Renewal of tenable.io Licenses and managed vulnerability services – 2-Year contract (RFQ pr10067842)

Appointment of an accredited service provider for the renewal of Tenable One licenses and managed services for a period of two (2) years. The service provider will provide Tenable license renewal (TenableOne), managed vulnerability services, support services (Tier 2 and Tier 3), and SLA-based support. Duration: 1 November 2026 to 30 October 2028.

Non-compulsory briefing session: 16 October 2026 at 10:00 AM, venue Microsoft Teams.

Closing date: 22 October 2026 at 11:00 AM.

Non-compulsory briefing session: 16 October 2026 at 10:00 AM, via Microsoft Teams. Closing date: 22 October 2026 at 11:00 AM.

RFQ submission and enquiries contact:

• Name: T Bokgwathile
• Email: [email protected]
• Submission method: email to [email protected]

Submission method: email (electronic format). Submit to [email protected]. Bids must be submitted in an email format; late submissions will not be accepted and are automatically disqualified.

Returnable documents (all must be completed, signed, and submitted; failure to submit any mandatory document will automatically disqualify the bid):

• SBD 3.3 (Pricing Schedule – Professional Services, Firm Pricing): firm prices, valid for 120 days from closing date.
• SBD 4 (Bidder's Disclosure, original completed and signed): disclose any employment by an organ of state, relationships with procuring institution, and all CSD-registered companies linked to directors.
• SBD 6.1 (Preference Point Claim form, original completed and signed): claim specific-goal preference points.
• Full Technical Proposal with supporting documents.
• Copy of full company registration documents.
• Copies of South African IDs for all Directors.
• Company Profile.
• Valid Tenable OEM Authorization Letter confirming accreditation and status level (mandatory; missing letter leads to disqualification).
• Joint Venture / Consortium / Trust Deed (if applicable) with all required documents for every party: certified copies of shareholders certificates, company registration documents, and ID documents of Directors or Members.

Evaluation follows the 80/20 preference point system (price 80 points, specific goals 20 points), with sequential phases:

Phase 1: Administrative Compliance (pre-qualification) – signed and completed bid documents, company registration documents, valid Tenable OEM Authorization Letter, any other mandatory documentation. Failure results in disqualification.

Phase 2: Functionality / Technical evaluation (100 points, cut-off 70). Only bidders scoring 70 or above proceed to Phase 3.

Functionality criteria:

• Bidder experience (25 points): minimum 4 signed reference letters of similar ICT security projects. 4 letters = 3 points; 6 letters = 4 points; 7 or more = 5 points. (Weighted 25)
• Team Lead experience (25 points): Bachelor's Degree in IT or Information Systems with minimum 5 years' progressive cybersecurity experience. CV with qualification and 5 years = 3 points; 6 years = 4 points; 7+ years = 5 points. (Weighted 25)
• Technical proposal (50 points): must adequately address the 8 scope elements (Licensing, Managed Vulnerability Services, Support Services, Monthly Reviews and Reporting, SLA Requirements, Response and Resolution Times, Support Channels). Adequately addresses 6 of 8 = 3 points; 7 of 8 = 4 points; all 8 = 5 points. (Weighted 50)

Phase 3: Price and Specific Goals (80/20). Price formula: Ps = 80(1 - (Pt - Pmin)/Pmin). Specific goals (20 points):

• Black Ownership (7 points): 100% = 7, 51% = 5, less than 51% = 3, not Black owned = 0.
• Women Ownership (5 points): 100% = 5, 51% = 3, less than 51% = 1, not women owned = 0.
• Youth Ownership (5 points): 100% = 5, 51% = 3, less than 51% = 1, not youth owned = 0.
• PWDs Ownership (3 points): 100% = 3, 51% = 2, less than 51% = 1, not PWDs owned = 0.

Specific goals points require verification documents: registration documents and ID copies, or a doctor's letter for PWDs ownership.

Scope of work (two-year contract, 1 November 2026 to 30 October 2028):

• Tenable license renewal (TenableOne / TenableOne) directly from OEM, covering 300 assets (GPL may review the number for the second year).
• Licensing must include vulnerability scanning, risk scoring, and reporting dashboards.
• Managed vulnerability services: monthly vulnerability scanning (minimum 4 scans per month where required), continuous monitoring of security posture, risk prioritization and remediation guidance, custom vulnerability reporting, executive reporting on overall security posture.
• Support services: Tier 2 and Tier 3 technical support, telephonic and remote support, incident logging via helpdesk/email/phone, defined support hours (minimum 8x5 with escalation capability).
• Monthly reviews and reporting: monthly service review meetings; monthly reports must include vulnerability scan results, remediation status, risk trend analysis, incident management statistics, SLA performance metrics, recommendations; quarterly reports provide strategic overview.
• System health checks and optimization of the Tenable platform (monitor scan performance, ensure optimal configuration and updates).

