ESKOM dns security managed services – 5-Year RFP (1-Year implementation, 4-Year maintenance)

The document provided is a blank Quality Control Plan / Inspection Test Plan (QCP/ITP) template. It requires bidders to complete the following for the DNS security managed services project:

• Contract/Order number, subcontractor order number, and QCP number.
• Scope of work: item/plant/material description, with revision number and date.
• Quality control plan approvals: signature blocks for contractor/supplier, subcontractor (where applicable), Eskom, and Approved Inspection Authority (AIA) where applicable.
• Activities: a table listing each activity with description/requirement, intervention point (hold, witness, document review, surveillance, verification), category (statutory/non-statutory), inspection and test method (e.g. visual, NDT), supplier and Eskom inspection (internal/TPI or AIA/NOBO), and records.
• The template includes a legend for intervention points: AP (document requires approval), T1/T2 (100% or sample testing), A1/A2 (100% or sample inspection), W1/W2 (100% or sample witness), IN (document for information only), R1/R2 (100% or sample document review).
• Acceptance criteria must be defined (e.g. functionality, performance measures, regulatory compliance).

The tender is for the procurement of domain name system (DNS) security managed services, covering a five-year period consisting of one year of implementation and four years of maintenance and support. The procuring entity is Eskom.

The document is a Contract Quality Plan (CQP) template. It is intended for the supplier to identify and plan for meeting Eskom's contract expectations and quality management requirements.

The document is a Contract Quality Plan (CQP) template for the supplier to complete. Its purpose is for the supplier to identify and plan how it will meet Eskom's quality expectations for the contract.

The template requires the supplier to provide details on:

• Scope of work (full description of the works information).
• Communication channels between the supplier and Eskom for quality-related issues.
• An organogram showing roles, responsibilities, and qualifications of personnel, including QA/QC functions.
• An index of interfacing documents (processes, standards, codes, and specifications).
• A list of suppliers and sub-suppliers, including materials to be purchased and outsourced activities.
• Monitoring of suppliers and sub-contractors.
• Interface of sub-suppliers with the supplier's quality management system.
• An index of items to be manufactured, refurbished, and purchased.
• Related items/activities that need Quality Control Plans/Inspection and Test Plans (QCP/ITP), both offsite and onsite.
• Scope of work areas and processes requiring special controls governed by codes of manufacturing/fabrication standards (e.g., welding, NDT/NDE).
• An index of documented information to be submitted to Eskom during the project.
• How records will be controlled and retained.
• Concession and non-conformance management.
• Databook management process (including operating and maintenance manual).
• Management of working tools and equipment.
• Dealing with customer property as per ISO 9001.
• Product preservation.
• Identification and traceability.
• Commissioning and post-delivery activities (including warranty, technical support).

The template includes a table where the supplier must indicate which scope categories apply (design, manufacturing, supply and delivery, construction/installation/maintenance, commissioning, professional services, other).

The document references compliance with ISO 9001 requirements for managing customer property and the quality management system generally. It also references SANS 466:2005 and ISO 10005:2005 as guidelines for quality plans. No further compliance requirements are stated.

The tender is for the procurement of Domain Name System (DNS) Security Managed Services for five years: one year for implementation and four years for maintenance and support.

Only the currencies listed in the pricing schedule are accepted: AUD, CAD, CHF, DKK, EUR, GBP, HKD, JPY, NOK, NZD, SEK, SGD, USD and ZAR. Bidders intending to use a different currency must request approval well before submission; the onus is on the bidder to submit with approved currencies.

The pricing schedule is for Domain Name System (DNS) Security Managed Services.

Implementation phase deliverables include: Design; Build, Configure and Testing; Deployment; Stabilisation & Go-Live Support; Data Migration; Change Management; Project Management; Training.

Support and maintenance covers a term of four years after a one-year implementation, with annual contract price adjustment details to be provided.

Resource tables for implementation and support are to be completed with skills, levels, hours, and rates.

Prices must be quoted in ZAR, excluding VAT and escalations.

All cells highlighted in green must be completed.

Cash-flow projections are required for the implementation phase, across a 12-month schedule.

A detailed resource plan for implementation must be provided in the prescribed table.

Foreign currency portions must be converted using SARB exchange rates at 12:00 on the day of advertisement; proof of the SARB rates must be submitted.

Exchange rates must be rounded to four decimals.

Exchange rate variations may not be claimed for local mark-up.

The currency table lists 14 approved currencies; bidders must indicate the currency of each line item.

Contract start date: 1 December 2026 or soon thereafter.

Contract duration: 5 years (1 year implementation, 4 years maintenance and support).

First programme submission: within 1 week of Contract Date.

Revised programme intervals: every 2 weeks from contract commencement.

Quality policy statement and quality plan: within 4 weeks of Contract Start Date.

Defects date: 5 years after completion of the whole of the services.

Employer: Eskom Holdings SOC Ltd (Registration No. 2002/015527/30).

Registered office: Megawatt Park, Maxwell Drive, Sandton, Johannesburg.

Telephone: 011 800 3111.

Returnable documents:

• Signed Form of Offer and Acceptance (Part C1) with the Schedule of Deviations, if any.
• Completed Contract Data Part 2 (C1.2b) and staff rates/task schedule pricing in the provided Excel worksheet.
• Completed pricing schedules (Part C2) with all prices exclusive of VAT, in ZAR for local suppliers, not linked to foreign currency.
• Signed SBD forms as required by the tender pack.
• Pro forma parent company guarantee, performance bond, and ASGI-SA guarantee on the prescribed forms.
• Security vetting/screening documents for the Consultant, its employees and subcontractors, including criminal record verification certificates.

Submission method and address: Eskom will communicate in the tender pack; no address provided in this extract.

Disqualification risks: failure to submit any returnable form, unsigned forms, late submission, fraudulent or expired criminal record certificates, or failure to provide required securities within the stated time.

The tender uses the NEC3 Professional Services Contract with secondary options X4 (parent company guarantee), X13 (performance bond), X1 (price adjustment for inflation), X2 (changes in law), X3 (multiple currencies), X7 (delay damages), X9 (transfer of rights), X10 (Employer's Agent), X11 (termination by Employer), X13 (performance bond), X18 (limitation of liability), and Z (additional conditions).

Pricing basis: Option G (Term Contract) – cost reimbursable, work ordered by task, priced on staff rates and a Task Schedule; prices exclusive of VAT; annual escalations on CPI portion.

Preference points system: not specified in the extract.

Evaluation stages: not specified in the extract.

Procurement of Domain Name System (DNS) Security Managed Services for a period of five (5) years: 1 year implementation and 4 years maintenance and support.

The services are governed by the NEC3 Professional Services Contract (April 2013 edition).

Scope is defined in Part 3: Scope of Work.

Service provider must comply with Eskom's security standards, POPIA, and security vetting requirements.

Intellectual property: foreground IP (developed during services) vests with Eskom; Consultant retains background IP; must provide manufacturing documents and designs to Eskom on completion.

Data protection: both parties are independent responsible parties; must comply with POPIA; no transfer of personal info to third parties without consent; no transfer abroad without compliance with section 72 of POPIA.

Security breach notification: notify Eskom at [email protected] within 24 hours of becoming aware of a breach; provide progress reports at least daily; notify police/national intelligence/regulators as required.

Security vetting: Consultant, employees, and subcontractors must undergo vetting/screening by State Security Agency or Eskom's Vetting Fieldwork Unit; criminal record certificates must be no older than 4 weeks at submission and remain valid for duration of access; costs borne by Consultant.

Audit rights: Eskom may audit the Consultant's data security and vetting compliance with reasonable notice.

Consultant must provide a detailed written report on security risk investigations within 30 days of completing them, and verification reports within 30 days.

Pricing: Option G (Term Contract) – cost reimbursable, work ordered by task, Task Schedule priced on staff rates and lump sums; all prices exclusive of VAT; annual escalations calculated separately on CPI portion.

Staff rates may be set for named staff, categories of staff, or related to salaries; expenses listed separately and only those listed are claimable.

Securities required: parent company guarantee (Option X4), performance bond (Option X13), and ASGI-SA Guarantee, each on the pro forma wording provided.

Pricing must be in ZAR for local suppliers, not linked to foreign exchange rates; foreign exchange commitments only for direct importers.

Prices must be valid for the period stated in the Contract Data.

Security vetting and screening: the Consultant, its employees and subcontractors providing the service must undergo vetting and/or screening by the State Security Agency or the Employer's Vetting Fieldwork Unit, and must provide identifying documents, certificates and other records on request.

