Five-year supply, implementation and support of web application firewalls (4 units) and internal network firewalls (16 units) across eight atns sites

Compulsory briefing session

• Date: 15 October 2026 at 12h00 (CAT).
• Venue: Microsoft Teams.
• Meeting ID: 392 896 137 011 619.
• Passcode: bo398QT2.
• Link: https://teams.microsoft.com/meet/392896137011619?p=z9tuaW5A4eHTwkpJIt
• Attendance is compulsory.

Clarification deadlines

• Written queries using the Form of Questionnaire (Appendix A): by 22 October 2026 at 17h00 CAT.
• Consolidated answers issued by 29 October 2026 at 17h00 CAT.

Closing

• 13 November 2026 at 14h00 CAT.

Validity

• Proposals must remain valid for 120 days from submission.

Compulsory briefing session

• Date: 15 October 2026 at 12h00 (CAT).
• Venue: Microsoft Teams.
• Meeting ID: 392 896 137 011 619.
• Passcode: bo398QT2.
• Link: https://teams.microsoft.com/meet/392896137011619?p=z9tuaW5A4eHTwkpJIt
• Attendance is mandatory; no further proof of attendance is required beyond the session register.

Enquiries before bid closure

• Contact: Zanele Mbiza
• Role: Specialist: Demand Management
• Email: [email protected]
• Copy to: [email protected]

Enquiries after bid closure

• Contact: Lesedi Mashiloane
• Role: Specialist: Acquisition Management
• Email: [email protected]
• Copy to: [email protected]

Telephone

• 011 607 1325

Submission address (hard copy)

ATNS Company Limited

Eastgate Office Park, Block C

South Boulevard Road

Bruma, 2298

South Africa

Online submission

• National Treasury e-Submission (e-Tender) system.

Submission method

• Online via the National Treasury e-Submission (e-Tender) system.
• Hard copy delivery also permitted.
• Email submissions will not be accepted or processed.

Hard copy format

• One original, one copy, and one PDF version on USB.
• Deliver to: ATNS Company Limited, Eastgate Office Park, Block C, South Boulevard Road, Bruma, 2298, South Africa.

Bid structure — two parcels

• Parcel A (Phase 1 and 2): Volume 1A general instructions and administrative requirements, excluding SBD 3.3 and SBD 6.1.
• Parcel B (Phase 3): SBD 3.3 Pricing Schedule, SBD 6.1 Preference Points Claim Form, CSD report, CIPC documents, shareholder certificates, ID copies of shareholders, and a valid B-BBEE certificate or sworn affidavit for EMEs/QSEs.

Returnable forms and documents

• SBD 1 (Invitation to Bid): bidder details and signed offer cover page; an unsigned or omitted form renders the bid non-responsive.
• SBD 3.3 (Pricing Schedule — Professional Services): full pricing for all line items; incomplete or missing pricing renders the bid non-responsive.
• SBD 4 (Declaration of Interest): discloses state employment or connections; each party to the bid must complete and sign it.
• SBD 6.1 (Preference Points Claim Form): claims specific-goal preference points.
• SBD 7 (Contract Form): to be completed and signed by the successful bidder.
• Proof of CSD registration or proof of application.
• Valid SARS Tax Compliance Status PIN.
• OEM certification or authorisation letter.
• Reference letters from at least three enterprise clients.
• Technical manual for the proposed WAF and internal firewall solution.
• Proof of registration or accreditation with OEMs or professional bodies.
• Bidders Declaration and Structure Clarification Form, indicating bidding structure and primary bidder type.
• POPIA consent.

Disqualification risks

• Late bids are not accepted.
• Any returnable form left unsigned or omitted.
• Bids without a price or with an incomplete price.
• Failure to attend the compulsory briefing session.
• Failure to submit the required reference letters, OEM certification or technical manual.
• Non-compliance with any submission condition or evaluation criterion.

Parcel A — Administrative and Mandatory (Phase 1 and 2)

• Volume 1A general instructions and administrative requirements, excluding SBD 3.3 and SBD 6.1.

Parcel B — Price and Preference Points (Phase 3)

• SBD 3.3 Pricing Schedule.
• SBD 6.1 Preference Points Claim Form.
• CSD report.
• CIPC documents.
• Shareholder certificates.
• ID copies of shareholders.
• Valid B-BBEE certificate or sworn affidavit for EMEs/QSEs.

Submission

• Online via the National Treasury e-Submission (e-Tender) system, or hard copy.
• Hard copy: one original, one copy, and one PDF on USB.
• Hard copy address: ATNS Company Limited, Eastgate Office Park, Block C, South Boulevard Road, Bruma, 2298.
• Closing: 13 November 2026 at 14h00 CAT.
• Email submissions will not be accepted.

Evaluation is conducted in three phases.

