Managed security operations centre (msoc) implementation, operation and support – 36 months (nrcs 011-2026/2027)

Closing date: 04 December 2026 at 11:00.

Briefing session: none stated (marked N/A).

Bid validity: 180 days from closing date.

Bidding procedure enquiries:

• Contact: Glenda Mathane
• Email: [email protected]
• Telephone: 012 482 8765

Technical enquiries:

• Contact: Siyabonga Mfeka
• Email: [email protected]
• Telephone: 012 482 8712

Submission address:

NRCS Tender Box

Ground Floor, SABS Campus

1 Dr Lategan Road

Groenkloof, Pretoria, 0001

Submission method: sealed bid box only. No fax, post, or email submissions accepted.

Submission address: NRCS Tender Box, Ground Floor, SABS Campus, 1 Dr Lategan Road, Groenkloof, Pretoria, 0001.

Closing time: 04 December 2026 at 11:00. Late bids are not considered.

Bids must be submitted on the official forms provided, not re-typed.

Each sealed envelope must be marked with the bid reference NRCS 011-2026/2027 and the description.

Returnable forms (all must be completed and signed):

• SBD 1 (Invitation to Bid): bidder details and offer cover page.
• SBD 3.1 (Pricing Schedule): firm prices, valid for 180 days from closing date.
• SBD 4 (Declaration of Interest): discloses any state employment or connections; false disclosure disqualifies.
• SBD 6.1 (Preference Points Claim): claims B-BBEE preference points.
• SBD 7 (Contract Form): to be signed by successful bidder.
• Authority for Signatory: attach a signed resolution authorising the signatory.
• Proof of authority (e.g., company resolution) must accompany the bid.

Disqualification risks:

• Late submission, regardless of reason.
• Missing or unsigned returnable forms.
• Failure to provide a clear bid price.
• Bidders listed on the Register for Tender Defaulters or List of Restricted Suppliers.

Preference point system: 80/20 (applicable to requirements up to R50 million).

Price: 80 points.

Specific goals (B-BBEE status level):

• Level 1: 20 points
• Level 2: 18 points
• Level 3: 14 points
• Level 4: 12 points
• Level 5: 8 points
• Level 6: 6 points
• Level 7: 4 points
• Level 8: 2 points
• Non-compliant: 0 points

Total: 100 points.

Price is scored using the formula Ps = 80(1 - (Pt - Pmin)/Pmin).

Bidders who fail to provide a clear bid price are not eligible for price evaluation.

Failure to submit proof for specific goals means no preference points are claimed.

The NRCS may require substantiation of any preference claim at any time.

The NRCS requires a managed Security Operations Centre (SOC) service for 36 months, operating 24/7.

Scope includes:

• Baseline cybersecurity maturity assessment and remediation roadmap.
• Deployment, integration, testing and handover of the SOC.
• Continuous event ingestion, correlation, threat detection, alert triage, threat hunting, incident investigation and escalation.
• Supply and operate SIEM, SOAR and UEBA capabilities, including licences, hosting, management and support.
• Incident classification, severity-based prioritisation, escalation matrix, runbooks, playbooks, case records, evidence preservation and forensic support.
• Response actions only within NRCS-approved authorisation boundaries; emergency containment procedures must be documented and approved.
• Secure NRCS-accessible portal or dashboard with near-real-time alert and incident status.
• Access to lock USB ports on laptops/desktops when needed.

Monitoring coverage (minimum expected scope, subject to discovery):

• Identity and access: Active Directory / Entra ID, authentication, privileged access, VPN, access control events.
• Endpoints and servers: Microsoft Defender and other supported EDR/AV, OS, server and virtualisation security events.
• Network and perimeter: Fortinet firewall, SD-WAN, routers, switches, wireless/NAC, DNS and internet security events.

Objectives:

• Detect and respond to cyber threats across all NRCS offices and approved cloud services.
• Centralise and correlate security telemetry.
• Improve incident response readiness, vulnerability prioritisation and threat intelligence.
• Protect sensitive and personal information, support POPIA compliance.
• Provide live visibility, monthly management reports, audit-ready evidence and structured skills transfer.

Goods/services must conform to standards in the bidding documents and specifications.