Criminal record verification: certificates must be issued by a reputable screening company accredited by the South African Police Services, be no older than four weeks at the time of submission, and remain valid for the duration of the person's access. Fraudulent, cancelled, withdrawn, invalidated, amended or expired records, or a noted criminal conviction, may result in the person being removed and blocked from access at no compensation.

POPIA compliance: both parties must comply with the Protection of Personal Information Act, 2013; must not transfer personal information without consent and must ensure lawful processing.

Intellectual property: foreground IP vests with Eskom; Consultant must ensure copyright notices and provide IP documents on completion.

Standard forms: include SBD 1 (Invitation to Bid), SBD 3 (Pricing Schedule), SBD 4 (Declaration of Interest), SBD 6.1 (Preference Points Claim), SBD 6.2 (Local Production Declaration), SBD 7 (Contract Form), SBD 8 (Past SCM Practices), SBD 9 (Certificate of Independent Bid Determination), and Authority to Sign – as applicable; each must be completed and signed.

The document is a technical evaluation criteria workbook for the procurement of DNS security managed services. It provides guidance to the technical evaluation team on structuring criteria and sourcing evidence. The solution must be a managed DNS security service delivered over a five-year period (1 year implementation, 4 years maintenance and support).

Closing date: 3 November 2026 at 10:00

No briefing or site visit dates are stated in the document.

No named contacts, submission address, or enquiry channels are stated in the available document.

Returnable documents

• The technical file must include all mandatory returnables, numbered to align with each evaluation criteria question.
• Each technical requirement must be supported by OEM documentation and proposed managed services use cases. Failure to provide OEM documentation with the required capability and functionality scores zero for that item.
• Evidence must reference the exact file, section, and page number in the tender submission.
• The tenderer must complete its registered name, evaluator details, and date fields on the evaluation sheets.

Disqualification risks

• Failing any gatekeeper (legislative or compliance criteria) stops further evaluation.
• Scoring below the minimum threshold in either the desktop evaluation or the technical demonstration disqualifies the bid.

Evaluation stages and thresholds

• Desktop evaluation: minimum threshold of 0.8 (80%).
• Technical demonstration: minimum threshold of 0.8 (80%).
• The two stages are evaluated separately; scores may not be added together.

The technical evaluation (desktop) uses a weighted scorecard (total weight = 1.0) across categories: Compliance (10%), Integration Capabilities (14%), DNS Defense Capabilities (43%), and DNS Visibility (35%).

Key technical requirements and their weights (desktop):

• Threat-blocking efficacy (≥87% malware, ≥80% phishing) with false positive rate ≤2%, validated independently: 4%
• Local POP in South Africa with SOC 2 type certification evidence: 3%
• Agentless on-premises deployment: 3%
• Access guard feature for continuous evaluation of firewall, proxy, and DNS policies: 5%
• Integration with Existing Security Ecosystems (EDR, firewall, proxy, SIEM): 4%
• Must operate without inline DNS relay, using passive analysis: 5%
• Predictive Domain Risk Scoring using threat intelligence (pre-attack phase): 4.44%
• Real-time global DNS propagation monitoring across 50+ anycast nodes: 4.44%
• Incident Response Support with Historical DNS Data (12 months real-time correlation, up to 10 years archival): 4.44%
• Ruleset-Based Policy Management: 2.96%
• Location-Based Policy Management: 4.44%
• Cross-platform agent support: 2.96%
• Dynamic TTL adjustment (reducing propagation delays by 70%): 3.7%
• Correlation of DNS query patterns with threat feeds (DNSBL, MITRE ATT&CK) for automated mitigation: 3.7%
• Automated DNS zone transfers (AXFR/IXFR) with cryptographic validation: 2.22%
• Policy-as-code for DNS records (CAA, DKIM, DMARC) with automated remediation: 3.7%
• Disruption of C2 communications for malware-less attacks: 3.7%
• Aggregation of DNS logs into a centralized platform: 3.7%
• Detection of suspicious traffic within VPN/ZTNA tunnels correlated to user/endpoint: 4.44%
• Behavioural and ML-based detection of DNS tunneling and exfiltration: 3.7%
• Out-of-the-box integration with AD, DHCP, DNS Server for user device mapping: 3.7%
• Simulated detection/prevention of zero-day domains, botnets, phishing, malware, TOR traffic, malicious domains, NRDs: 4.44%
• Filter DNS queries based on domain registrar details: 2.22%
• Real-time threat intelligence classification of domains: 3.7%
• Native integration with VPN/ZTNA services: 2.22%

Each requirement is scored on a scale: full score if fully demonstrated, partial scores for partial capability, and zero if no OEM documentation is provided. Priority ratings (show stopper, critical, etc.) affect the demonstration scoring but the desktop scoring uses the stated weights.

Technical demonstration scoring (weights out of 1.0 total) includes business requirements, with show-stopper items yielding zero if not met. The demonstration threshold is 0.8 (80%). Demonstration duration must be strictly adhered to for all vendors.

Scope: Procurement of DNS security managed services for Eskom Group IT for a period of five years (1 year implementation and 4 years maintenance and support).

The solution must be a managed DNS security service with the following capabilities (each to be demonstrated with OEM documentation and service use cases):

Threat protection and efficacy

• Independently validated threat-blocking efficacy: ≥87% malware, ≥80% phishing, with false positive rate averaging ≤2% (AV-TEST equivalent).
• Predictive domain risk scoring using threat intelligence to block/monitor domains before public blocklists (pre-attack phase).
• Real-time classification of domains using threat intelligence in addition to content/category filtering.
• Filtering of DNS queries based on domain registrar details as an additional threat signal.
• Disruption of command-and-control (C2) communications for malware-less (living-off-the-land) attacks, with coverage for non-standard protocols (e.g., Microsoft Teams, Azure DNS).
• Behavioural and machine-learning-based detection of DNS tunneling activity and exfiltration attempts in real time.
• Attribution of malicious activity to infrastructure, including threat actor TTPs and infrastructure mapping.
• Correlation of DNS query patterns with threat feeds (DNSBL, MITRE ATT&CK) to detect reconnaissance, tunneling, or DDoS attacks, triggering automated mitigation.

Deployment and architecture

• Local Point of Presence (POP) in South Africa for low-latency DNS resolution and local data residency; OEM documentation must evidence SOC 2 type certification.
• Must be agentless on-premises deployment, without acting as an inline DNS relay; must use passive analysis methods to avoid interrupting DNS resolution paths.
• Native integration with VPN/ZTNA services, with correlation of DNS activity from VPN-connected endpoints.
• Detection and correlation of suspicious traffic within VPN/ZTNA tunnels to the originating user or endpoint.
• Cross-platform agent support across all endpoint devices with minimal performance impact.
• Out-of-the-box integration with Active Directory (AD), DHCP, and DNS Server for full user-device mapping visibility.

DNS management and visibility

• Real-time global DNS propagation monitoring across 50+ anycast nodes, with predictive analytics to identify delayed zones and automate corrective actions.
• Dynamic adjustment of TTL values based on traffic patterns and change-windows, reducing propagation delays by 70% during migrations while maintaining compliance.
• Automated DNS zone transfers (AXFR/IXFR) with cryptographic validation and conflict resolution to prevent zone poisoning or misconfigurations.
• Automation of DNSSEC key generation, signing, and rollover without service disruption, with cryptographic proof of record integrity.
• Ruleset-based policy management for advanced, customizable rulesets (e.g., network and identity attributes).
• Location-based policy management for geo-location filtering or office location-based enforcement.
• Policy-as-code enforcement for DNS records (e.g., CAA, DKIM, DMARC), including automated violation remediation and audit reporting for standards like PCI-DSS.
• Aggregation of DNS-related logs from multiple sources into a centralized platform supporting real-time search, correlation, and compliance-ready storage.
• Access guard feature to evaluate and continuously monitor firewall, proxy, and DNS security policies.
• Historical DNS data: 12 months of retained data for real-time correlation, with long-term archival up to 10 years using optimised storage.
• Ability to filter DNS queries based on domain registrar details as an additional threat signal.
• Integration with existing security ecosystems (EDR, firewall, proxy, SIEM) for automated incident response, enriched analytics, and correlation.

Security testing and simulations

• Demonstrate detection and prevention of key threat categories: zero-day domains, botnets, phishing, malware, TOR traffic, malicious domains, and newly registered domains (NRDs).

No pricing format, bid security, guarantees, retention, payment terms, or turnover thresholds are stated in the document.