Phase 1 — Administrative

• Valid SARS Tax Compliance Status PIN, valid for the full validity period.
• If a bidder fails an administrative requirement, ATNS may reject the bid or allow supplementary information within seven (7) days; the supplementary information must address administrative requirements only and must not be substantive.

Phase 2 — Mandatory

• Compulsory briefing session attendance.
• Company experience: reference letters from at least three enterprise clients confirming implementation and support of web application next-generation firewalls within the past five years.
• OEM certification or authorisation letter for the proposed WAF and internal firewall solutions.
• Technical and functional compliance with the specifications in sections 3.1 and 3.2, evidenced by the technical manual.
• Failure to comply with any mandatory requirement excludes the bid from further evaluation.

Phase 3 — Price and Preference Points

• System: 80/20 preference point system.
• Price: 80.00 points.
• Preference points for specific goals: 20.00 points.
• Total: 100.00 points.
• Price formula: Ps = 80(1 − (Pt − Pmin)/Pmin).
• The 80/20 system applies to responsive tenders up to and including R50 000 000.

Specific goals (20 points)

• 51% Black Owned suppliers: 10.00 points.
• 30% Black Woman Owned suppliers: 10.00 points.
• Bidders must claim points in SBD 6.1.
• Evidence: CSD registration report, CIPC documents, shareholder certificates, ID copies of shareholders, and a B-BBEE certificate or sworn affidavit for EMEs/QSEs.

No minimum qualifying score for functionality is stated.

Scope

• Supply, implementation and support of web application firewalls (WAF) and internal network firewalls in high-availability mode over five years.
• The solution must include reporting.
• WAF objectives: protect web applications against SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF) and other OWASP Top 10 vulnerabilities; mitigate application-layer DoS/DDoS attacks and malicious traffic.
• Internal firewalls provide network segmentation and control lateral movement of traffic.

WAF specifications

• Storage: 1 TB SSD.
• IPS throughput: 12 Gbps.
• NGFW throughput: 10 Gbps.
• Threat protection throughput: 6 Gbps.
• Concurrent sessions: 4 million.
• Concurrent users: 1 500.
• Total users: 5 000.

Internal firewall specifications

• Storage: 500 GB SSD.
• IPS throughput: 10 Gbps.
• NGFW throughput: 10 Gbps.
• Threat protection throughput: 5 Gbps.
• Concurrent sessions: 2 million.
• Concurrent users: 1 500.
• Total users: 2 000.

Functional requirements

• Support sLDAP, OAuth 2.0, OpenID Connect, SAML on Azure AD, and local authorisation.
• Control network access by monitoring incoming and outgoing packets and allowing or blocking based on source and destination IP addresses, FQDN, protocols and ports.
• Identity awareness for granular application control by user, user group and machine.
• Deep packet inspection for protocol non-compliance, viruses, spam, intrusions and defined criteria.
• Built-in IDS and IPS, signature-based, statistical anomaly-based and stateful protocol analysis based.
• SSL monitoring including TLS 1.3.
• Multi-core CPUs separating general CPU tasks from threat prevention and traffic inspection.
• Network traffic prioritisation per user, zone, group, firewall rule, URL and application.
• NAT and PAT capability.
• Built-in antivirus engine inspecting HTTPS traffic across HTTP, HTTPS, FTP, POP3, SMTP and SMB.
• Compliance must be substantiated by the technical manual covering sections 3.1 and 3.2, with page numbers and relevant paragraphs referenced.

Deployment

• 4 WAFs in high availability at Bruma and O.R. Tambo sites.
• 16 internal firewalls in high availability across eight sites:
• OR Tambo: ATNS Operations Complex, Gate 14 Bonaero Drive, Bonaero Park, 1622.
• Bruma: Eastgate Office Park Block C, South Boulevard Road, 2198.
• Cape Town: Control Tower Complex, Foxtrot 3 Gate, Tower Road, Cape Town International Airport, 7525.
• King Shaka International Airport: ATNS Control Tower, 1 King Shaka Airport Road, Tongaat, La Mercy, KwaZulu-Natal.
• Port Elizabeth: E2830 Alistor Miller Road, Walmer, Port Elizabeth.
• East London: 984 Settlers Way, Greenfields, East London.
• George: 1 PW Botha Airport, Moeras Rivier, George.
• Bloemfontein: ATNS Operations Building, 1 Thaba Nchu Rd, Bob Rodgers Park, Bloemfontein.

Operational requirements

• 24/7 monitoring and support.
• Firmware and software upgrades.
• OEM escalation.
• Replacement hardware and spares.
• System health checks.
• Performance reporting.