SLA requirements: signed formal SLA aligned to GPL requirements.

Incident severity classification:

• Severity 1 (Critical): service unavailable or severe impact.
• Severity 2 (High): moderate service impact.
• Severity 3 (Medium): minor impact.
• Severity 4 (Low): requests or non-critical enhancements.

Response and resolution times:

• Critical: response 15 min, start 1 hr, resolution 4 hrs.
• High: response 30 min, start 4 hrs, resolution 8 hrs.
• Medium: response 2 hrs, start 8 hrs, resolution 24 hrs.
• Low: response 4 hrs, start 24 hrs, resolution 48 hrs.

Support channels: email (helpdesk system), telephonic support, remote support tools. All incidents must be logged and tracked via a formal ticketing system.

Scope elements to be addressed in technical proposal: 1) Licensing, 2) Managed Vulnerability Services, 3) Support Services, 4) Monthly Reviews and Reporting, 5) Service Level Agreement, 6) SLA Requirements, 7) Response and Resolution Times, 8) Support Channels. The technical proposal must clearly describe the approach to each of these eight elements.

Bidder experience: minimum 4 years' relevant experience in ICT security. Mandatory valid Tenable OEM Authorization Letter. Proven record of four (4) similar assignments with signed reference letters. Team leader must have a Bachelor's Degree in IT or Information Systems and minimum 5 years' progressive cybersecurity experience; CV must be submitted with relevant qualification. Personnel must be appropriately qualified with relevant certifications.

Quality standards defined in Section 4 of the document apply. Deliverables must meet those quality standards. Reporting requirements: monthly reports must include vulnerability scan results, remediation status, risk trend analysis, incident management statistics, SLA performance metrics, and recommendations. Quarterly reports must provide a strategic overview of service performance, key risks, compliance status, vulnerability management maturity, and progress against service improvement initiatives.

Pricing schedule SBD 3.3 (Professional Services) applies. Prices quoted in South African Rand (ZAR) and VAT inclusive/exclusive. Offer must be valid for 120 days from closing date. Rates must be firm for the full period or state basis for adjustments. Payment upon satisfactory delivery of agreed milestones; no advance payments unless approved in writing.

Prices must be quoted in South African Rand (ZAR) and be VAT inclusive or exclusive.

Payment will be made upon satisfactory delivery of agreed milestones.

No advance payments will be made unless approved in writing.

Mandatory compliance requirements:

• CSD registration (companies must be registered on the Central Supplier Database).
• Valid tax clearance (SARS) as per SCM requirements.
• B-BBEE: Preference points claimed under specific goals per SBD 6.1, with verification documentation (registration documents, ID copies, doctor's letter for PWDs).
• Tenable OEM Authorization Letter (mandatory, confirms accreditation and status level; failure to submit leads to disqualification).
• Minimum of 4 years' relevant experience in ICT security.
• Proven record of four (4) similar assignments, with signed reference letters.
• Team leader must have a Bachelor's Degree in IT or Information Systems and minimum 5 years' progressive cybersecurity experience.
• Company registration documents and copies of South African IDs for all Directors.
• Joint Venture / Consortium / Trust Deed (if applicable) with all required documents for all parties.
• Compliance with all applicable legislation, regulations, and policies including SCM, CIPC, and SARS.

Service Level Agreement (SLA) is mandatory; the service provider must sign a formal SLA aligned to GPL requirements. Incident severity classification as per GPL managed service model. Response and resolution times as per SLA table. All incidents must be logged and tracked via a formal ticketing system. Support channels: email (helpdesk system), telephonic support, remote support tools.

GPL reserves the right to appoint one or more service providers, to not make any appointment, or to establish a panel. GPL is not bound to accept the lowest-priced bid or any bid. Late submissions are automatically disqualified. GPL may verify all information; false or misleading information leads to disqualification. Bidders must comply with all applicable legislation. Costs of preparation are for the bidder's account. GPL may cancel the bid process at any stage.

Functionality evaluation (100 points, cut-off 70): Bidder experience (25 points), Team Lead experience (25 points), Technical proposal addressing 8 scope elements (50 points). Only bidders scoring 70+ proceed to price and specific goals (80/20).