Gatekeepers: limited to legislative and compliance criteria. Failure of any gatekeeper ends evaluation.

Compliance evidence required:

• Valid OEM documentation for each technical requirement. If not provided, that item scores zero.
• Proposed managed services use cases must accompany each OEM document.
• Evidence must be numbered and cross-referenced to criteria.
• Tenderer must be registered on CSD and have a valid tax compliance status (implied by standard SCM practice, but not explicitly stated in the document).

No B-BBEE, CIDB, or other specific compliance thresholds are stated in this technical evaluation document.

The department (Eskom) requires a DNS Security Managed Services solution for a period of five years: one year implementation and four years maintenance and support. The solution must provide comprehensive advanced protection against DNS attacks, enable efficient DNS traffic management, and integrate seamlessly with the existing information security ecosystem. The service must be based on purpose-built hardware, provide robust, scalable, integrated controls for network DNS security services, and be deployed at two data centres (Megawatt Park and Teraco). The solution must offer DNS firewall, hardware and protocol high availability, geographical redundancy, DNSSEC and IPv6 compliance, network discovery, configuration automation, policy enforcement, fail-safe architecture, DNS traffic control, real-time threat detection, anomaly detection, access guard reporting, infected device identification, real-time visibility, agentless log collection with 1-year retention, on-premises deployment, and integration with existing security tools. Additional requirements include IPAM capability, AV-Test compliance (80%+ success rate), SOC 2 compliance, and ruleset-based policy management.

Closing date: 3 November 2026 at 10:00 (from tender record). No other dates stated.

No contact names, emails, telephones, or submission addresses stated in the document. The work location is Eskom Megawatt Park, Johannesburg (ad-hoc basis, no site visits).

Submission method and address are not stated in the document. Returnable forms are not listed in the document. No specific submission instructions were provided.

The document specifies that the solution must achieve an 80% or higher success rate in the DNS Security category as evaluated by AV-Test within the last three years, covering threat detection, blocking efficiency, industry benchmarking)Skip? [source] and efficacy reporting. Compliance with SOC 2 standards for data protection and privacy is required. Solution must comply with IETF DNSSEC RFCs (4033-4025, 6840, 6781). Recognised certifications such as ISO/IEC 27001, SSAE16 (and attestation reports where cloud-based) are required.

The managed service must provide comprehensive advanced DNS security protection for a five-year period (1 year implementation, 4 years maintenance and support). Solution must be deployed on-premises at two data centres: Megawatt Park data centre and Teraco data centre.

Key required capabilities:

• DNS firewall against DNS malware
• Hardware high availability for all enabled services (DNS, DNSSEC, DHCP, FTP, TFTP, HTTP, HTTPS, NTP)
• Protocol HA including DHCP failover, DNS, TFTP/HTTP, NTP, Syslog
• Geographical redundancy across data centre and disaster recovery sites
• DNSSEC and IPv6 compliance
• L2/L3 network discovery and connected endpoints
• Network configuration change and management automation
• Network policy and compliance enforcement
• Fail-safe, secure-by-design architecture
• Integrated DNS traffic control for load balancing across multiple data centres
• Real-time threat detection via DNS query analysis
• DNS traffic behaviour and anomaly detection
• Access Guard reporting on firewall/proxy/DNS security performance
• One-click infected device identification
• Real-time visibility on DNS security layer (MAC address, username, source IP, device name, host name)
• Agentless DNS log collection with minimum 1-year log retention and 1-year real-time search
• On-premise deployment with full administrative control
• DNS-level infected device detection with automation to find and contain infected devices
• Seamless integration with existing firewall, proxy, and NDR (out-of-the-box)
• First-seen domain detection on DNS layer
• On-premises reporting (daily, weekly, monthly) with compliance-friendly logging
• AV-Test compliance: 80% or higher success rate in DNS Security category
• SOC 2 compliance
• Ruleset-based policy management (by category, client IP, CNAME, CNAME TLD, CVE, device name, DoH/DoT, domain, domain age, classification within 15 minutes, TLD, FQDN, IP, IP country, nameserver attributes, open port, proxy IP, query type, registrar, status, username)
• Bidirectional EDR integration
• SOAR & API integration
• Content filtering and policy management
• Granular rule creation
• Advanced allow/block list management (dynamic with URL feeds)
• MSP-friendly multi-tenant architecture
• Compatibility with Windows, macOS, Linux, iOS, Android
• Protection against DNS hijacking, spoofing, cache poisoning, zero-day attacks
• DNS filtering and content blocking with custom black/white lists
• DNS traffic analysis
• DNS encryption (DoH/DoT) with detection of invisible traffic
• Data exfiltration prevention in real-time
• IPAM capability: enterprise-grade IP Address Management for hybrid on-premises and multi-cloud environments, including centralised IP address space management, native/API-driven cloud integrations (Azure, AWS, GCP), RESTful APIs, scalability for IPv4/IPv6 with high availability, role-based access control, audit/compliance reporting, migration from Cisco Prime Network Registrar (IP records and metadata only), customisable dashboards, ongoing vendor support and roadmap, integrated DNS/DHCP management.

Additional solution capabilities required:

• Global Server Load Balancing (GSLB) and DNS Traffic Control for disaster recovery and remote failover
• Multi-factor authentication (MFA) for admin access
• Threat Intelligence Feed (TIF) with continuous up-to-date data
• Malware DGA protection
• Machine learning/heuristics to augment threat feeds
• Hybrid architecture deployment
• Typo-squatting prevention
• Image-based anti-phishing via AI
• Crypto-mining domain classification
• Proactive threat hunting
• Automatic threat remediation (blocking suspicious DNS requests, quarantining infected devices, notifying security teams)
• Reporting with AD username, hostname, MAC address instead of variable IP
• Agentless deployment
• Roaming client support for off-network users
• Cloud-based protection option
• On-premises reporting option
• Bidirectional XDR integration
• SOAR & API integration with open architecture
• Content filtering and policy management
• Granular rule creation
• Advanced allow/block list management
• Dynamic allow/block lists with URL feeds
• MSP-friendly architecture for multi-tenant environments
• Strong AV-Test success score (80%+ in DNS Security category within last 3 years)
• Compliance with IETF standards (RFCs 4033-4025, 6840, 6781)

Implementation requirements:

• Dedicated project manager for implementation phase
• Two devices/systems (one at Megawatt Park, one at Teraco)
• On-site, classroom, and web-based training for end-users and support staff (pre-booked)
• Train 10 resources in first implementation year (hands-on practical)
• Mentor 10 Eskom resources through installation, configuration, deployment (skills transfer program)
• Train 10 Eskom IT staff for first-line support (onsite)
• Provide recognised product certifications (e.g., ISO/IEC 27001, SSAE16) and attestation reports for cloud-based solutions
• Expert-level training with relevant certification for 10 resources

Training and skills transfer requirements:

• Provide onsite, classroom-based, and web-based training for end-users and system support staff on a pre-booked basis.
• Deliver hands-on practical implementation training for 10 resources in the first year of implementation.
• Mentor 10 Eskom resources through installation, configuration and deployment stages using a defined skills transfer program.
• Train 10 Eskom IT staff to provide first-line support via onsite training.
• Provide recognised product certifications (e.g., ISO/IEC 27001, SSAE16) and attestation reports if cloud-based solution.
• Provide expert-level training with relevant certification for 10 resources.

The solution must demonstrate consistent performance in independent AV-Test evaluations covering threat detection (identifying a wide range of DNS-based threats including phishing, malware sites, malicious URLs), blocking efficiency (covering DNS tunnelling, C2 server communications, domain-based malware), industry benchmarking (detection rates, false positive rates, overall blocking effectiveness), and efficacy reporting (published AV-Test results showing at least 80% success rate in all DNS Security test reports within the last three years).

No pricing schedule, bill of quantities, or payment schedule provided in the document. Pricing format not specified.

No pricing format, bid security, bonds, guarantees, retention, payment terms, or financial capacity thresholds stated in the document.

AV-Test compliance: solution must achieve 80% or higher success rate in DNS Security category, verifiable through published AV-Test results within last three years.

SOC 2 compliance for data protection and privacy.

IETF DNSSEC RFC compliance.

Industry certifications such as ISO/IEC 27001 and SSAE16 (with attestation reports for cloud solutions).

No specific B-BBEE level or CIDB grading stated in the document.

The resource will be required to work at Eskom Megawatt Park on an ad-hoc basis. No requirement exists for any Eskom site visits.

