Atns soc implementation, operation and maintenance (5 years) – RFP atns/rfp10/06/2026/27/it_soc_sof_2025_310

Closing date: 02 October 2026, 14h00 CAT. Clarification queries due: 18 September 2026, 17h00 CAT. Responses to queries: 25 September 2026. Compulsory briefing session: date not stated in the document (attendance required).

Pre-bid clarifications: Zanele Mbiza, Specialist: Demand Management, [email protected] (cc: [email protected]). Post-bid clarifications: Nhlanhla Mdamba, Specialist: Acquisition Management, [email protected] (cc: [email protected]). Technical enquiries: Nhlanhla Mdamba/Zanele Mbiza, 011 607 1325, [email protected]; [email protected]. Submission address: ATNS Company Limited, Eastgate Office Park, Block C, South Boulevard Road, Bruma, 2298, South Africa.

Submit in three parcels (A: Administrative and Mandatory, B: Functionality, C: Price and Preference) via the online e-Submission (e-Tender) system or hard copy. Hard copies: one original, one copy, and one PDF on USB, delivered to ATNS Company Limited, Eastgate Office Park, Block C, South Boulevard Road, Bruma, 2298, South Africa, by 02 October 2026, 14h00 CAT. Bids must include completed and signed SBD 1, SBD 3.3, SBD 6.1, Declaration of Interest, CSD proof, tax compliance PIN, and all required supporting documents. Non-compliance with any administrative or mandatory requirement may lead to rejection or disqualification.

Four-stage evaluation: Stage 1 Administrative (SARS tax compliance PIN), Stage 2 Mandatory (compulsory briefing attendance, 3 SOC reference letters, on-premises architecture diagram, IT/OT monitoring capability, key personnel certifications), Stage 3 Functionality (minimum 70/100 points; SIEM functional capability 35 points, log collection and integration 35 points, training 30 points; scoring per number of documents/evidence provided), Stage 4 Price and Preference (80/20 system; price 80 points, specific goals 20 points). Bidders scoring zero on any individual criterion or below 70 functionality points are disqualified. Preference points: 10 points for 51% Black Owned, 10 points for 30% Black Woman Owned, claimed via SBD 6.1 with supporting documents.

Design, implement, operate, support, and maintain a fully integrated on-premises Security Operations Centre (SOC) for ATNS over five years. Scope includes: SOC architecture design and engineering; secure onboarding of existing systems; supply, installation, and configuration of hardware/software; SIEM implementation and tuning; SOAR deployment; incident response workflow implementation; threat intelligence integration; dashboard and reporting; security hardening; testing and commissioning. Systems to be monitored: enterprise IT, CNS/ATM (OT), network infrastructure, security systems (IDS/IPS, EDR), identity management, applications, servers, databases. Operational requirements: 24/7/365 monitoring, continuous log ingestion, incident response and escalation, threat hunting, forensics, warranty and support. SIEM functional capability must include 17 specified features (e.g., real-time log ingestion, correlation, DPI for OT protocols, custom rules, long-term retention, automated triage, playbook-driven response, threat intelligence, behavioural analytics). Log collection must support syslog, APIs, cloud connectors, agent-based/agentless collection, secure forwarding, passive OT traffic analysis, ticketing integration. Training deliverables: as-built documentation, user manuals, testing methodology and plan, training plan, knowledge transfer and skills transfer approach.

Bidders must provide a detailed solution-architecture diagram demonstrating on-premises deployment within ATNS designated data centres, identifying storage, processing, and backup locations for security logs, incident data, telemetry, and forensic evidence. All security data must remain under ATNS control and within approved jurisdiction. For functionality, bidders must provide documentary evidence for SIEM functional capability (17 items), log collection and integration (8 items), and training (7 items), with screenshots, connector catalogues, integration guides, training plans, and skills transfer approach. Failure to provide supporting evidence results in zero for that criterion.

Company experience: minimum 3 contactable reference letters from enterprise clients confirming successful implementation and management of a SOC within the last 5 years. Reference letters must be on official letterhead, dated and signed by authorised representative, clearly confirm SOC implementation and management, include contact details for verification. Appointment letters, purchase orders, contracts, or award letters are not accepted as substitutes. Key personnel: at least 3 Tier-1 SOC Analysts and at least 2 Tier-3 SOC Analysts. Required certifications: CISM, CEH, OSCP, GCIH, GCIA, Global Information Assurance Certification, Computing Technology Industry Association Security+, Vendor SIEM Certifications – International Qualifications. Certifications must be valid on bid closing date. Tier-2 resources must demonstrate experience in security monitoring and incident triage; Tier-3 resources must demonstrate experience in incident response, threat hunting, and digital forensics. References must include contactable client details. Failure to submit valid and current documentation results in disqualification.

