.
• References must identify the client and industry, scope and assessment phases, MITRE ATT&CK mapping where used, start and end dates or month and year of delivery, a contactable client representative, and an authorised client signature.
• Where confidentiality restricts detail, the reference must still confirm scope and satisfactory completion at a high level.
• Scoring: fewer than 3 projects = 0; 3 to 4 = 20; 5 or more = 30 (out of 30).

Red Team Lead

• The nominated lead must have led at least three eligible Red Team engagements delivered under formal Rules of Engagement, covering external, internal, Active Directory, Wi-Fi, web application or API, phishing or social engineering, or physical vectors, with executive and technical reports produced.
• Evidence: completed Annexure B with at least three projects, month and year dates, scope and assessment vectors, the lead's responsibilities and key deliverables.
• Scoring: fewer than 3 projects = 0; 3 to 4 = 10; 5 or more = 20 (out of 20).

Technical Lead certifications

• At least three current valid certifications: one of OSCP, OSEP, OSWE or GIAC GPEN, plus two from CREST, EC-Council ECSA, GIAC GXPN or GWAPT, CRTO, PNPT, CISSP or CEH Master.
• Copies must show the candidate's name, certification title, issuing organisation and issue and expiry dates or lifetime status, and must be unexpired at the closing date.

Personnel

• The service provider must assign suitably qualified and experienced personnel meeting the RFQ requirements; replacement personnel must be equally or better qualified and pass TCTA vetting and approval.
• TCTA reserves the right to verify references, qualifications and project evidence.

Assessment quality requirements

• Each assessment module must be independently executed and auditable, with sufficient records and reproducible evidence to support findings and retest results.
• Recognised methodologies must be used: MITRE ATT&CK techniques for adversarial emulation and OWASP guidance for application testing.
• Testing must be controlled and non-destructive, with emergency stop procedures and immediate escalation of any potential business disruption.
• Evidence must be sanitised where appropriate and handled under agreed chain-of-custody arrangements, with secure storage and transfer of reports, logs and evidence.
• Findings must be documented with affected assets, severity ratings, technical evidence, reproducible testing steps, business impact and prioritised remediation recommendations.
• Reports must carry unique finding IDs, root causes, CVSS v3.1 scores and severity, likelihood, business impact, compensating controls, remediation guidance, and OWASP or MITRE ATT&CK mapping, plus detailed scan results per asset.
• Retesting must repeat relevant exploitation steps and attack chains where authorised, and classify findings as Fixed, Partially Fixed or Not Fixed with updated risk ratings and validation evidence.
• Acceptance requires completion of the agreed scope and all deliverables, Critical and High findings fixed or formally risk-accepted by TCTA, and TCTA sign-off of the executive summary and technical report.

The financial proposal must cover the full six-month Red Team Assessment and use the RFQ Pricing Schedule.

Line items (quantity)

• External network assessment, including reconnaissance, controlled exploitation and reporting — 1 assessment module.
• Internal network assessment on-site, including unauthenticated and low-privilege authenticated testing — 1 assessment module.
• Active Directory assessment, including credential compromise, privilege escalation and attack-path validation — 1 assessment module.
• Wireless/Wi-Fi assessment, including authentication, encryption, access controls and segregation testing — 1 assessment module.
• Web application security assessment covering all agreed in-scope applications and interfaces — 1 assessment module.
• Physical and social engineering assessment covering approved scenarios and targets — 1 assessment module.
• Post-remediation retesting and validation, including the retest report — 1 retest phase.
• Skills transfer and knowledge sharing — 2 TCTA resources.

Totals to be completed

• Assessment subtotal excluding VAT.
• Disbursements excluding VAT, with an itemised breakdown.
• Total excluding VAT.
• VAT at 15% on taxable costs.
• Total including VAT.

Conditions

• Prices must be firm and unconditional and must disclose all applicable costs.
• Planning, project management, reporting, evidence preparation, workshops and skills transfer must be included without double counting.
• TCTA may decline to award to the highest-scoring bidder if the price is not market related.

Pricing format: RFQ Pricing Schedule, priced per module for the full six-month engagement.

• External network assessment — 1 assessment module
• Internal network assessment, on-site — 1 assessment module
• Active Directory assessment — 1 assessment module
• Wireless/Wi-Fi assessment — 1 assessment module
• Web application security assessment — 1 assessment module
• Physical and social engineering assessment — 1 assessment module
• Post-remediation retesting and validation — 1 retest phase
• Skills transfer and knowledge sharing — 2 TCTA resources

Pricing rules

• Prices must be firm and unconditional.
• Planning, project management, reporting, evidence preparation, workshops and skills transfer must be included without double counting.
• Disbursements must be itemised.
• Amounts must be shown excluding and including VAT; VAT is charged at 15% on taxable costs.
• The schedule totals the assessment subtotal excluding VAT, disbursements excluding VAT, total excluding VAT, VAT at 15%, and total including VAT.
• TCTA may decline to award to the highest-scoring bidder if the offered price is not market related.