No specific environmental requirements stated. Solution must be deployed on-premises at two data centres (Megawatt Park and Teraco) with fail-safe, secure-by-design architecture.

Service Level Agreement requirements: Service provider must provide 24/7/365 second- and third-line support with the OEM. A comprehensive SLA covering KPAs, KPIs and liabilities will be drafted with the successful supplier.

Escalation targets (response times):

• Critical (business stopped): Level 1 – 1 hour to service provider; 4 hours to OEM; Level 2 – 3 hours to service provider; 4 hours to OEM.
• Major (business severely impacted): Level 1 – 1 hour to service provider; 4 hours to OEM; Level 2 – 3 hours to service provider; 4 hours to OEM.
• Normal (minor business impact/product failure): Level 1 – 1 business day to service provider; 1 business day to OEM; Level 2 – 2 business days to service provider; 1 business day to OEM.
• Low (no business impact but requires updates): Level 1 – 2 business days to service provider; 2 business days to OEM; Level 2 – 2 business days to both.
• Informational (request for information): Level 1 – 3 business days to service provider; 3 business days to OEM; Level 2 – 3 business days to both.

The solution must include but not be limited to the following capabilities: DNS firewall against DNS malware; hardware and protocol HA (DHCP failover, DNS, TFTP/HTTP, NTP, Syslog); geographical redundancy across DC and DR; DNSSEC and IPv6 compliance; L2/L3 network discovery; network configuration automation; network policy and compliance enforcement; fail-safe secure-by-design architecture; DNS traffic control for load balancing; real-time threat detection; DNS traffic behaviour and anomaly detection; access guard reporting; one-click infected device identification; real-time visibility (MAC, username, source IP, device name, host name); agentless DNS log collection with 1-year retention and real-time search; on-premises deployment with full administrative control; DNS-level infected device detection with automation; integration with firewall, proxy, and NDR; first-seen domain detection; on-premises reporting (daily/weekly/monthly); AV-Test compliance (80%+ success rate in DNS Security category); SOC 2 compliance; ruleset-based policy management customizable by category, client IP, CNAME, CNAME TLD, CVE, device name, DoH/DoT, domain, domain age, domain classification (within 15 minutes), domain TLD, FQDN, IP, IP country, nameserver attributes, open port, proxy IP, query type, registrar, status, username; compatibility with Windows, macOS, Linux, iOS, Android; protection against DNS hijacking, spoofing, cache poisoning; DNS filtering and content blocking; DNS traffic analysis; DNS encryption (DoH/DoT); integration with firewalls, IPS, AI threat detection, NGFW, SIEM, bidirectional XDR with open API and key sharing; scalability, flexibility, performance; ease of deployment and management; automatic threat remediation; data exfiltration prevention; content filtering and policy management; granular rule creation; advanced allow/block list management; dynamic allow/block lists with URL feeds; MSP-friendly architecture; AV-Test success score; compliance with IETF standards (RFCs 4033-4025, 6840, 6781). IPAM: enterprise-grade IP Address Management for hybrid on-premises and multi-cloud environments, including centralised IP address management, native/API-driven cloud integrations (Azure, AWS, GCP), RESTful APIs and automation, scalability for IPv4/IPv6 with high availability, role-based access control and audit/compliance reporting, migration of existing IPAM database from Cisco Prime Network Registrar (IP records and metadata only), customisable dashboards and reporting, ongoing vendor support and roadmap, integrated DNS/DHCP management, ability to import or integrate with Active Directory DNS, DDNS, RPZ zones, DNSSEC, DDoS protection, DNS blacklist feeds, extensive SIEM logging, EDNS. Global Server Load Balancing (GSLB) and DNS Traffic Control required for service protection, load sharing, and disaster recovery.

The document specifies solution compliance gates: AV-Test success rate of 80% or higher in DNS Security category within last three years, SOC 2 compliance, IETF DNSSEC RFC compliance, and recognised certifications (ISO/IEC 27001, SSAE16) with attestation reports for cloud solutions. No other evaluation criteria (e.g., price, functionality split) provided.

The document is a Third-Party Security Risk Assessment Questionnaire for all service providers responding to the RFP. Bidders must answer all questions to demonstrate their security posture before contract award. The questionnaire covers data ownership, storage, security controls, disaster recovery, and compliance.

Returnable documents: the Third-Party Security Risk Assessment Questionnaire must be completed in full with responses to all items. Valid SOC reports must be submitted: SOC 1 Type II where financial data is stored, SOC 2 Type II where personal and intellectual property data is stored. If not currently available, the bidder must state when an independent audit examination is planned. Bidders must attach required supporting documentation, including architecture/network diagrams, disaster recovery test results, and security policies.

The bidder's security posture is assessed through the questionnaire responses. Mandatory submission: valid SOC reports (SOC 1 Type II for financial data, SOC 2 Type II for personal/IP data). Bidders unable to provide these must indicate a planned audit date. Note: Hosting in South Africa and the European Union is preferred.

No specific compliance requirements found.

Project: implementation, maintenance and support of Domain Name System (DNS) security managed services over five years.

Eskom representative

• Name: Lesego Garegae (Wendy Nduneni)
• Role: Eskom representative issuing the quality returnables annexure

No email address or telephone number is given in this annexure.

Returnable documents for the Category 2 quality evaluation:

• Form A: completed and signed.
• Quality Management System evidence — one of two routes:
• Option 1: a valid ISO 9001 certificate issued by an approved and authorised certification body holding recognised international accreditation, with a product/service scope relevant to the work and an unexpired validity date.
• Option 2: objective evidence of a documented QMS that complies with ISO 9001 but is not certified.
• Section B: evidence that the QMS is in operation.
• Section C: a draft Contract Quality Plan specific to the scope of work.
• Section D: a Quality Control Plan, checklist or Inspection and Test Plan.
• Section E: Form A plus any additional scope-specific requirements.

Submission channel, delivery address and closing time are not set out in this annexure.

Quality deliverables are scored individually, each indicator worth 1 point.

Section A — Quality Management System (ISO 9001), one route only:

• Option 1 (certified): 4 points — relevant scope defined on the certificate, approved and authorised certification authority, recognised international accreditation, valid expiry date.
• Option 2 (uncertified documented QMS): 7 points — QMS manual or scope document, quality policy and quality objectives approved by top management, control of documented information (clause 7.5), control of nonconforming outputs (8.7), nonconformity and corrective action (10.2), internal audit (9.2).

Section B — Evidence of QMS in operation: 4 points — organisation chart and responsibility matrix covering the quality management function (5.3); control of externally provided processes, products and services including evaluation, selection, performance monitoring and re-evaluation criteria (8.4); latest internal management system audit report with nonconformity, correction and corrective action reports stating objective, scope, criteria and outcomes (9.2); management review records such as minutes and attendance registers.

Section C — Contract Quality Plan: 1 point — draft plan specific to the scope of work (ISO 10005), carrying important QA deliverables.

Section D — Quality Control Plan: 1 point — QCP, checklist or ITP per the scope of work (ISO 10005), or an example from similar or previous work.

Section E — Additional requirements: 1 point — Form A completed and signed, plus any other scope-specific requirements.

Maximum available: 11 points on Option 1, 14 points on Option 2.

Scope: provision of Domain Name System (DNS) security managed services.

Contract period: five years — one year of implementation followed by four years of maintenance and support.

Referenced specifications: 240-105658000 (tender quality requirements), 240-109253698 (contract quality plan), 240-109253302 (quality control plan).

Quality deliverables: documented QMS evidence, a draft Contract Quality Plan and a Quality Control Plan or ITP specific to the DNS scope.

Section E — user-defined additional requirements: Form A must be completed and signed, and any further scope-specific requirements may be added and evaluated. Section E carries 1 point.

Quality management system

• Hold a valid ISO 9001 certificate from an approved and authorised certification body with recognised international accreditation, with a relevant scope and unexpired validity; or
• Provide objective evidence of a documented QMS complying with ISO 9001 without certification.

Returnables

• Form A: completed and signed.
• Section B QMS-in-operation evidence, Section C draft Contract Quality Plan, Section D Quality Control Plan or ITP.

No CSD registration, tax compliance, B-BBEE or CIDB requirements are stated in this annexure.

Quality scoring per deliverable, each indicator worth 1 point.

Section A — ISO 9001 Quality Management System:

• Option 1 (certified): 4 points.
• Option 2 (uncertified documented QMS): 7 points.

Section B — Evidence of QMS in operation: 4 points.

Section C — Draft Contract Quality Plan (ISO 10005): 1 point.

Section D — Quality Control Plan or ITP (ISO 10005): 1 point.

