Renewal of fortinet ngfw and fortiidentity cloud licences, subscriptions, oem support and maintenance – cipc bid 12/2026/2027

CIPC requires the renewal of its existing Fortinet Next-Generation Firewall (NGFW) and Forti-Identity Cloud licences, subscriptions, OEM support and maintenance for 12 months. The scope strictly excludes new hardware, replacement, migration or implementation of new security platforms. Renewals must maintain current security capabilities, ensure continued threat intelligence and software updates, and be activated against existing appliances and cloud tenant. The successful bidder must provide proof of renewal, technical support, and training for 5 CIPC personnel.

Closing date: 26 November 2026 at 11:00

• No briefing session or site visit is scheduled.
• Bids must be delivered to the correct Tender Box before closing time; late proposals are not accepted.

Supply chain enquiries

• Contact: Mr Solomon Motshweni
• Role: Supply Chain
• Email: [email protected]
• Telephone: 087 743 7103

Technical enquiries

• Contact: Mr Alfred Sekhula
• Email: [email protected]
• Contact: Mr Solly Bopape
• Email: [email protected]
• Contact: Mr Andile Stulo
• Email: [email protected]

Submission address

Manager (Supply Chain Management)

Cipc

Block F, the DTIC Campus

77 Meintjies Street

Sunnyside

Pretoria

Submission method and pack

• Deliver sealed bids to the CIPC Tender Box at the West Gate, close to the Entfutfukweni Building (Block F), 77 Meintjies Street, Sunnyside, the DTIC Campus, Pretoria.
• Address the envelope to: Manager (Supply Chain Management), CIPC, Block F, the DTIC Campus, 77 Meintjies Street, Sunnyside, Pretoria.
• One original hard copy of the technical proposal: every page numbered, signed by an authorised representative, and initialled on each page.
• One USB containing both the technical proposal and price proposal in separate folders. USB must be PDF, read-only, not password protected, include a table of contents, and carry the bidder's name. The USB is used for evaluation; CIPC is not liable for incomplete content.
• One sealed price envelope marked with the bidder's name, containing: Pricing Schedule SBD 3.3, SBD 1 (Invitation to Bid), and a price breakdown on the bidder's letterhead signed by an authorised representative.
• The total bid (ceiling price) must be carried to both SBD 3.3 and SBD 1.

Returnable forms (all must be completed and signed)

• SBD 1 (Invitation to Bid): the offer cover page.
• Tax Clearance Certificate PIN (TCS PIN) for verification of tax compliance; original TCC required where the quotation exceeds R30 000 (VAT incl.). Certified copies are not acceptable.
• SBD 4 (Declaration of Interest): discloses state employment or connections to the institution.
• SBD 6.1 (Preference Points Claim): claims B-BBEE points; non-submission scores zero.
• SBD 8 (Declaration of Bidder's Past Supply Chain Management Practices).
• SBD 9 (Certificate of Independent Bid Determination): certifies no collusion or price disclosure.
• Proof of CSD registration (CSD report) with supplier and unique reference numbers.
• Fortinet OEM authorisation letter or partner certification, signed, dated, showing validity, identifying the bidder and confirming ability to renew licences/subscriptions and provide OEM support.

Disqualification risks

• Late or incomplete submissions, bids in the wrong box, unsigned or missing returnable forms, missing OEM letter, USB not in PDF/read-only/password protected, prices not VAT inclusive or quoted in a foreign currency, prices not valid for 90 days, or failure to comply with any submission requirement.
• Tenders deposited in the wrong box will not be considered.

Evaluation phases

• Phase 1: Compliance and mandatory requirements (documents and OEM letter). Bidders failing any mandatory item are disqualified.
• Phase 2: Functional evaluation, scored out of 100 points. Minimum qualifying score: 60/100. Bidders scoring below 60 are disqualified.
• Phase 3: Price and preferential procurement under the 80/20 system.