Pre-bidding testing is at bidder's cost.

Premises open for inspection by NRCS or its representatives at all reasonable hours.

If inspections show non-compliance, costs are borne by the supplier; non-compliant supplies may be rejected and replaced at supplier's cost.

Supplier must permit audit of records by NRCS-appointed auditors.

Pricing must be firm and in ZAR inclusive of all taxes.

Offer valid for 180 days from closing date.

Complete all pricing fields: Year 1, Year 2, Year 3, and 36-month total for each item.

Items: maturity assessment, deployment/integration/testing/handover, managed SOC subscription, SIEM/SOAR/UEBA licences/hosting/ingestion, training and quarterly attack simulations, other approved costs, licensing, escalation costs.

Provide subtotal (VAT exclusive), VAT, and total bid price (VAT inclusive).

Bidders who fail to submit pricing proposals are disqualified.

The total bid amount is used for price and preference evaluation.

Pricing schedule: SBD 3.1.

Only firm prices accepted; non-firm prices (including exchange-rate-linked) are not considered.

Prices in South African Rand, inclusive of all applicable taxes.

Offer valid for 180 days from closing date.

Pricing items (Year 1, Year 2, Year 3, 36-month total):

1. Once-off maturity assessment and remediation roadmap
2. Deployment, integration, testing and handover
3. Managed SOC subscription (12 months per year)
4. SIEM/SOAR/UEBA licences, hosting and ingestion (if not included in item 3)
5. Training and quarterly attack simulations
6. Other explicitly itemised and approved costs
7. Licensing
8. Escalation costs

Subtotal (VAT exclusive), VAT, and total bid price (VAT inclusive) must be provided.

Bidders who fail to submit pricing proposals are disqualified.

The total bid amount is used to evaluate price and preference.

Payment terms: payments within 30 days after submission of a valid invoice (per GCC).

Tax compliance:

• Submit a SARS TCS PIN or a printed TCS certificate.
• Alternatively, provide a CSD number if no TCS PIN is available.
• For consortia/JVs/subcontractors, each party must submit a separate TCS certificate/PIN/CSD number.

Bidders must not be persons in the service of the state, nor have directors/members who are.

B-bbee:

• A B-BBEE verification certificate or sworn affidavit (for EMEs and QSEs) must be submitted to claim preference points.
• EME (turnover < R5 million): signed letter from auditor/accountant confirming turnover and black ownership, or B-BBEE certificate.
• QSE (turnover R5m–R35m): B-BBEE certificate from accredited rating agency.
• Large enterprise (turnover > R35m): B-BBEE certificate and detailed scorecard from accredited rating agency.

Foreign suppliers:

• Complete the questionnaire on residency, branch, permanent establishment, income and tax liability in South Africa.
• If not resident and no presence, no TCS PIN required.
• If accredited representative, enclose proof.

CSD registration required; provide CSD number.

Vendor registration with NRCS required before payment; submit Supplier Declaration Form (SDF) and supporting documents.

No specific health and safety requirements stated beyond general GCC clauses on delivery, delays, and penalties. The document does not detail OHS plans or HSE compliance.

Contract duration: 36 months.

General Conditions of Contract (GCC) apply; Special Conditions of Contract (SCC) prevail in conflict.

Performance security: required within 30 days of contract award, amount specified in SCC (not stated in document).

Payment: within 30 days after invoice and delivery note.

Prices firm for contract period; no variation unless authorised.

No assignment without prior written consent.

Subcontracts must be notified in writing.

Delays: penalties may apply under GCC clause 22; extension possible with or without penalties.

Termination for default, insolvency, and force majeure provisions apply.

Disputes settled per GCC.

Supplier must indemnify against patent/trademark infringement.

Supplier must permit inspection and audit of records.

Warranty: 12 months after delivery/acceptance or 18 months after shipment, whichever earlier (unless SCC states otherwise).

Evaluation uses the 80/20 preference point system.

Price: 80 points.

Specific goals (B-BBEE status level): up to 20 points.

Total: 100 points.

Bidders who fail to provide clear bid price offers are not eligible for price evaluation.

Failure to submit proof for specific goals means no preference points are claimed.

NRCS may require substantiation of any preference claim.