Section E — Additional requirements: 1 point.

Maximum available: 11 points on Option 1, 14 points on Option 2.

Returnable documents — all must be completed, signed and submitted with the bid:

• Annexure B (Eskom requirement 32-726): mandatory SHE requirements the tenderer must comply with when submitting the tender. Must be signed and returned.
• Annexure Q (Group Technology SHE Tender Requirements for Professional Services Adhoc Support): scope description activities for DNS maintenance and support on an adhoc basis, and onsite training at the Service Provider's site.

Registration with the Department of Labour for compensation in respect of occupational injuries and diseases on duty, evidenced by a valid Letter of Good Standing (COIDA or equivalent).

Annexure B (Eskom requirement 32-726) is mandatory and must be signed and submitted by the tenderer as part of the tender returnable.

Scope: Domain Name System (DNS) security managed services, including maintenance and support on an adhoc basis.

Contract period: 5 years total — 1 year implementation and 4 years maintenance and support.

Training: Onsite training is planned to take place at the Service Provider's site.

Annexure B (Eskom requirement 32-726): mandatory SHE requirements to be signed and submitted with the tender.

SHE legal appointments under Section 16(2) of the OHS Act: the CEO/MD must assign a person under their control to assist in executing employer duties. The 16(2) appointment must be signed by the CEO/MD.

OHS Act Section 37(2) Agreement: to be signed by the service provider and the Eskom Project Manager at tender award.

COIDA: valid Letter of Good Standing (or equivalent) proving registration with the Department of Labour for compensation for occupational injuries and diseases on duty.

Mandatory returnable

• Annexure U — E-Tendering Training Acknowledgement Form (Template ID 240-9722574, Rev 1): must be completed in full, signed by an authorised signatory and returned to Eskom within the prescribed period.
• The form captures the enquiry number, the bidder's business or joint venture name, contact person, landline, cellphone and email address, and confirms that the bidder has completed self-training on the Eskom e-Tendering solution through the Noddy Guide, the training video or a clarification meeting.

Disqualification risk

• A form that is not fully completed or not submitted within the prescribed period renders the bid non-responsive and disqualifies the bidder from the procurement process.

Annexure U — E-Tendering Training Acknowledgement Form (Template ID 240-9722574, Rev 1)

• Mandatory returnable that must be fully completed and submitted to Eskom within the prescribed period.
• Confirms that the bidder has self-trained on the e-Tendering solution through the Noddy Guide, the training video or a clarification meeting and can operate it.
• Requires the enquiry number, business or joint venture name, contact person, landline, cellphone, email address, authorised signature, designation and date.
• Incomplete or late submission renders the bid non-responsive and disqualifies the bidder from the procurement process.

Mandatory returnable

• Annexure U — E-Tendering Training Acknowledgement Form: full completion and submission is a condition of responsiveness.

E-tendering capability

• The bidder must be able to operate the Eskom e-Tendering solution; the acknowledgement form confirms this capability.

Disqualification

• Failure to fully complete and submit the acknowledgement form within the prescribed period disqualifies the bidder from the procurement process.

Envisaged solution requirements

• DNS firewall capability against DNS malware.
• Hardware high availability for all enabled services and protocol HA covering DHCP failover, DNS, TFTP/HTTP, NTP and Syslog.
• Geographical redundancy across data centre and disaster recovery.
• Compliance with DNSSEC and IPv6.
• Network discovery for L2/L3 devices and connected endpoints.
• Integrated DNS traffic control to load balance traffic across multiple data centres.
• Agentless DNS log collection with at least one year of retention and one year of real-time search for audits and investigations.
• DNS-level detection of infected devices.
• Out-of-the-box integration with existing firewall, proxy and NDR.
• Rule filtering by category, client IP, CNAME/CNAME domain/CNAME TLD, CVE, device name, DoH and DoT, domain and domain age, domain TLD, FQDN, IP and IP country, nameserver attributes, open port, proxy IP, query type, domain registrar, status and username.
• DNS filtering and content blocking with customisable blacklists and whitelists and category-based restrictions.
• DNS traffic analysis and DNS encryption (DoH/DoT) with detection of hidden malicious DNS traffic.
• Customisable, exportable reports and analytics with pre-built long-term network reporting.
• Integration with firewalls, IPS, AI threat detection solutions and SIEM.
• Real-time threat detection using AI-driven analytics and global intelligence feeds, plus DNS traffic behaviour and anomaly detection.
• Global Server Load Balancing and DNS traffic control to protect services, share load between sites and implement disaster recovery and remote failover.

Closing

• Date and time: 03 November 2026 at 10:00 South African Standard Time.
• Late tenders will not be accepted.

Issue date

• 12 October 2026.

Clarification

• No clarification meeting will be held.
• Clarification questions must be emailed to [email protected].
• Clarification queries close 5 working days before the tender submission deadline.

Tender validity

• 365 days (12 months) from the closing date and time.

Eskom Representative

• Name: Herman Mhlongo
• Telephone: 011 516 7653
• Email: [email protected]
• All queries and clarifications must be addressed in writing to the Eskom Representative; no query may be directed to any other Eskom official.

Procurement Manager

• Name: Nothukela Thuksi Sereo

Fraud and corruption reporting

• Telephone: 0800 11 2722
• Email: [email protected]

Submission channel

• Eskom e-tendering site: https://eTendering.eskom.co.za

Submission method

• Electronic submission only, through the Eskom e-tendering site at https://eTendering.eskom.co.za.
• Documents must be uploaded under the Technical, Commercial, Financial and other folders.
• All documents must be in PDF format; the price list must be submitted in electronic format.
• Upload limits: 500 MB per document and 4 GB for the total submission.
• No zip or compressed files may be uploaded; no hard copies will be accepted.
• The submission status must be indicated as complete.
• If a tender is resubmitted, only the latest version is accepted and all earlier submissions become null and void.
• Late tenders will not be accepted.
• There is no public tender opening; tenders are downloaded electronically and prices are not read out.

Returnables required at closing (disqualifiable if incomplete, unsigned or missing)

• Electronic copy of the tender.
• Annexure A: Authorisation Form.
• Annexure B: Acknowledgement Form.
• Annexure C: Tenderer's Particulars.
• Annexure D: Integrity Declaration Form; the Eskom Supplier Integrity Pact must be read.
• Annexure E: CPA requirements for local goods and services, where applicable.
• Annexure F: CPA(IG) for imported goods and services, where applicable.
• Annexure H: SBD 1 Invitation to Bid, for all tenderers including foreign suppliers.
• Annexure J: SBD 4 Bidder's Disclosure.
• Annexure K: Tax Evaluation Questionnaire (personal service provider test for PAYE).
• Annexure L: NEC 3 Professional Services documentation.
• Annexure M: complete Pricing Schedule in Excel format.

Returnables required at closing (non-disqualifiable)

• Annexure I: SBD 6.1 Preference Points Claim Form under the PPPFA 2022 regulations.
• Tax clearance certificate where required.
• Tax Evaluation Questionnaire where included as an annexure.
• If any of these are missing or incomplete, the procurement practitioner will request them in writing and the bidder has 5 working days to comply, failing which the tender is disqualified.

Returnables scored zero if not submitted at closing

• Proof of the specific goals claim; failure to submit does not disqualify but scores zero for specific goals.

Joint venture tenders

• Letter of intent or valid joint venture agreement confirming each partner's rights, obligations and profit-sharing ratios.
• Written confirmation that the joint venture will operate as a single business entity for the contract duration.
• Confirmation of a single designated joint venture bank account, independent of the individual partners.

Required before contract award

• Proof of valid and current CSD registration (CSD number or CSD report).
• SDL&I evidence (Annexure P), quality evidence (Annexure Q), SHE evidence (Annexure S) and Schedule Q evidence (Annexure R).
• COIDA certificate of good standing or proof of application (South African tenderers).
• Financial due diligence documents as set out in the financial requirements.

Disqualification risks

• Any disqualifiable returnable left unsigned, incomplete or absent at closing.
• Failure to upload tender documents on the e-tendering system, which makes the tender non-responsive.
• Submission after the closing time.