Eligibility and registration

• Registration on National Treasury's Central Supplier Database, with proof submitted.
• Valid SARS tax compliance status PIN, or a printed TCS certificate; consortia, joint ventures and subcontractors must each submit a separate TCS certificate, PIN or CSD number.
• Bidders, companies with directors, or close corporations with members in the service of the state are not eligible.

Certifications

• ISO/IEC 27001 and ISO/IEC 27035 certificates issued by an accredited body (mandatory).
• Technical Lead: at least three current valid certifications — one of OSCP, OSEP, OSWE or GIAC GPEN, plus two from CREST, EC-Council ECSA, GIAC GXPN or GWAPT, CRTO, PNPT, CISSP or CEH Master. All must be unexpired at the closing date.

B-bbee

• A valid B-BBEE certificate from a SANAS-accredited verification agency, or a validly commissioned affidavit for an eligible EME or QSE, is required to claim the 20 specific-goals points.
• Joint ventures and consortia must submit a consolidated B-BBEE certificate.
• Affidavits must meet the Annexure C requirements: deponent's name and identity number, designation, enterprise name and business address, black ownership and black female ownership percentages, latest financial year revenue and whether audited or management accounts, financial year end, a single B-BBEE status level, nature of business, VAT number, matching signature dates for the deponent and the Commissioner of Oaths, an independent Commissioner of Oaths, and the correct sector code affidavit.

Contract compliance

• POPIA and applicable data protection law compliance.
• Mutual non-disclosure agreement signed before testing begins.
• Personnel must pass TCTA vetting and approval.

Returnable forms

• SBD 1 (Invitation to Bid): signed offer and bidder particulars.
• SBD 4 (Declaration of Interest): discloses state employment or relationships with the procuring institution; a false declaration disqualifies the bid.
• SBD 6.1 (Preference Points Claim): claims preference points under the Preferential Procurement Regulations 2022.
• SBD 7 contract form to be completed and signed by the successful bidder.
• Proof of authority to sign, such as a company resolution.

Duration

• Six months, covering project initiation and scope confirmation, approval of the Rules of Engagement, external and internal network assessments, Active Directory and wireless assessments, web application assessment, physical and social engineering assessment, executive and technical reporting, skills transfer and feedback presentations, remediation consultation, post-remediation retesting, and final reporting, cleanup and closure.
• The bidder must submit a project schedule showing milestones, deliverables, dependencies, and time allowed for remediation and retesting, accommodating retesting within 30 working days of the agreed remediation period.

Change control

• Changes to agreed scope, targets, testing methods or schedule must be authorised and recorded through the agreed change-control process.
• Production changes require an approved Change Request and rollback plan.
• Deviations proposed by the bidder do not amend the required scope unless expressly accepted by TCTA.

Closure

• Test accounts, payloads and temporary configurations must be removed at engagement closure.
• Assessment information must be returned, retained or securely destroyed in line with the non-disclosure agreement and TCTA's instructions.

Commercial terms

• Bid validity period: 30 days.
• TCTA's Standard Conditions of Bid apply; TCTA may cancel the bid or decline to award, and the standard conditions are available on request or on TCTA's website.
• The successful bidder must complete and sign the SBD 7 contract form.
• TCTA remains responsible for implementing remediation; the service provider may not make production changes without authorisation.
• Support ends on completion and acceptance of the agreed deliverables, retesting and closure activities within the contract period.

Functionality threshold

• Minimum qualifying score: 30 out of 50. Bids below this are non-responsive and do not proceed to price evaluation.

Functionality criteria (50 points)

• Company track record in Red Team, adversary-emulation or assumed-breach engagements: 30 points. Fewer than 3 projects = 0; 3 to 4 = 20; 5 or more = 30.
• Red Team Lead experience: 20 points. Fewer than 3 eligible projects = 0; 3 to 4 = 10; 5 or more = 20.

Preference points (100 points total)

• Price: 80 points.
• Specific goals: 20 points.
• 80/20 preference point system applies.
• B-BBEE status levels score: Level 1 = 20, Level 2 = 18, Level 3 = 14, Level 4 = 12, Level 5 = 8, Level 6 = 6, Level 7 = 4, Level 8 = 2, non-compliant = 0.
• Bidders who do not meet the specific goals are not disqualified but score 0 for that element.
• Preference points are claimed only with a valid B-BBEE certificate or sworn affidavit stating the status level; affidavits not meeting the Annexure C requirements score no points.
• TCTA may require a bidder to substantiate any preference claim before or after adjudication.

Document compliance

• A bid missing a mandatory returnable is disqualified at that stage.
• A bid missing a non-mandatory returnable linked to an evaluation criterion scores no points for that criterion.