Comprehensive cybersecurity programme for PRASA: maturity assessment, architecture review, vapt, ot/it integration, strategy, roadmap & automated grc platform

PRASA seeks a service provider to deliver a comprehensive cybersecurity programme for its critical rail infrastructure. The scope includes: Enterprise Cybersecurity Maturity Assessment (NIST CSF 2.0), Security Architecture Review (SABSA, Zero Trust), Vulnerability Assessment and Penetration Testing (VAPT), Critical Asset Configuration Review, IT/OT Integration Testing, OT Site Assessments (3 sites), Cybersecurity Strategy and Roadmap (3-year), CISO Execution Support, and an Automated GRC Platform. The programme addresses risks from IT/OT convergence, legacy systems, and emerging threats (e.g., ransomware) while ensuring compliance with POPIA, Cybercrimes Act, and NCPF. The goal is to establish a robust, evidence-based cybersecurity capability aligned to rail operations and OT environments.

Closing date: 14 July 2026 at 10:00 AM. Key milestones: Contract signature and kick-off (Week 1), Inception Report and PMP accepted (End of Week 2), Rules of Engagement signed (End of Week 3), Maturity assessment evidence collection complete (End of Week 6), Active testing complete (End of Week 10), OT Site Assessments complete (End of Week 11), Draft Strategy and Roadmap issued (End of Week 13), Final Strategy and Roadmap accepted (End of Week 15), Board presentation delivered (Week 16), Programme close-out accepted (Week 16).

Submit all required documents as specified in the RFQ. Ensure all declarations and Standard Bidding Documents (SBDs) are duly completed and signed where required. Follow the formal deliverable acceptance process: (i) issue deliverables in draft, (ii) PRASA reviews and provides feedback within 10 business days, (iii) submit revised version addressing feedback, (iv) PRASA accepts in writing or escalates to the Cybersecurity Steering Committee. Failure to achieve acceptance within two revision cycles triggers an issue under the contract's Issue Management process.

Scope includes nine mandatory workstreams: 1) Enterprise Cybersecurity Maturity Assessment (NIST CSF 2.0, ISO/IEC 27001:2022, COBIT 2019), 2) Security Architecture Assessment (SABSA, Zero Trust, Purdue Enterprise Reference Architecture), 3) Vulnerability Assessment and Penetration Testing (VAPT) across external/internal networks, web/mobile/API applications (CREST, OWASP methodologies), 4) Critical Asset Configuration Review (CIS Benchmarks, NIST SP 800-53, CSA CCM v4), 5) IT/OT Secure Integration Test (Purdue, IEC 62443, NIST SP 800-82), 6) OT Cybersecurity Assessment (3 sites, IEC 62443, passive techniques), 7) Cybersecurity Strategy and Roadmap (3-year strategy, 18-36 month roadmap), 8) CISO Execution Support (governance instruments, 90/180-day plans), 9) Automated GRC Platform (multi-framework compliance, risk registers, FAIR quantification). Out of scope: implementation of security tools (except GRC platform), SOC/MDR operations, red teaming, active testing on safety-critical OT systems.

Bidder must respond to all nine workstreams with clear methodologies, named teams, indicative effort, and expected deliverables. Key methodologies: Workstream 1 (NIST CSF 2.0 maturity scoring 0–5 scale, evidence under chain-of-custody); Workstream 2 (SABSA, NIST SP 800-207 Zero Trust, Purdue Enterprise Reference Architecture); Workstream 3 (CREST, OWASP WSTG v4.2, MASVS/MASTG, API Security Top 10 2023, MITRE ATT&CK); Workstream 4 (CIS Benchmarks, NIST SP 800-53/171/207, CSA CCM v4); Workstream 5 (Purdue, IEC 62443-3-2/3-3, NIST SP 800-82); Workstream 6 (IEC 62443-2-1/3-2, passive traffic analysis, Permit-to-Work). All work must be traceable to international standards and South African regulations.

Mandatory key personnel and minimum credentials: Engagement Director (18 years cyber, 8 years client-facing, CISSP + CISM/CRISC, led multisite critical infrastructure programmes); Lead Consultant - Strategy & Maturity (15 years cyber advisory, CISSP/CISM, lead-author on ≥3 NIST CSF assessments, degree in Computer Science/Engineering/Information Systems, SSA Vetted); Penetration Testing Lead (12 years offensive security, CREST CCT App/Inf or OSCE3/OSCP+OSWE/OSEP, led large-scale VAPT programmes); OT/ICS Cybersecurity Lead (12 years industrial environments, 6 years OT cyber, GICSP/IEC 62443 Cybersecurity Expert, ≥2 operational OT assessments in rail/energy/oil & gas/utilities/transport); Security Architecture Lead (12 years, SABSA Chartered SCF/SCP or TOGAF, CCSP/hyperscaler Security Specialty, Zero Trust experience); Cloud Security Lead (10 years cyber, 5 years cloud, CCSK/CCSP, AWS Security Specialty, Microsoft SC-100/AZ-500, CIS/CSA CCM experience); GRC & Compliance Lead (12 years GRC/audit, CISA + CRISC/ISO 27001 Lead Implementer/Auditor, POPIA/King IV/NIST CSF alignment); Project Manager (10 years, PMP/PRINCE2 Practitioner, critical infrastructure cyber programme delivery, full-time allocation).