Quality requirements are embedded in functionality evaluation: SIEM functional capability (35 points) requires evidence of real-time log ingestion, correlation and analytics, deep packet inspection for OT protocols, custom rule creation, long-term log retention, advanced querying, automated triage, playbook-driven response, automated containment, safety-oriented workflows for CNS/ATM, threat intelligence feeds, IOC detection, aviation and OT-specific threat intelligence, threat hunting, behavioural analytics, and incident case management. Log collection and integration capability (35 points) requires screenshots, connector catalogues, and integration guides for syslog, APIs, cloud connectors, agent-based/agentless collection, secure log forwarding, passive OT traffic analysis, and ticketing integration. Training (30 points) requires as-built documentation approach, user manuals, testing methodology and plan, training plan, knowledge transfer plan, and skills transfer approach. Failure to provide supporting evidence results in zero for that criterion.

Pricing must be submitted on SBD 3.3 (Professional Services) and include all costs for the five-year period. The pricing schedule includes sections for Annual Licensing, Annual Managed Security, Support & Maintenance, Implementation, Administrator Training, and Response Training, with pricing required for each year of the five-year period and totals. Bids without a price or with incomplete pricing are non-responsive. Any budget amount indicated is a guide only; costing must be fair and reasonable. Offer must remain valid for 120 days from closing date.

Pricing must be submitted on SBD 3.3 (Professional Services) and include all costs for the five-year period, covering annual licensing, managed security, support and maintenance, implementation, administrator training, and response training. Bids without a price or with incomplete pricing are non-responsive. Budget indicated is a guide only; costing must be fair and reasonable. Offer valid for 120 days from closing date. Price evaluation uses the 80/20 preference point system (price 80 points).

CSD registration: mandatory; submit proof of registration or application. SARS Tax Compliance Status PIN: must be valid for the full validity period; submit PIN or printed TCS. B-BBEE: valid certificate or sworn affidavit (for EMEs/QSEs) required to claim preference points. CIPC documents, shareholder certificates, and ID copies of shareholders required for specific goals. Declaration of Interest: complete and signed. SBD 1: Invitation to Bid must be completed and signed. Compulsory briefing session attendance required. Company experience: minimum 3 contactable reference letters for SOC implementation/management within last 5 years. Key personnel: at least 3 Tier-1 and 2 Tier-3 SOC Analysts with specified certifications (CISM, CEH, OSCP, GCIH, GCIA, Security+, vendor SIEM).

Safety is a core value: 'Safety and Customer Centricity: Prioritising customer needs and ensuring that safety is non-negotiable'. The SOC must include safety-oriented workflows for CNS/ATM systems. No specific OHS plan or HSE compliance documents are required beyond this.

The document mentions 'economic, social, and environmental sustainability' as a general principle but provides no specific environmental requirements or sustainability criteria for this tender.

ATNS accepts no liability for accuracy of the brief; bidders rely on their own judgment. ATNS may vary scope and terms with written notice. Successful bidder must accept standard terms and conditions, including retention for non-satisfactory completion, breach, confidentiality, and professional indemnity insurance. ATNS may withdraw from commitments if circumstances dictate. All designs and documentation submitted are confidential. ATNS may reject, withdraw, or cancel any proposal, negotiate with one or more bidders, and is not obliged to accept the lowest bid. Contract concluded only when formal contract and SLA signed by both parties. ATNS may award one contract for all functions or multiple contracts. Bids may be rejected for proven corruption or fraud, abuse of SCM system, or failure to perform on previous contracts. Additional information may be requested; responses due within 7 working days. Bidders must keep bid information confidential. Copyright of documentation belongs to ATNS; no disclosure without written approval. Contractor must notify ATNS immediately if unable to deliver on time or at quoted price. On termination, bidder must hand over all documentation and deliverables without right of retention. Amendments must be in writing and signed. CSD registration mandatory before award. Proposals should be concise, in plain English, and follow prescribed format.

Additional evaluation criteria: Functionality scoring per criterion: SIEM Functional Capability (35 points) - all 17 documents = 35, 13-16 = 28, 9-12 = 20, 5-8 = 12, no evidence = 0. Log Collection and Integration Capability (35 points) - all 8 requirements = 35, 6-7 = 26, 4-5 = 5, 2-3 = 9, 1 = 4, no evidence = 0. Training (30 points) - all 7 requirements = 30, 5-6 = 23, 3-4 = 15, 1-2 = 8, no evidence = 0. Minimum qualifying threshold for functionality is 70 points out of 100. Bidders scoring less than 70 will not be considered. Bidders scoring zero on any individual criterion will not be evaluated further. Bids not covering all required elements will be deemed non-responsive. Evaluation based strictly on information submitted; no assumptions made.