Penetration testing and vulnerability assessment services for nmisa (3-Month engagement)

Commercial enquiries:

• Contact: Supply Chain
• Telephone: 012 947 2875
• Email: [email protected]

Technical enquiries:

• Contact: Bongani Mabunda
• Telephone: 012 947 2712
• Email: [email protected]

Submission email: [email protected]

Submission method: email to [email protected]

Closing time: 23 October 2026 at 14:00

Mailbox size limit: 8MB; if the proposal exceeds this, send in multiple emails. Only on-time submissions are considered.

Quotation must be on company letterhead and clearly state the delivery period.

Returnable documents (all must be completed, signed and attached):

• SBD 4 (Declaration of Interest): discloses whether any director or shareholder is employed by the state or connected to anyone at NMISA; false declarations disqualify the bid.
• SBD 6.1 (Preference Points Claim): claims B-BBEE preference points under the 80/20 system.
• CSD report: proof of Central Supplier Database registration.
• Valid B-BBEE certificate (or sworn affidavit for EME/QSE) if pricing exceeds R2 000.
• Compulsory technical specification table: complete with "yes" or "no" and supporting evidence; a "no" on any item disqualifies the bid.
• Signed declaration identifying proposed subcontractors (or confirming none) and confirming no subcontractor will perform testing without prior written NMISA approval.
• Evidence of Professional Indemnity and Cyber Liability Insurance, or a signed undertaking to provide it before contract commencement.

Disqualification risks:

• Any returnable form omitted or unsigned.
• Quotation received after the closing time.
• Failure to meet any compulsory technical specification.

Evaluation stages:

1. Mandatory/legislative compliance (pass/fail): SBD 4, SBD 6.1, CSD report, valid B-BBEE certificate. No points allocated; failure to comply disqualifies.
2. Compulsory technical specifications (pass/fail): Professional Indemnity and Cyber Liability Insurance; subcontractor disclosure. A "no" on any item disqualifies.
3. Functional evaluation (minimum qualifying score: 80/100):

• Company Experience and Track Record (20 points): 5 or more comparable penetration testing/vulnerability assessment projects completed in the last 5 years = 20; 4 = 16; 3 = 12; 2 = 8; 1 = 4; none = 0. Evidence must identify client, scope, completion date and contactable reference. Duplicate descriptions count once.
• Proposed Technical Methodology (25 points): comprehensive coverage of external, internal, web/application, cloud/identity, wireless, manual validation, controlled exploitation, evidence handling, risk rating, reporting and retesting.
• Key Personnel Experience and Capability (20 points): Project Lead with 8+ years and at least two testers with 5+ years each = 20; lead 6-7 years and two testers 4+ years = 16; meets mandatory minimum = 12; below mandatory = 0.
• Professional Certifications (10 points): strong coverage including 2+ hands-on offensive-security certifications = 10; 3 relevant certifications including at least 1 hands-on = 8; mandatory minimum including at least 1 hands-on = 6; below mandatory = 0. Multiple certificates held by one individual do not substitute for team capability.
• Reporting, Remediation and Retesting Approach (15 points): sample anonymized report or detailed template plus remediation/retest approach.
• Project Plan, Governance and Service Protection (10 points): scheduling, RoE, communications, escalation, critical finding notification, stop-test process and protection of production services.

4. Price and B-BBEE points (80/20 system):

• Price: 80 points maximum, calculated using the formula Ps = 80(1 - (Pt - Pmin)/Pmin).
• B-BBEE status level: Level 1 = 20, Level 2 = 18, Level 3 = 14, Level 4 = 12, Level 5 = 8, Level 6 = 6, Level 7 = 4, Level 8 = 2, non-compliant = 0.

Total score out of 100.

Scope: once-off independent penetration testing and vulnerability assessment of NMISA's external and internal attack surface, cloud environment (Microsoft Azure, Microsoft 365, Entra ID), identity services, networks, wireless infrastructure, web applications and other agreed critical ICT systems.

Duration: approximately 3 months for initial assessment, reporting and remediation workshop; plus up to 3 additional months for two included remediation retest cycles after NMISA's written acceptance of the initial final report.

Key requirements:

• Automated vulnerability scanning alone is not acceptable; must combine automated discovery with manual validation, attack-path analysis and controlled exploitation where authorized.
• Findings from automated tools must be manually validated; false positives must be excluded from confirmed counts.
• Inception meeting and Rules of Engagement (RoE) must be approved by NMISA before intrusive testing.
• External penetration testing: assess public-facing IPs, domains, DNS, internet-facing hosts, portals, remote-access services, firewalls, VPNs and perimeter controls.
• Internal network penetration testing: assess agreed network segments, servers, workstations, segmentation, trust relationships, credential exposure, privilege escalation and lateral movement.
• Cloud and identity security assessment: assess Azure resources, Entra ID identity/access controls, privileged roles, authentication, application registrations, M365 security exposure. Must comply with cloud provider testing rules; no testing of Microsoft-managed infrastructure.
• Web application and portal testing: assess NMISA-selected internet-facing and internal web apps, portals and APIs; apply OWASP-aligned practices. Testing limited to NMISA-controlled customizations and authorized interfaces.
• Wireless network security assessment: assess corporate and guest wireless networks, encryption, authentication, segmentation and rogue access risks.
• Vulnerability assessment: authenticated and unauthenticated assessments across Windows, Linux, network devices, servers and applications; identify end-of-life components.
• Social engineering/phishing simulation and physical security testing are excluded from core scope; may only be performed with separate written approval and quoted optional rates.
• Remediation support: provide remediation priority matrix (severity, CVSS v4.0 score/vector, affected asset, business impact, recommended action); conduct technical remediation workshop; include at least two retest cycles.