Returnable documents

• Disqualifiable at closing: electronic copy of the tender, Annexure A Authorisation Form, Annexure B Acknowledgement Form, Annexure C Tenderer's Particulars, Annexure D Integrity Declaration Form, Annexure E CPA for local goods and services, Annexure F CPA(IG) for imported goods and services, Annexure H SBD 1, Annexure J SBD 4 Bidder's Disclosure, Annexure K Tax Evaluation Questionnaire, Annexure L NEC documentation and Annexure M Pricing Schedule in Excel format.
• Non-disqualifiable at closing, remediable within 5 working days of a written request: Annexure I SBD 6.1 Preference Points Claim, tax clearance certificate where required, and the tax evaluation questionnaire.
• Scored zero if not submitted at closing: proof of the specific goals claim.
• Joint venture tenders must also submit the letter of intent or valid joint venture agreement with rights, obligations and profit-sharing ratios, written confirmation that the joint venture will operate as a single business entity for the contract duration, and confirmation of a single designated joint venture bank account independent of the individual partners.
• Required before award: proof of valid and current CSD registration, SDL&I evidence (Annexure P), quality evidence (Annexure Q), SHE evidence (Annexure S), Schedule Q evidence (Annexure R), COIDA certificate or proof of application, and financial due diligence documents.
• Functionality documents: Annexure N1 Scope of Work and Annexure N2 Technical Evaluation Criteria.
• Submission is electronic only through https://eTendering.eskom.co.za, uploaded under the Technical, Commercial, Financial and other folders in PDF format, with the price list in electronic format; no zip or compressed files and no hard copies are accepted.
• If a tender is resubmitted, only the latest version is accepted and earlier submissions become null and void; the submission status must be marked complete.

Evaluation stages

• Functionality applies, scored out of 100% with a minimum threshold of 80%.
• Stage one: desktop technical evaluation, minimum 80% to pass.
• Stage two: demonstration, minimum 80% to pass; only bidders passing stage one are invited.
• Bidders below 80% at either stage are disqualified.

Functionality criteria and weights

• Threat-blocking efficacy of at least 87% for malware and 80% for phishing, false positives averaging no more than 2%, independently validated: 4%.
• Local point of presence for low-latency resolution and data residency compliance: 3%.
• Agentless on-premises deployment: 3%.
• Access Guard feature continuously evaluating firewall, proxy and DNS security policy performance: 5%.
• Integration with existing security ecosystems for automated incident response and correlation: 4%.
• Operation without acting as an inline DNS relay, using passive analysis: 5%.
• Predictive domain risk scoring using threat intelligence: 4%.
• Enhanced visibility into DNS tunnelling: 4%.
• Attribution of malicious activity to infrastructure, including threat actor TTPs and infrastructure mapping: 4%.
• Incident response support with historical DNS data, 12 months of real-time correlation and archival up to 10 years: 5%.
• Ruleset-based policy management: 3%.
• Location-based policy management: 4%.
• Cross-platform agent support: 3%.
• Real-time global DNS propagation monitoring across 50 or more anycast nodes: 3%.
• Dynamic TTL adjustment reducing propagation delays by 70% during migrations: 3%.
• Correlation of DNS query patterns with threat feeds such as DNSBL and MITRE ATT&CK: 4%.
• Automated DNS zone transfers (AXFR/IXFR) with cryptographic validation and conflict resolution: 3%.
• Policy-as-code for DNS records (CAA, DKIM, DMARC) with automated remediation and audit reporting: 3%.
• Disruption of command-and-control communications for malware-less attacks: 4%.
• Centralised DNS log aggregation with real-time search and compliance-ready storage: 3%.
• Detection of suspicious traffic in VPN/ZTNA tunnels correlated to the originating user or endpoint: 3%.
• Behavioural and machine-learning detection of DNS tunnelling and exfiltration in real time: 3%.
• Out-of-the-box integration with Active Directory, DHCP and DNS Server: 4%.
• Simulation of detection and prevention for zero-day domains, botnets, phishing, malware, TOR traffic, malicious domains and newly registered domains: 5%.
• Filtering of DNS queries by domain registrar details: 3%.
• Real-time threat-intelligence classification of domains: 5%.
• Native integration with VPN/ZTNA services: 3%.
• Total: 100%; threshold: 80%.

Price and preference points

• Price is scored out of 80 or 90 points; specific goals out of 20 or 10 points under the PPPFA.
• Prices are evaluated inclusive of VAT, corrected for arithmetical errors, excluding contingencies in any bill of quantities or activity schedule, adjusted for acceptable variations or deviations, and compared on a net present value basis.
• Unconditional discounts count for evaluation; conditional discounts are applied when payment is made.
• Tenders are ranked on the 80/20 or 90/10 preference system, with price and specific goals scores added together.
• Where it is unclear which preference system applies, the lowest acceptable tender determines it.
• Failure to submit proof of a specific goals claim scores zero for that goal but does not disqualify the bidder.
• Objective criteria and reverse e-auction are not applicable.
• Contractual requirements are not evaluation criteria; they are assessed after evaluation and ranking.
• Eskom may negotiate with preferred bidders where tendered prices are not market-related.

Scope

• Managed DNS security services for Eskom over five years: one year of implementation followed by four years of maintenance and support.
• The solution must be based on purpose-built hardware and cover DNS, DNSSEC, DHCP, FTP, TFTP, HTTP, HTTPS and NTP, supported by a real-time database managed centrally through the IP Address Management service.
• A dedicated project manager is required for the implementation phase.
• Detailed scope: Annexure N1; technical evaluation criteria: Annexure N2.

Implementation phases

• Planning; design and configuration; build and development; integration into the Eskom estate; testing; data migration where applicable; deployment and go-live; post-implementation support.

Core capabilities

• DNS firewall protection against DNS malware.
• Hardware high availability for all enabled services, plus protocol HA covering DHCP failover, DNS, TFTP/HTTP, NTP and Syslog.
• Geographical redundancy across data centre and disaster recovery.
• Compliance with DNSSEC and IPv6.
• Network discovery for L2/L3 devices and connected endpoints; network configuration change and management automation; network policy and compliance enforcement.
• Integrated DNS traffic control and Global Server Load Balancing to distribute traffic across data centres and support disaster recovery and remote failover.
• Real-time threat detection through DNS query analysis; DNS traffic behaviour and anomaly detection.
• Access Guard reporting on firewall, proxy and DNS security performance, including malicious traffic blocked or missed.
• One-click identification of infected devices and DNS-level infected device detection.
• Real-time visibility of MAC address, username, source IP, device name and host name.
• Agentless DNS log collection with at least one year of retention and one year of real-time search; reporting daily, weekly and monthly.
• On-premises deployment with full administrative control; detection of domains seen for the first time in the organisation.
• Out-of-the-box integration with existing firewall, proxy, NDR, SIEM, IPS, AI threat detection, Active Directory, DHCP and DNS Server; native VPN/ZTNA integration; bidirectional EDR/XDR integration; SOAR and API integration.
• Rule filtering by category, client IP, CNAME/CNAME domain/CNAME TLD, CVE, device name, DoH and DoT, domain and domain age, domain TLD, FQDN, IP and IP country, nameserver attributes, open port, proxy IP, query type, domain registrar, status and username.
• Customisable blacklists and whitelists with category-based content filtering; DNS encryption (DoH/DoT) with detection of hidden malicious DNS traffic; customisable, exportable reports and pre-built long-term network reporting.
• Predictive domain risk scoring using threat intelligence; correlation of DNS query patterns with threat feeds such as DNSBL and MITRE ATT&CK; real-time threat-intelligence domain classification; filtering by domain registrar details.
• Enhanced visibility into DNS tunnelling and behavioural, machine-learning detection of tunnelling and exfiltration in real time.
• Attribution of malicious activity to infrastructure, including threat actor tactics, techniques and procedures and infrastructure mapping.
• Incident response support with historical DNS data: 12 months of retained data for real-time correlation and archival up to 10 years on optimised storage.
• Ruleset-based and location-based policy management; cross-platform agent support.
• Real-time global DNS propagation monitoring across 50 or more anycast nodes with predictive analytics; dynamic TTL adjustment cutting propagation delays by 70% during migrations.
• Automated DNS zone transfers (AXFR/IXFR) with cryptographic validation and conflict resolution.
• Policy-as-code for DNS records (CAA, DKIM, DMARC) with automated violation remediation and audit reporting for standards such as PCI-DSS.
• Disruption of command-and-control communications for malware-less attacks, including non-standard protocols such as Microsoft Teams or Azure DNS.
• Centralised aggregation of DNS logs from multiple sources with real-time search, correlation and compliance-ready storage.
• Detection and correlation of suspicious traffic inside VPN/ZTNA tunnels to the originating user or endpoint.
• Simulation of detection and prevention for zero-day domains, botnets, phishing, malware, TOR traffic, malicious domains and newly registered domains.
• Continuous security gap reporting; image-based anti-phishing; crypto-mining domain classification; global and built-in threat intelligence feeds; proactive threat hunting.
• Deployment as on-premises, cloud or hybrid; agent and agentless options; roaming client support; iOS and Android support.
• Compatibility with Windows, macOS, Linux, iOS and Android; scalability for high DNS traffic volumes without affecting network performance.
• Automatic threat remediation, including blocking suspicious DNS requests and quarantining infected devices; prevention of data exfiltration.