Mandatory experience

• Reference letters from at least three enterprise clients confirming the bidder has implemented and supported web application next-generation firewalls.
• The referenced service must have been completed within the past five years.
• Each letter must be on the client organisation's official letterhead and signed by an authorised representative.
• Each letter must include contact details (telephone number and/or email address) for verification.
• Letters of appointment, project award notifications or contracts will not be accepted as substitutes.
• Failure to provide valid and current documents results in automatic disqualification.

OEM certification

• Proof of certification or authorisation from the OEM to implement and support the proposed WAF and internal firewall solutions, clearly detailing which products and activities the bidder is authorised to undertake.

Technical capability

• The proposed solution must meet all specifications in sections 3.1 and 3.2, evidenced by the technical manual.

Devices must use multi-core CPUs that separate general CPU tasks from threat prevention and traffic inspection tasks, improving performance and reducing latency.

SBD 3.3 Pricing Schedule (Professional Services) must be completed in full.

Section 1 — Hardware, Software and Project Management

• Internal firewall hardware: 16 units.
• WAF hardware: 4 units.
• Internal firewall software and licensing.
• WAF software and licensing: 4 units.
• Internal firewall 5-year NBD warranty: 16 units.
• WAF 5-year NBD warranty: 4 units.
• Implementation, configuration and project management.
• Training: 10.
• Maintenance and support: 1.
• Total cost for Year 1.

Section 2 — Maintenance and Support

• Year 2, Year 3, Year 4 and Year 5 maintenance and support, each 1.

Summary

• Section 1 total, Section 2 total, total 5-year cost excluding VAT, VAT at 15%, total 5-year cost including VAT.

Conditions

• Prices in ZAR, inclusive of all applicable taxes, duties, levies, transport, delivery, implementation, configuration, project management, training, maintenance, support and other costs.
• All line items must be priced; failure to price any item may render the bid non-responsive.
• Quantities are estimates for evaluation only.
• Year 1 includes all hardware, software, licensing, warranty, implementation, configuration, project management, training, maintenance and support costs.
• Years 2 to 5 maintenance and support shown as annual costs.
• Prices fixed for at least 120 days from closing unless otherwise specified in the Special Conditions of Contract.
• Discounts must be clearly stated.
• ATNS may verify pricing and correct arithmetical errors; unit prices prevail over totals.
• No price adjustments after closing except where expressly permitted.
• Unpriced items are deemed included elsewhere and will not attract additional payment.
• The service provider must provide orderly transition and exit services at contract end or earlier termination, including transfer of configurations, documentation, licences, credentials, asset information and operational knowledge.

Pricing format

• Prices in South African Rand (ZAR) and inclusive of all applicable taxes, duties, levies, transport, delivery, implementation, configuration, project management, training, maintenance, support and any other costs.
• All sections of the pricing schedule must be completed; failure to price any line item may render the bid non-responsive.
• Quantities are estimates for evaluation and do not guarantee actual quantities.
• Year 1 pricing must include all hardware, software, licensing, warranty, implementation, configuration, project management, training, maintenance and support costs.
• Years 2 to 5 maintenance and support must be shown as annual costs.
• Total bid price = Section 1 (hardware, software and project management) + Section 2 (maintenance and support, Years 2 to 5) + VAT where applicable.
• Prices remain fixed for at least 120 days from the closing date unless otherwise specified in the Special Conditions of Contract.
• Discounts must be clearly stated in the pricing schedule.
• ATNS may verify pricing and correct arithmetical errors; unit prices prevail over totals.
• No price adjustments accepted after closing, except where expressly permitted.
• Unpriced items are deemed included elsewhere in the bid price and will not attract additional payment.
• The service provider must provide orderly transition and exit services at contract end or earlier termination, including transfer of configurations, documentation, licences, credentials, asset information and operational knowledge.

Pricing schedule line items

• Internal firewall hardware: 16 units.
• WAF hardware: 4 units.
• Internal firewall software and licensing.
• WAF software and licensing: 4 units.
• Internal firewall 5-year NBD warranty: 16 units.
• WAF 5-year NBD warranty: 4 units.
• Implementation, configuration and project management.
• Training: 10.
• Maintenance and support: 1.
• Years 2 to 5 maintenance and support: 1 each year.
• Summary: Section 1, Section 2, total 5-year cost excluding VAT, VAT at 15%, total including VAT.

No bid security, performance bond or retention percentage is stated.

Registration and tax

• CSD registration required before submitting a bid; submit proof of registration or proof of application. No award or contract will be concluded with a bidder not registered on the CSD.
• Valid SARS Tax Compliance Status PIN, valid for the full validity period. A printed TCS certificate may also be submitted.
• Consortia, joint ventures and sub-contractors: each party must submit a separate TCS certificate, PIN or CSD number.
• Where no TCS PIN is available but the bidder is registered on the CSD, a CSD number must be provided.
• Bids submitted without any of the above are deemed non-responsive.

