Provision of thinkst canary decoy/honeypot system and support services for the road accident fund

Tenderers must complete the Preferential Procurement Regulations 2022 preference points claim form. Must provide proof of compliance for specific goals (e.g., HDI, Women, Persons with Disability) to claim points. Fraudulent claims may result in disqualification, cost recovery, contract cancellation, business restrictions for up to 10 years, or criminal prosecution.

The Road Accident Fund (RAF) seeks to appoint an accredited reseller, implementer, or support partner of Thinkst Canary to provide a Decoy/Honeypot System and Support Services for a two-year period. The solution must include licenses, management components, and Decoy/Honeypot assets with a centralised management platform.

Closing date: 23 July 2026 at 15:00. RFQ validity period: 30 days from closing date. Expected service start: Two-year agreement from date of last signatory.

Enquiries: Email [email protected] or contact Ntsako Baloyi at 012 649 2023. Submission address: RAF Head Office, 420 Witch Hazel Avenue, Centurion, Eco Glades, Pretoria, 0046.

Submit all RFQ responses via email to: [email protected]. Late submissions will not be accepted. Complete and sign all Annexures (Standard Bidding Documents and Mandatory Evaluation documents). Suppliers with disabilities must provide a valid medical certificate. Only CSD-registered suppliers will be considered. Collusive bidding or multiple submissions from related entities will result in disqualification. No gifts, hospitality, or benefits may be offered to RAF officials; report any solicitation to 0800 005919 or risk disqualification.

Must supply, implement, configure, and support a Thinkst Canary Decoy/Honeypot System with all required licenses and a centralised management platform. Key deliverables: Real-time detection and alerting for unauthorised access, network reconnaissance, privilege escalation, lateral movement, insider threats, malware, and ransomware. High-fidelity alerts with minimal false positives. Centralised dashboards and reporting for security events, threat activity, and system health. Integration with Microsoft Sentinel SIEM and Microsoft Entra-ID/Active Directory. Threat intelligence aligned to MITRE ATT&CK framework. Detailed audit logs. Regular software updates, patches, and threat intelligence updates. Knowledge transfer, administrator training, and operational documentation. Support for multiple Decoy/Honeypot types (endpoint, server, database, application, Active Directory, network service, credential). Technical support and maintenance, including incident response and vendor escalation.

Prices must be VAT-inclusive (if VAT-registered) and quoted in ZAR. VAT vendors must include VAT; failure to do so means the quoted price is deemed all-inclusive. Non-VAT-registered suppliers charging VAT will be disqualified. Only prices in the provided cost breakdown table will be evaluated; missing prices lead to disqualification. No price changes allowed after Award Letter/PO issuance. Ad-hoc services must be quoted with rates inclusive of VAT (if applicable).

Must be an accredited reseller, implementer, or support partner of Thinkst Canary. Submit a valid Accreditation Certificate or Letter of Accreditation from the OEM by closing date. CSD registration is mandatory. Tax compliance with SARS is required. Complete SBD 4 (Bidders Disclosure) and SBD 6.1 (PPR 2022). Suppliers with disabilities must provide a valid medical certificate. Collusive bidding or multiple submissions from related entities are prohibited.

The service provider must comply with the provisions of the Protection of Personal Information Act.

No submission guidelines found in the provided document. The content in currentAnalysis relates to security measures, not submission instructions.

The service provider must comply with the Protection of Personal Information Act (POPIA).

• Implement technical and organisational security measures to protect RAF's confidential, private, personal, or sensitive information (files, data, documents).

The service provider must have policies to comply with RAF requirements and the Protection of Personal Information Act.

• Implement robust cybersecurity measures including firewalls, intrusion detection, and encryption.
• Use encryption for data in transit and at rest, complying with industry standards.
• Regularly update and patch systems, software, and applications.
• Have a documented incident response plan and report any security incidents or data breaches to RAF promptly.
• Ensure subcontractors adhere to the same data protection and cybersecurity standards.
• RAF reserves the right to audit and monitor the service provider's compliance.
• Maintain physical security measures including controlled access, surveillance, and 24/7 monitoring.
• Have a fire suppression system (e.g., carbon dioxide extinguishers) on premises.
• Implement access control on a need-to-know basis with strong authentication.
• Handle personal and sensitive data in compliance with data protection laws.
• Safeguard data against unauthorised access, disclosure, alteration, and destruction.
• Impose confidentiality obligations on agents, subcontractors, or third parties.
• Screen third-party service providers handling PII and require data protection agreements.
• RAF reserves the right to conduct security screening or vetting of company directors and resources.

The service provider's premises must have a fire suppression system or similar in place, such as fire extinguishers with carbon dioxide, to prevent damage or loss of documents and records in a fire.

• The premises must have a secure perimeter with controlled access and/or surveillance systems, secure doors, locks, and alarms to prevent unauthorised access.
• Implement physical security measures to ensure safety and security of documents.

The service provider must ensure physical security of records, including controlled access points, surveillance cameras, and/or 24/7 monitoring.

• Protect all document storage facilities against unauthorised access.
• Immediately inform RAF of any real, attempted, or suspected breach of physical security and provide evidence (e.g., CCTV footage, police reports).
• Implement network security measures such as firewalls, intrusion detection, and encryption.
• Grant access on a need-to-know basis using strong authentication methods.
• Regularly review and update access permissions.
• Handle and process personal and sensitive data in compliance with applicable data protection laws.
• Safeguard data against unauthorised access, disclosure, alteration, and destruction.
• Inform RAF immediately of any data breaches or incidents impacting information security.
• Implement measures to ensure confidentiality of personal, confidential, and sensitive data, including imposing confidentiality obligations on agents, subcontractors, or third parties.
• Screen or vet third-party service providers handling PII for their data protection policies and require a data protection agreement.
• RAF reserves the right to conduct security screening or vetting of company directors and resources.
• Implement robust cybersecurity measures against threats like malware, phishing, and unauthorised access.
• Use encryption for data in transit and at rest, complying with industry standards.
• Regularly update and patch systems, software, and applications.
• Have a documented incident response plan to address and mitigate data breaches promptly.
• Report any security incidents or data breaches to RAF in a timely manner.
• Ensure subcontractors adhere to the same data protection and cybersecurity standards.
• The service provider is responsible for the actions and compliance of any subcontractors or third parties.
• RAF reserves the right to audit and monitor the service provider's compliance with this policy.
• The service provider must cooperate with any audits or assessments conducted by RAF.

The service provider will be entrusted with RAF's confidential, private, personal, or sensitive information (files, data, documents) and must comply with the Protection of Personal Information Act.

• Have protocols for proper handling and transport of files to and from the service provider's premises using a secure, lockable transportation system.
• Keep files in lockable containers or packaging during handling and transportation to prevent loss, theft, or damage.
• Maintain accurate records of each document stored, including location, access history, and retention schedule, organised for easy tracking.
• Use secure protocols for document retrieval, including verifying requester identity and ensuring secure transport.
• Maintain detailed records of all retrieval activities (date, time, requester identity, reason).
• Store physical documents and records in lockable cabinets to prevent unauthorised access or tampering.
• Ensure access to documents is controlled and monitored, with policies and procedures in place.
• Control document access, permitting only authorised personnel to handle, view, or transport documents.
• Have access monitoring and control procedures to ensure only authorised personnel are granted access to documents, records, and storage facility.
• Implement network security measures.