Performance and certification

• Independently validated threat-blocking efficacy of at least 87% for malware and 80% for phishing, with false positive rates averaging no more than 2%.
• AV-Test DNS Security success rate of 80% or higher in all test reports within the last three years, and performance at or above industry benchmarks in independent testing over the last two years.
• SOC 2 compliance for data protection and privacy.

Submission and compliance basics

• Where performance security is required as a bond or demand guarantee, the tenderer must name at least two financial institutions it is likely to approach from Eskom's list of approved institutions.
• Tenders are opened electronically; there is no public opening and prices are not read out.
• Basic compliance requires meeting the eligibility criteria, submitting a complete tender with commercial, financial and technical information, and submitting the mandatory commercial returnables by the stated deadlines.

Quality requirements

• Quality requirements apply and are set out in Annexure P and the Quality Folder.
• Quality is an additional contractual requirement requiring supporting evidence.
• Quality evidence is assessed after evaluation and ranking, with proof submitted before contract award.

Pricing schedule

• A complete Pricing Schedule (Annexure M) must be submitted in Excel format.
• The price list must be submitted in electronic format.
• Upload limits: 500 MB per document and 4 GB for the total submission.
• Where cataloguing is required, the Pricing Schedule must include a cataloguing line item for the tenderer to quote; Eskom pays for cataloguing.

Pricing

• A complete Pricing Schedule (Annexure M) must be submitted in Excel format; the price list must be submitted electronically.
• Prices are evaluated inclusive of VAT.
• Where cataloguing is required, the Pricing Schedule must include a cataloguing line item for the tenderer to quote; Eskom pays for cataloguing.

Payment terms

• Contracts valued below R50 000 000 including VAT: payment within 30 days of receipt of undisputed invoices.
• Contracts valued above R50 000 000 including VAT: payment within 60 days of receipt of undisputed invoices.

Performance security

• Where a performance bond or demand guarantee is required, the tenderer must name at least two financial institutions it is likely to approach from Eskom's list of approved institutions.

Financial due diligence (required before award)

• Latest approved annual financial statements of the tendering company itself, not the parent or ultimate holding company; draft statements and management accounts are not accepted.
• Statements must include background to the company, a signed director's report, a signed auditor's, reviewer's, compiler's or accounting officer's report, statement of financial position, statement of comprehensive income, statement of changes in equity, statement of cash flows and notes.
• South African entities that are not audited must also submit a signed public interest score giving the actual score, stating whether the company is owner managed and confirming whether the annual financial statements were externally prepared, plus copies of the ITA34C for the current and previous years of assessment.
• For an unincorporated joint venture or special purpose vehicle, each partner must submit its own annual financial statements covering all of the above.

Registration and tax

• Proof of valid and current CSD registration (CSD number or CSD report) is mandatory; a contract will not be awarded to a tenderer not registered on the CSD, except foreign suppliers with no locally registered CIPC entity.
• Local tenderers must provide a SARS e-filing PIN for verification by Eskom and/or their CSD profile or CSD number.
• A certified copy of a tax clearance certificate is required from foreign tenderers with a South African footprint that are not registered on the CSD and have not provided a SARS PIN.
• Foreign suppliers with no South African footprint must complete SBD 1 but need not provide proof of tax compliance.

B-bbee

• B-BBEE status must be proven by a certificate issued by an authorised body or person, a sworn affidavit prescribed by the B-BBEE Codes of Good Practice, or another requirement prescribed under the Broad-Based Black Economic Empowerment Act.
• Specific goals are scored out of 20 or 10 points under the PPPFA; failure to submit proof scores zero for that goal without disqualification.
• Supplier Development, Localisation and Industrialisation requirements are set out in Annexure O.

Other statutory evidence

• Employment Equity: tenderers that are designated employers under the Employment Equity Act must provide proof of compliance and proof of submission of the Employment Equity report to the Department of Labour (South African tenderers only).
• COIDA: original certificate of good standing, or proof of application, issued by the Compensation Fund or a licensed compensation insurer (South African tenderers only).
• CIDB requirements are not applicable to this tender.

Eligibility disqualifiers

• Nationality of a country on an international sanctions list, which also applies to proposed subcontractors and suppliers.
• Submitting more than one tender, individually or as a joint venture or consortium partner.
• A joint venture or consortium agreement that does not state that the parties are jointly and severally liable for executing the contract.
• Any conflict of interest, including a common controlling partner or majority shareholder, or a relationship giving access to another tenderer's tender or influence over the employer's decisions.
• A tender signed by an unauthorised person.
• Restriction by National Treasury or Eskom, or listing on the Tender Defaulters list.
• Subcontracting 100% of the scope of work.
• Alternative tenders are not allowed.

Basic compliance

• Meeting the eligibility criteria, submitting a complete tender with commercial, financial and technical information, and submitting the mandatory commercial returnables by the stated deadlines.
• Failure to upload tender documents on the e-tendering system renders the tender non-responsive.
• Main contractors and suppliers are discouraged from subcontracting to their own subsidiaries, which may be treated as fronting; any such subcontracting must be declared in the tender documents.

B-BBEE and specific goals

• B-BBEE status must be proven by a certificate issued by an authorised body or person, a sworn affidavit prescribed by the B-BBEE Codes of Good Practice, or another requirement prescribed under the Broad-Based Black Economic Empowerment Act.
• Specific goals are scored out of 20 or 10 points under the PPPFA.
• Proof of a specific goals claim may be submitted at tender closing; failure to submit it does not disqualify the tenderer but scores zero for specific goals in the PPPFA scoring and ranking.
• Supplier Development, Localisation and Industrialisation requirements are set out in Annexure O.

Safety, health and environmental requirements

• SHE requirements apply and are set out in Annexure Q, with Schedule Q in Annexure S.
• South African tenderers must submit an original COIDA certificate of good standing, or proof of application, issued by the Compensation Fund or a licensed compensation insurer.
• SHE evidence is an additional contractual requirement assessed after evaluation and ranking, with proof submitted before contract award.

Additional solution capabilities

• Continuous security gap reporting on the DNS security service to support proactive risk mitigation.
• One-click detection and isolation of compromised devices.
• Image-based anti-phishing using AI models and domain reputation analysis.
• Classification and blocking of crypto-mining domains.
• Global threat intelligence feed of known malicious domains and IPs, plus built-in proprietary and open-source intelligence feeds.
• Proactive threat hunting tools for the DNS layer.
• Deployment as on-premises, cloud or hybrid with minimal configuration; agent and agentless options.
• Protection and visibility for roaming and off-network users; iOS and Android support.
• Cloud-based protection for DNS traffic and on-premises reporting with compliance-friendly logging.
• Bidirectional EDR integration; SOAR and API integration for automated response workflows.
• Content filtering and policy management, granular rule creation, and advanced dynamic and static allow and block lists with URL threat feeds.
• Multi-tenant architecture suitable for managed service providers.
• Demonstrated AV-Test performance and compliance with industry best-practice frameworks for data protection and privacy.

Contract conditions

• The contract will be based on the NEC3 Professional Services Contract or the Supplier's Agreement.
• Tenderers must be fully compliant with the tender requirements and the contract to be entered into.
• Where a performance bond or demand guarantee is required, the tenderer must name at least two financial institutions it is likely to approach from Eskom's list of approved institutions.
• Proof of CSD registration is a mandatory contractual requirement; a contract will not be awarded to a tenderer not registered on the CSD, except foreign suppliers with no locally registered CIPC entity.
• Contractual requirements are not evaluation criteria; they are assessed after evaluation and ranking and proof of compliance must be submitted before contract award.
• Failure to meet contractual requirements by the stated deadlines may render the tenderer non-responsive and ineligible for award.
• Payment terms: contracts below R50 000 000 including VAT are paid within 30 days of receipt of undisputed invoices; contracts above R50 000 000 including VAT within 60 days.
• Main contractors and suppliers are discouraged from subcontracting to their own subsidiaries, which may be treated as subcontracting with themselves or fronting; any such subcontracting must be declared in the tender documents, and a list of potential subcontractors can be drawn from www.csd.gov.za.
• Tender validity is 12 months (365 days) from the closing date and time.
• The tender is for the whole of the contract.

