FOSRBY-RFP-02-26/27 request for proposal [RFP] for the provision of managed cybersecurity services for a period of sixty (60) months

• General description: This RFP seeks a Managed Security Services Provider (MSSP) to deliver comprehensive cybersecurity services for 60 months.
• Objective: Strengthen Foskor's cybersecurity operations through outsourced 24/7 monitoring, threat detection, incident response, vulnerability management, and security awareness training.
• Business goals: Achieve round-the-clock monitoring, advanced threat detection, bridge talent gap, vulnerability/risk management, compliance readiness, cost efficiency, and support for Operational Technology (OT) resilience.
• The MSSP will act as an extension of Foskor's ICT function or as a fully outsourced SOC.

• Closing date and time: 28 July 2026 at 12h00.
• Briefing session: Non-compulsory, held on 07 July 2026 from 09h30 to 11h00 via Microsoft Teams.
• Clarification deadline: Submit queries to Nana Ndlovu by 12h00 on 21 July 2026.
• Bid validity period: 180 business days from the closing date.

• Procurement/SCM Contact: Nana Ndlovu.
• Email: [email protected] (for technical enquiries) and [email protected] (for submission).
• Telephone: 0359023235.
• Physical submission address: Foskor (Pty) Ltd, 21 John Ross Highway, Richards Bay, 3900.
• Electronic submission email: [email protected].

• Submit bids by the closing date and time: 28 July 2026 at 12h00. Late bids will not be considered.
• Submission methods: Physical delivery to Foskor (Pty) Ltd, 21 John Ross Highway, Richards Bay, 3900 OR email to [email protected] (PDF format, max 5 MB).
• All returnable documents listed in the RFP must be submitted. Failure to submit mandatory documents results in disqualification.
• Mandatory returnable documents include: Pricing Schedule (fully completed), evidence of ISO/IEC 27001 certification.
• Returnable documents used for scoring include: Proposed solutions for deliverables (Annexure 3), project implementation plan, sample IR Playbook, sample incident report, client references, CVs with certifications, evidence of SOC 2 Type II and SIEM platform certifications.
• Essential returnable documents include: Joint Venture agreement (if applicable), latest financial statements, SBD1 form, Proposal Form, Certificate of Acquaintance, RFP Declaration, B-BBEE Preference Points claim form, CSD registration report.
• All returnable sections must be signed, stamped, and dated on each page.
• Bids must be submitted on official forms, not retyped. Any additional conditions must be in a covering letter.
• Alterations to bid prices must be initialled by the signatory.
• Bids are valid for 180 business days from the closing date. Foskor may request an extension.
• Post-closing communication only with the General Manager Procurement.
• Unauthorised canvassing of Foskor officials is prohibited and may lead to disqualification and blacklisting.

Bidder must submit proof of ISO/IEC 27001 certification for SOC/SIEM services; must be registered on National Treasury's Central Supplier Database (CSD); must be tax compliant; must achieve minimum technical score of 70%; must submit all mandatory returnable documents; must have a South African office or representative if foreign-based; must comply with Foskor's Integrity Pact and General Bid Conditions.

Scope: Provision of Managed Cybersecurity Services for 60 months.

Key Deliverables:

• 24/7/365 Security Monitoring via a SOC: Includes skilled personnel, technology, processes, secure premises.
• SIEM Platform Management: Monitor existing security, network, cloud, infrastructure; integrate log sources (Annexure 1); migrate up to 12 months historical logs.
• Honeypots: Implement at least three; design to avoid operational risk.
• Dark Web Monitoring: Proactive monitoring for leaked data, credentials, discussions.
• Advanced Analytics: AI-powered tools for real-time threat detection.
• Incident Detection and Response: Automated quarantine, SOAR, coordination with Foskor ICT, annual cyber-attack simulations, incident response playbooks.
• Vulnerability & Risk Assessments: Vulnerability scanning (Foskor uses Tenable One; MSSP provides interpretation, prioritisation, reporting), annual security assessments (external/internal penetration tests, VPN, network, web app, AD, password, domain, cloud).
• Cybersecurity Awareness Training: Provision and administration of platform, scheduling modules, phishing testing, reporting.
• Ad-hoc Services: Consulting, forensic investigations, incident response planning (subject to separate quotation).
• Reporting and Compliance: Periodic reports (weekly, monthly), log retention (1 year hot storage, 5 years archival), support for POPIA, Cybercrimes Act, ISO/IEC 27001, NIST CSF.
• Governance and Service Management: Bi-weekly/monthly service reviews, SLA reporting, continuous improvement.
• Service Level Agreements and KPIs: Defined SLAs with credits for misses. KPIs include SOC availability ≥99.97%, alert acknowledgement times (critical ≤15 min), log ingestion success ≥98%, MTTD <30 min, MTTR <2-4 hours, vulnerability remediation within 48hrs (critical assets) or 14 days (non-critical).

• Pricing format: Submit total bid price and detailed pricing breakdown per year (Year 1 to Year 5) as per pricing model in Scope of Work.
• Pricing components: 24/7 monitoring and detection (SOC/SIEM), Incident Response, Vulnerability Management, Security Assessments, Security Awareness Training, Implementation/onboarding, Project Management, Training, Software License subscription, Maintenance.
• Ad-hoc support costing: Provide hourly rates for Forensic Investigations, Consulting, Cyber incident response, Formalise/test Incident Response Plans.
• Prices must be quoted in South African Rand (ZAR), inclusive of VAT.
• Prices are to be quoted on a delivered basis.
• Firm prices for contract duration are preferred; if fixed for 12 months only, provide price adjustment formula.
• Conditional discounts only considered if unconditional.
• For imported content, specify exchange rate used (SARB rate on advertisement date).
• Payment terms: Within 30 days of receipt of a correct statement/tax invoice.
• Foskor may require a performance bond/security; amount to be stipulated.

• Mandatory Certification: Bidders' SOC and SIEM services must be certified against ISO/IEC 27001. Submit evidence.
• Tax Compliance: Must be tax compliant; submit Tax Compliance Status PIN or CSD number. Foreign suppliers must declare tax liability in RSA.
• Central Supplier Database (CSD): Registration required for local entities.
• B-BBEE: Submit B-BBEE Preference Points Claim Form. Preference points awarded based on B-BBEE status level.
• Legal Requirements: Comply with all applicable laws, including Employment Equity Act.
• Joint Ventures: If applicable, submit agreement or written confirmation with percentage split.
• Foreign Suppliers: Must have authorised South African representative with Power of Attorney.
• Blacklisting: Grounds include bad faith withdrawal, failure to sign contract, unsatisfactory performance, bribery, fraudulent statements, litigation in bad faith.

• Additional evaluation criteria details: Technical evaluation weighting is 100%, minimum threshold 70%.
• Scoring details: Understanding of Scope scored via Annexure 3 (Yes/No responses, max 40 points divided by 2 for final 20%).
• References scored: 0% for 0 letters, 2% for 1, up to 10% for 5 letters.
• Certifications scored per role submission: 0%, 2.5%, or 5% per role based on number of submissions.
• Employee experience scored: 5% (<5 years), 10% (6-10), 15% (11-15), 20% (16+).
• Price evaluation formula provided for scoring 80 points.
• B-BBEE scoring based on status level per table in claim form.
• Post-tender negotiations may occur if price is not market-related.