Functional criteria (total 100 points)

• Licence renewal, support and service approach: 50 points — approach to renewing Fortinet NGFW and Forti-Identity Cloud licences, uninterrupted continuation, activation/validation, OEM support and escalation, technical support, proof of renewal. Higher ratings require integration with CIPC environment, training, knowledge transfer, hardened OS, alerts and rule customisation.
• Accreditation with OEM: 15 points — valid Fortinet partner certification or OEM authorisation letter; higher ratings for expert or regional partner certification with OEM confirmation and escalation access.
• Reference letters and testimonials: 15 points — at least two relevant client references on formal letterhead with working contact details; more references score higher. CIPC may verify.
• Technical certification: 20 points — CVs for a minimum of two technical resources with Fortinet certifications; more certifications (NGFW, FortiADC, FortiAnalyzer, FortiManager) score higher.

Price and preference points

• Price: 80 points — lowest price scores full marks; others scored proportionally.
• B-BBEE: 20 points — claimed via SBD 6.1; non-submission scores zero.
• Preferential Procurement Regulations 2001 and the 80/20 system apply.

Scope

• Renewal of existing Fortinet Next-Generation Firewall (NGFW) and Forti-Identity Cloud licences, subscriptions, OEM support and maintenance for 12 months.
• Not for acquisition, replacement, migration or implementation of new hardware or security platforms. Scope limited to the existing deployed environment.
• Activate renewals against existing appliances, serial numbers and cloud tenant; maintain continuity without loss of configuration or security policies.
• Provide proof of licence activation, entitlement and expiry dates.
• Provide technical support and OEM escalation.
• Provide training (virtual or classroom) for 5 CIPC ICT security personnel.

Bill of Material (quantities)

• FortiADC 1200F licences/support: 2 of each service (Advanced Malware Protection, IPS, FortiSandbox, IP Reputation, Credential Stuffing, WAF, Premium Web/Comprehensive Support, Return and Replace, OS/Firmware Updates).
• FortiAnalyzer-VM: 20 of each (IOC subscription, VM licence, Premium Web/Comprehensive Support, Security Automation, Outbreak Alert, OS/Firmware Updates).
• FortiGate 3201F: 2 of each service (Advanced Malware Protection, IPS, Web/URL/DNS/Video Filtering, AntiSpam, Attack Surface, FortiConverter, Premium Web/Comprehensive Support, Return and Replace, AI-based Malware Prevention, DLP, OS/Firmware Updates).
• FortiGate 601F: 2 of each service included in the BOM.
• FortiManager-VM: 10 of each (VM licence 10 devices/VDOMs, Premium Web/Comprehensive Support, OS/Firmware Updates).
• Forti-Identity Cloud License Renewal: 900.

Training

• FortiOS Administrator 4-day instructor-led: 5
• FCP Certification Exam Voucher (compulsory): 5
• FortiADC Administrator 3-day instructor-led: 5
• FortiAnalyzer Administrator and Analyst: 5
• FortiManager Administrator instructor-led: 5
• Exam vouchers for each course: 5 each

Working conditions

• Reporting: bidder's account manager reports to the CIPC Process Owner.
• Proprietary rights over deliverables belong to CIPC; final products handed over at service end.
• Indemnity for losses, damages, and claims arising from service delivery, including IP violations.
• Quality: Senior Manager: Information Assurance controls quality; if below standard, the service provider must replace the resource at its own cost.

The bidder must present a licence renewal, support and service approach covering: renewing Fortinet NGFW and Forti-Identity Cloud licences, uninterrupted continuation of entitlements, activation and validation, OEM support and escalation, licence expiry management, technical support, and proof of renewal. The approach is evaluated for quality of solution design, integration with CIPC's environment, training and certification, knowledge transfer, and customisation of rules and alerts. A detailed project plan and schedule with activities, time frames, deliverables and budget breakdown is required.

Pricing must be submitted in a sealed envelope with SBD 3.3, SBD 1, and a price breakdown on company letterhead. The total ceiling price must be carried to both SBD 3.3 and SBD 1. Prices must be fixed, VAT inclusive, in South African Rand, valid for 90 days, and cover all costs for the full 12-month contract. A bill of quantities with unit costs is required. No pricing for new hardware, implementation, migration or replacement is allowed. Payment is linked to deliverables, no advance payment.

