Corporate threat assessment services for the south african civil aviation authority (SACAA)

Closing date: 05 October 2026 at 11:00.

No briefing or site visit mentioned.

Bidding procedure enquiries:

• Contact: Rudolph Mohlala
• Telephone: 011 545 1720
• Email: [email protected]

Technical enquiries:

• Contact: Rudolph Mohlala
• Telephone: 011 545 1720

Office park access code:

• Betty Monyeki: 082 885 4270
• Cynthia Motaung: 083 461 6534

Submission address:

South African Civil Aviation Authority

BYLS Bridge Office Park

Olievenhoutbosch Road & Jean Ave

Centurion, 0062

Submission method: sealed envelope/package deposited in Tender Box 1 at the SACAA head office foyer.

Address: South African Civil Aviation Authority, BYLS Bridge Office Park, Olievenhoutbosch Road & Jean Ave, Centurion, 0062.

Closing: 05 October 2026 at 11:00.

Three-envelope system:

• Envelope 1: All mandatory documents (Phase 1).
• Envelope 2: Technical proposal (1 original and 1 copy).
• Envelope 3: Pricing schedule (1 original and 1 copy), separate from technical proposal.

Documents must be neat and bound; SACAA not responsible for loss.

Mark envelope with RFQ reference number and bidder company name.

Returnable forms (all must be completed and signed):

• SBD 1 (Invitation to Bid): cover page with bidder details.
• SBD 4 (Bidder's Disclosure): declares any state employment or connections.
• SBD 6.1 (Preference Points Claim): claims B-BBEE points.

Disqualification risks:

• Late submission (after 11:00 on closing date).
• Incomplete or unsigned forms.
• Failure to obtain office park access code (arrange with Betty Monyeki or Cynthia Motaung).

Evaluation stages:

1. Phase 1 – Mandatory compliance: CSD registration, SBD 1, SBD 4, SBD 6.1.
2. Phase 2 – Functionality (minimum qualifying score: 80/100).

• Company References (max 30): 5 letters = 30, 4 = 20, 3 = 10. Letters must be dated, signed, on client letterhead, with contact details, for corporate threat assessment services in the last 3 years.
• Ability to Conduct Penetration Testing (max 50): CEH (10), OSCP (10), CISSP (10).
• Technical Approach and Methodology (max 20): detailed methodology for internal and external penetration testing.

3. Phase 3 – Price and Specific Goals (80/20 system):

• Price: 80 points, formula Ps = 80(1 - (Pt - Pmin)/Pmin).
• Specific Goal (B-BBEE level): Level 1 = 20, 2 = 18, 3 = 14, 4 = 12, 5 = 5, 6 = 6, 7 = 4, 8 = 2, Non-compliant = 0.

Scope: Comprehensive Corporate Threat Assessment across SACAA's entire IT environment, including internal networks, external-facing systems, web applications, cloud platforms, business critical assets, and associated digital infrastructure.

Frameworks: ISO/IEC 27001, OWASP Top 10 (2025), NIST SP 800-115.

Deliverables:

• Detailed threat analysis report with risk ratings, remediation recommendations, and prioritised mitigation roadmap.
• Three presentations/reports: Management, Exco, Audit and Risk Committee (ARC).
• Remediation assessment for critical and high-priority findings.

Testing scope:

• Internal network: 800 active IP addresses, 700 workstations, 80 servers.
• External: 20 websites.
• Wireless security test.
• Web application testing per OWASP (injection, broken authentication, sensitive data exposure, XXE, broken access control, security misconfiguration, XSS, insecure deserialization, known vulnerable components, insufficient logging/monitoring).
• CIS controls validation.
• Grey box testing: limited information provided (physical access, IP ranges, website URL).
• Internal assessment: attempt to bypass perimeter first; if unsuccessful, standard network access given.

Service duration: once off.

Bidder must provide detailed methodology for internal and external penetration testing. Testing approach: grey box, with internal assessment attempting perimeter bypass first. Deliver three audience-specific presentations and a remediation assessment.

Bidder must be suitably qualified and experienced. Provide contactable reference letters from clients for corporate threat assessment services in the last 3 years (5 letters for full points).

Testing must follow OWASP framework covering listed vulnerabilities. Certifications required: CEH, OSCP, CISSP.

Pricing schedule must be submitted separately (Envelope 3) with detailed breakdown.

No bid security, bonds, guarantees, or payment terms specified.

Mandatory:

• CSD registration (supplier number required).
• Tax compliance: SARS PIN or TCS certificate; each consortium/JV/subcontractor party must submit separate.
• SBD 1, SBD 4, SBD 6.1 completed and signed.
• B-BBEE certificate or sworn affidavit (for EMEs/QSEs) to claim preference points.
• No bids from persons in service of the state or companies with such directors/members.
• Proof of authority (e.g., company resolution) for signatory.

Service is once off. Contract subject to GCC and PPPFA. Successful bidder must sign SBD 7 (Contract Form).

Functionality evaluation: references (max 30), penetration testing certifications (max 50), technical approach (max 20). Minimum 80/100 to proceed. Price and specific goals: 80/20 system.