Deliverables (11 total): inception/RoE pack, attack surface/vulnerability assessment report, external penetration test report, internal penetration test report, cloud and identity security assessment report, web application/portal report, wireless security assessment report, executive summary, technical remediation workshop, retest and closure report, final consolidated report.

Service levels:

• Mobilization/inception within 5 business days of appointment.
• Critical finding notification immediately upon validation, no later than 4 hours after validation.
• Draft assessment report within 5 business days after completion of testing activity.
• Final report within 5 business days after receipt of consolidated NMISA comments.
• Retest within 10 business days of each NMISA retest request.
• Retest report within 3 business days after completion of retesting.

Testing rules:

• No testing until RoE approved in writing.
• Testing must be non-destructive; no DoS/DDoS, destructive malware, ransomware simulation, uncontrolled persistence, data deletion, bulk data extraction unless separately authorized.
• Production credentials and sensitive data must be protected, access restricted, encrypted in transit and at rest.
• Any target outside written scope must not be scanned or exploited; report and stop interaction.
• All tools must be appropriately licensed and lawfully authorized for commercial use.
• Testing infrastructure and data handling must comply with South African data-protection requirements (POPIA) and NMISA-approved arrangements.
• Maintain detailed testing activity log.

Methodology and standards:

• Must align with PTES, OWASP WSTG/Top 10, NIST SP 800-115; risk-rate using CVSS v4.0; may use MITRE ATT&CK.
• Must explain reconnaissance, discovery, vulnerability identification, manual validation, controlled exploitation, privilege escalation, lateral movement, evidence handling, false-positive control, risk rating, reporting, remediation and retesting.
• Identify principal commercial and/or open-source tools proposed.
• Source-code review excluded unless specifically authorized and priced.

Pricing format: comprehensive fixed and transparent pricing proposal for the complete core engagement, in ZAR, excluding and including VAT as applicable.

Core Assessment Services (Items 1-10) form the Evaluated Bid Price:

1. Inception, discovery and Rules of Engagement (once-off)
2. External vulnerability assessment and penetration test (assessment)
3. Internal vulnerability assessment and penetration test (assessment)
4. Microsoft Azure / cloud security assessment (assessment)
5. Microsoft Entra ID / identity security assessment (assessment)
6. Web application / portal penetration testing (per application, baseline 3 applications/APIs)
7. Wireless network security assessment (assessment)
8. Technical remediation workshop and executive presentation (once-off)
9. Two (2) remediation retest cycles and closure verification of findings (fixed price)
10. Final consolidated close-out report (once-off)

Optional/on-demand rates (Items 11-15) are excluded from the Evaluated Bid Price and create no commitment:

11. Additional web application/API penetration testing above baseline (per application/API)
12. Additional targeted penetration testing from approved material change (per day)
13. Social engineering / phishing simulation (per campaign)
14. Senior penetration tester / security specialist (hourly)
15. Additional penetration tester / security analyst (hourly)

Pricing rules:

• Prices must include all professional fees, project management, licensed tools, reporting, workshops, local travel, subsistence and incidental costs.
• No separate charge for project management, standard reporting, evidence preparation, ordinary local travel, tool licensing or workshops.
• Quotation validity: not less than 90 days from RFQ closing date.
• Core prices firm for the engagement, subject only to tax changes or formally approved variations.
• Any quantity above stated baseline requires approved unit rates and prior written NMISA authorization.
• No variation or additional fee for work performed without prior written approval.

Payment terms:

• NMISA is a Schedule 3A public entity under PFMA; payments effected when all goods and services are delivered in full.
• Invoices must be linked to milestones/deliverables formally accepted in writing by NMISA.
• No payment due merely because testing commenced or draft report submitted.
• Final payment may be withheld until final consolidated report, evidence handover and information-destruction obligations completed.

Pre-qualification (mandatory, no points):

• CSD registration: CSD report must be attached.
• SBD 4 (Declaration of Interest): completed, attached and signed.
• SBD 6.1 (Preference Points Claim): completed, attached and signed.
• Valid B-BBEE certificate (or sworn affidavit for EME/QSE) attached where applicable.
• International suppliers may be exempt from some requirements; all SBDs must be submitted signed, noting where not applicable, with documentary proof of reason.

Compulsory technical specifications (pass/fail):

• Valid Professional Indemnity and Cyber Liability Insurance appropriate to the engagement. Evidence of cover or signed undertaking with bid; valid policy schedules/certificates required before contract commencement. Failure to provide cover may result in cancellation of award; no testing while uninsured.
• Disclosure of proposed subcontractors and confirmation that no subcontractor will perform testing without prior written NMISA approval.

B-bbee:

• 80/20 preference point system applies.
• B-BBEE status level points: Level 1 = 20, Level 2 = 18, Level 3 = 14, Level 4 = 12, Level 5 = 8, Level 6 = 6, Level 7 = 4, Level 8 = 2, non-compliant = 0.
• For pricing above R2 000, B-BBEE certificate must be attached.
• Failure to submit proof of B-BBEE status means no preference points claimed.

Other:

• Bidders must not be listed on the Register for Tender Defaulters or List of Restricted Suppliers.
• Must comply with SBD 4 declarations regarding state employment and conflicts of interest.