Pricing format

• Complete Pricing Schedule SBD 3.3 (Annexure C) and carry the total ceiling price to both SBD 3.3 and SBD 1.
• Price must be a fixed quotation for the 12-month contract, inclusive of all costs, VAT, and quoted in South African Rand.
• Prices valid for 90 days.
• A bill of quantities with unit costs must be submitted; price breakdown on company letterhead required.
• Pricing must cover only renewal requirements in the TOR; no pricing for new hardware, implementation, migration or replacement.
• Additional support hours: 1 200 hours (as an example deliverable).
• No advance payment; payment per deliverables under the PFMA prescribed period.
• CIPC reserves the right to negotiate price with the successful bidder.
• Service provider bears all associated costs such as transport and disbursements. Travel costs are not for CIPC's account.

Mandatory compliance (Phase 1)

• Tax Clearance Certificate (TCC) PIN for verification; original TCC required for quotations above R30 000 (VAT incl.), certified copies not accepted.
• CSD registration proof with supplier and unique reference number.
• Fortinet OEM authorisation or partner certification (valid, identifying bidder, confirming ability to renew and provide support). Missing OEM letter disqualifies.
• Returnable forms: SBD 1, SBD 4, SBD 6.1, SBD 8, SBD 9 — all must be completed and signed.

Contractual compliance

• Government Procurement General Conditions of Contract (GCC) apply.
• No work before an official CIPC Purchase Order is received.
• Successful bidder must sign a Declaration of Secrecy and a confidentiality agreement regarding CIPC information. All information, documents, programs and reports are confidential.
• Successful bidder must sign a Service Level Agreement before contract commencement.
• Compliance with PFMA safeguarding of assets and access control; measures specified in the SLA.
• Resources must be available immediately to commence work from date of notification; failure to commence immediately could invalidate the proposal.
• Fraud/corruption: engaging in corrupt, fraudulent, unfair trade or coercive practices leads to rejection, ineligibility for award, or contract termination with 10 business days' notice.

No specific occupational health and safety requirements are stated. Service providers must follow CIPC security measures and rules, and comply with government safety legislation.

Contract term

• Twelve (12) months from effective commencement date.
• Renewals must be activated before existing entitlements expire; renewal and activation plan required.

Payment

• No advance payment; payment per deliverables within PFMA periods.

Confidentiality and IP

• All information provided by CIPC is confidential; cannot be disclosed without the Commissioner's written consent.
• Successful bidder must sign a Declaration of Secrecy; all CIPC information becomes CIPC property at contract end or termination.
• Proprietary rights to work products belong to CIPC.

SLA

• Successful bidder must sign a Service Level Agreement before commencement; SLA must cover security measures for safeguarding assets and access control.

Termination

• CIPC may terminate with 10 business days' notice for perceived reputational risk due to unethical behaviour.
• CIPC may declare a bidder ineligible for corrupt, fraudulent or unfair trade practices.

General conditions

• GCC (Government Procurement General Conditions) apply.
• No services before an official Purchase Order.
• Travel costs and disbursements are not for CIPC's account unless agreed in writing.
• CIPC reserves the right to negotiate price and to split or cancel the award.

The bidder must provide an assurance/guarantee of integrity and safe keeping of CIPC information (no amendment, corruption, distribution, storage or copying) during and after the contract. CIPC may negotiate price. Travel costs are not for CIPC's account unless agreed in writing. The GCC applies. No advance payment; payment per deliverables under PFMA. Prices must include VAT. All CIPC information is confidential and cannot be disclosed without the Commissioner's consent. Successful bidder must sign a Declaration of Secrecy and Service Level Agreement before commencement. Immediate commencement is critical; failure could invalidate the proposal. CIPC may terminate with 10 business days' notice for unethical behaviour.

Evaluation is in three phases: Phase 1 compliance (mandatory documents and OEM letter), Phase 2 functional (out of 100, minimum 60 to proceed), Phase 3 price and preference (80/20). Functional criteria: licence renewal approach 50, OEM accreditation 15, reference letters 15, technical certifications 20. Price is scored from lowest quote; B-BBEE 20 points. Bidders failing mandatory documents are disqualified immediately.