Bidder must operate a documented quality management approach: named Quality Assurance Lead (independent of delivery team) reviews all external deliverables; compliance with ISO 9001:2015; defined acceptance criteria per deliverable; internal peer review and sign-off before submission; lessons-learned capture at each phase gate. Deliverable acceptance process: draft submission → PRASA feedback (10 business days) → revised submission → formal acceptance. Failure to achieve acceptance within two revision cycles triggers an issue under the contract.

Pricing structure: Stage 3 evaluation (Price 80 points, Specific Goals 20 points). Bid must include: detailed cost breakdown for all nine workstreams; CapEx/OpEx envelopes by year; indicative investment plan with sensitivity analysis; quick-wins package (90-day initiatives); Year-One Execution Plan costs. Optional components (e.g., Breach and Attack Simulation) must be separately priced. Payment milestones: tied to deliverable acceptance (e.g., Inception Report, PMP, RoE, Strategy/Roadmap, GRC platform handover). Final payment contingent on operational handover and training completion (e.g., GRC platform administrator readiness).

Pricing evaluation: Price (80 points), Specific Goals (20 points). Bid must include indicative costs for all workstreams, with CapEx/OpEx breakdowns, sensitivity analysis, and financial envelopes by year. Payment is contingent on deliverable acceptance and operational handover (e.g., GRC platform training completion).

Mandatory compliance: ISO/IEC 27001:2022 certification for handling PRASA data, IEC 62443/OT cybersecurity capability (e.g., GICSP, ISA/IEC 62443 certifications). Regulatory alignment: POPIA, Cybercrimes Act, National Cybersecurity Policy Framework (NCPF), King IV, NIST CSF 2.0, ISO/IEC 27001:2022. Data protection: POPIA compliance, AES-256 encryption at rest, TLS 1.2+ in transit, data residency in South Africa, secure destruction of data post-engagement. Safety: ISO 45001:2018 OH&S management system, Permit-to-Work, PPE, Occupational Health and Safety Act compliance.

All on-site work (Workstreams 5, 6, or physical visits) must comply with PRASA's SHEQ regime. Requirements: documented OH&S management system aligned to ISO 45001:2018; valid Public Liability and Professional Indemnity insurance; PPE (high-visibility clothing, safety footwear, eye protection); Permit-to-Work, Site Induction, and Safety Briefing compliance; adherence to Occupational Health and Safety Act. Safety-critical constraint: No active/intrusive testing on safety-critical OT systems (signalling, traction, brake, train protection) without explicit written authorisation from Group COO, Engineering Executive, OEM, and CISO. Assessment limited to passive observation, design/configuration review, and procedural review under Permit-to-Work.

Environmental considerations are implicit in PRASA's operational context. Bidder must ensure: data residency compliance (certain data classes may be required to remain in South Africa); secure handling of evidence and findings (AES-256 encryption at rest, TLS 1.2+ in transit); minimal disruption to operations during testing; adherence to PRASA's SHEQ requirements for on-site work. No explicit environmental deliverables are specified, but sustainability and risk mitigation are embedded in the guiding principles (e.g., safety-first, evidence-driven).

Contract duration: 12 months (6 months core delivery + 6 months handholding). Governance structure: Tier 1 (Executive Sponsorship: Group CEO, GCIO), Tier 2 (Cybersecurity Steering Committee: chaired by GCIO, bi-weekly/weekly meetings), Tier 3 (Programme Delivery Forum: weekly, daily stand-ups during testing). RACI: PRASA CIO accountable for scope confirmation, RoE approval; bidder responsible for methodology, evidence collection, deliverable production. Intellectual property: PRASA owns all deliverables; bidder retains rights to generic methodologies. Confidentiality: POPIA compliance, NDAs, encrypted repositories (AES-256), data residency in South Africa. Risk management: Programme Risk Register and Issue Log maintained; critical risks notified within 4 hours.

Evaluation is multi-stage: Stage 1A (Mandatory Compliance - Substantive Responsiveness), Stage 1B (Basic Compliance - Administrative Responsiveness), Stage 2 (Technical/Functionality), Stage 3 (Pricing 80 points, Specific Goals 20 points). Mandatory requirements: completed RFQ documentation, ISO/IEC 27001:2022 certification, OT cybersecurity capability (IEC 62443/GICSP). Technical evaluation assesses alignment with guiding principles: standards-led (NIST, ISO, IEC), risk-based prioritisation, evidence-driven findings, safety-first (SHEQ compliance), minimal disruption, knowledge transfer, and defensible execution. Out of scope: tool implementation (except GRC), SOC/MDR operations, red teaming, active testing on safety-critical OT systems.