B-bbee

• B-BBEE certificate or sworn affidavit required for EMEs and QSEs to claim preference points.
• Specific goals: 51% Black Owned suppliers (10 points) and 30% Black Woman Owned suppliers (10 points).
• Evidence: CSD registration report, CIPC documents, shareholder certificates, ID copies of shareholders, and B-BBEE certificate or sworn affidavit.

OEM and professional registration

• OEM certification or authorisation letter for the proposed WAF and internal firewall solutions.
• Registration or accreditation with OEMs or professional bodies; bids without proof are deemed non-responsive.

Other compliance

• Bidders must not be persons in the service of the state, companies with directors in the service of the state, or close corporations with members in the service of the state.
• General Conditions of Contract must be accepted.
• POPIA compliance required.
• No CIDB grading or local content percentage is stated.

Preference points for specific goals under the 80/20 system

• 51% Black Owned suppliers: 10.00 points.
• 30% Black Woman Owned suppliers: 10.00 points.

Evidence required

• CSD registration report.
• CIPC documents.
• Shareholder certificates.
• ID copies of shareholders.
• B-BBEE certificate or sworn affidavit for EMEs/QSEs.

Bidders must claim points in SBD 6.1.

Contract terms

• ATNS accepts no liability for the accuracy of the brief; bidders rely on their own judgment and information.
• ATNS may vary the scope and terms; bidders will be advised in writing if a variation occurs.
• The successful bidder must accept standard terms including a retention clause for non-satisfactory completion, breach of contract, confidentiality, and a requirement for adequate professional indemnity insurance.
• ATNS may withdraw from commitments if circumstances dictate.
• ATNS may cancel or postpone the procurement at any stage before a contract is entered into.
• ATNS may negotiate with one or more bidders on any terms including price; negotiation does not constitute an award or promise to award.
• ATNS is not obliged to accept the lowest or any bid.
• A contract is concluded only when reduced to writing and signed by both parties; a Service Level Agreement may apply.
• ATNS may enter one contract for all functions or separate contracts for different functions.

Rejection grounds

• Proven corrupt or fraudulent acts in competing for the contract.
• Abuse of the ATNS SCM system, proven fraud or improper conduct, or failure to perform on a previous contract.
• Such actions will be communicated to the National Treasury.

Other conditions

• General Conditions of Contract must be accepted.
• Additional information may be requested during evaluation; replies must be submitted within 7 working days or as indicated, failing which the bid may be disregarded. Unsolicited additional information will not be accepted.
• Confidentiality obligations apply to the bid and all related information.
• Copyright of all contract documentation belongs to ATNS; the successful bidder may not disclose information, documentation or products to other clients without written approval. This survives termination.
• If the contractor cannot deliver within the period, at the quoted price or as specified, immediate written notice must be given; ATNS may implement remedies under the GCC.
• The bidder warrants it can conclude the agreement to ATNS's satisfaction.
• Waiver of a breach does not prejudice remedies for continuing or other breaches; no delay or indulgence operates as a waiver.
• On termination, the bidder must hand over all documentation and deliverables without right of retention.
• No amendment or variation is valid unless in writing and signed by both parties; any waiver of the written requirement must also be in writing.

Mandatory requirements

• Attendance of the compulsory briefing session.
• Company experience: reference letters from at least three enterprise clients confirming implementation and support of web application and next-generation firewalls, completed within the past five years, on official client letterhead, signed by an authorised representative, with contact details for verification. Letters of appointment, project award notifications or contracts are not accepted.
• OEM certification or authorisation letter to implement and support the proposed WAF and internal firewall solutions.
• Technical and functional compliance with sections 3.1 and 3.2, evidenced by the technical manual with page numbers and relevant paragraphs referenced.
• Failure to comply with any mandatory requirement excludes the bid from further evaluation.

Three-phase evaluation.

Phase 1 — Administrative

• Valid SARS Tax Compliance Status PIN, valid for the full validity period.

Phase 2 — Mandatory

• Compulsory briefing session attendance.
• Reference letters from at least three enterprise clients for implementation and support of web application next-generation firewalls within the past five years.
• OEM certification or authorisation letter.
• Technical manual demonstrating compliance with sections 3.1 and 3.2.

Phase 3 — Price and Preference Points (80/20)

• Price: 80.00 points.
• Preference points for specific goals: 20.00 points.
• Total: 100.00 points.
• Price formula: Ps = 80(1 − (Pt − Pmin)/Pmin).
• Specific goals: 51% Black Owned suppliers (10.00 points) and 30% Black Woman Owned suppliers (10.00 points).
• Evidence: CSD registration report, CIPC documents, shareholder certificates, ID copies of shareholders, and B-BBEE certificate or sworn affidavit for EMEs/QSEs.
• Bidders must claim points in SBD 6.1.