Eligibility and compliance

• Tenderers, whether a single company or an incorporated or unincorporated joint venture or consortium, must meet the eligibility criteria in the Tender Data, and neither the tenderer nor its principals may be restricted from doing business with Eskom or state-owned companies.
• Ineligible: tenderers with the nationality of a country on an international sanctions list, which also applies to proposed subcontractors and suppliers.
• Ineligible: submitting more than one tender, individually or as a joint venture or consortium partner.
• Ineligible: a joint venture or consortium tender whose agreement does not state that the parties are jointly and severally liable for executing the contract.
• Ineligible: any conflict of interest, including a common controlling partner or majority shareholder, or a relationship giving access to another tenderer's tender or influence over the employer's decisions.
• Ineligible: tenders signed by an unauthorised person.
• Ineligible: tenderers restricted by National Treasury or Eskom, or listed on the Tender Defaulters list.
• Ineligible: subcontracting 100% of the scope of work.
• Basic compliance requires meeting the eligibility criteria, submitting a complete tender with commercial, financial and technical information, and submitting the mandatory commercial returnables by the stated deadlines; failure to upload tender documents on the e-tendering system makes the tender non-responsive.
• A tenderer that does not submit mandatory documents, or complete information in them, by the stated deadlines is deemed non-responsive.
• Alternative tenders are not allowed.

Technical evaluation

• Functionality applies, scored out of 100% with a threshold of 80%.
• Two stages: stage one desktop evaluation, stage two demonstration. Bidders must reach 80% in the desktop stage to be invited to demonstrate; bidders below 80% at either stage are disqualified.
• Weighted criteria include threat-blocking efficacy (at least 87% malware, 80% phishing, false positives no more than 2%, independently validated) at 4%; local point of presence 3%; agentless on-premises deployment 3%; access guard monitoring of firewall, proxy and DNS policies 5%; integration with existing security ecosystems 4%; operation without inline DNS relay using passive analysis 5%; predictive domain risk scoring 4%; DNS tunnelling visibility 4%; attribution of malicious activity to infrastructure 4%; historical DNS data with 12 months real-time correlation and archival up to 10 years 5%; ruleset-based policy management 3%; location-based policy management 4%; cross-platform agent support 3%; global DNS propagation monitoring across 50 or more anycast nodes 3%; dynamic TTL adjustment 3%; correlation with threat feeds such as DNSBL and MITRE ATT&CK 4%; automated zone transfers (AXFR/IXFR) 3%; policy-as-code for CAA, DKIM and DMARC 3%; disruption of command-and-control communications 4%; centralised DNS log aggregation 3%; VPN/ZTNA tunnel traffic detection 3%; behavioural and machine-learning tunnelling detection 3%; Active Directory, DHCP and DNS server integration 4%; simulation of detection and prevention for zero-day domains, botnets, phishing, malware, TOR traffic, malicious domains and newly registered domains 5%; filtering by domain registrar details 3%; real-time threat-intelligence domain classification 5%; native VPN/ZTNA integration 3%.
• Price is scored out of 80 or 90 points and specific goals out of 20 or 10 points, ranked on the 80/20 or 90/10 preference system.
• Objective criteria, reverse e-auction, CIDB requirements, Contract Skills Development Goals and Contract Participation Goals are not applicable.

eTendering system

• Web-based platform that replaces physical submission of tender documents at Eskom tender offices; suppliers upload their bids electronically.
• Suppliers must register their details before access is granted; an OTP is sent to the registered cell phone and email.
• Public access points: the Tender Bulletin site (https://tenderbulletin.eskom.co.za) to view published tenders, and the eTendering site (https://eTendering.eskom.co.za) to view tender information and submit documents.
• A CSD number is required to access the eTendering system.
• Closed tenders: tenders not listed on the Tender Bulletin are sent directly to selected potential suppliers, who receive a private bidding link by email.
• System problems: contact the buyer responsible for the published tender.

Submission channel

• Electronic submission only, through the Eskom eTendering portal: https://eTendering.eskom.co.za
• The portal is reached via the Tender Bulletin public site: https://tenderbulletin.eskom.co.za
• A CSD number is required to gain access to the eTendering system.

Registration and login

• Register supplier details, verify the email address, then log in with the registered email address and password.
• A one-time PIN (OTP) is sent to the registered cell phone and email; enter it to verify.
• Contact numbers must be entered with a plus prefix, e.g. +27.

Uploading the bid

• Select the relevant tender reference number, then click 'Create New Submission'.
• Upload each document under 'Add file', giving the file a name and selecting the correct category (Technical, Commercial, Finance).
• Verify all required documents are uploaded before clicking 'Finalize Submission', then 'Finalise and Close Submission'. Use 'No, continue adding files' to add further documents.

Size limits

• Individual file: maximum 50MB.
• Total of all uploaded files: maximum 900MB.

Confirmation

• On finalisation an automated email lists the submitted files, the submission ID and the submission and closing timestamps; keep the submission ID for future enquiries.
• Submitted documents can be viewed or verified under 'My Submissions' using 'View Submission'.

System problems

• Where difficulties arise with the Tender Bulletin, eTendering or OpenText systems, contact the buyer responsible for the published tender.

Submission process

• Tender documents are submitted electronically through the Eskom eTendering portal (https://eTendering.eskom.co.za), reached via the Tender Bulletin public site (https://tenderbulletin.eskom.co.za).
• A CSD number is required to access the system.
• Register supplier details, verify the email address, and log in with an OTP sent to the registered cell phone and email.
• Select the relevant tender reference number, click 'Create New Submission', and upload documents using 'Add file', naming each file and selecting the correct category (Technical, Commercial, Finance).
• Confirm all required documents are uploaded before clicking 'Finalize Submission' and then 'Finalise and Close Submission'; use 'No, continue adding files' to add more.
• Individual file limit: 50MB. Total upload limit: 900MB.
• On finalisation an automated email lists the submitted files, the submission ID and the submission and closing timestamps; save the submission ID for future enquiries.
• Submitted tenders can be viewed or verified under 'My Submissions' using 'View Submission'.

CSD registration

• A CSD number is required to gain access to the Eskom eTendering system and to submit a bid.

System support

• For difficulties with the Tender Bulletin, eTendering or OpenText systems, contact the buyer responsible for the published tender.

Procurement of DNS security managed services: 5 years total (1 year implementation + 4 years maintenance and support).

Closing date and time: 03 November 2026 at 10:00 (SAST).

Enquiries:

• Contact: Eskom Representative (name not provided in source)
• Email: not provided in source
• Telephone: not provided in source

Submission address: as stated in Tender Data; for e-tendering via Eskom Tender Bulletin site.

Submission method: E-tendering via Eskom Tender Bulletin site (Eskom E-tendering page). Physical submission only if expressly permitted.

• Outer package must be marked "Confidential" with the invitation number, tenderer's name and address, and the authorised representative's contact details.
• For physical tenders: submit one original and one complete copy, packaged separately as "ORIGINAL" and "COPY"; an additional electronic copy may be requested.
• Sign all documents; alterations must be initialled by all signatories. No correction fluid or tape.
• Mandatory returnables must be submitted by closing date and time; no late or post-closing submissions accepted.
• Tender validity: hold tender valid for acceptance for the period stated in the Tender Data; extend if requested.
• Communication only through the Eskom Representative, in writing.
• Returnable forms: SBD 4 (Declaration of Interest) — disclose any state employment or connection; SBD 9 (Certificate of Independent Bid Determination) — certify no collusion; SDL&I Undertaking — submit by contract award; Authority to act as agent — authenticated copy if an agent submits.

Evaluation stages:

1. Basic compliance: mandatory returnables and documents; failure leads to disqualification.
2. Pre-qualification criteria: if stipulated (e.g., B-BBEE level, CIDB grading); must be met at closing.
3. Functionality: if applicable, scored against criteria; must meet minimum threshold stated in Tender Data.
4. Financial analysis: risk assessment of tenderer's financial statements; high risk may lead to exclusion.
5. Price evaluation: per PPPFA 90/10 or 80/20 point system; arithmetical errors corrected as per rules.
6. Specific Goals: scored with supporting documentation; zero points if not submitted by closing.
7. Ranking: add price score and Specific Goals score; highest ranked wins unless objective criteria apply.

• B-BBEE: if pre-qualification, proof (certificate/CSD number/report) required at closing; else score zero but not disqualified.
• Sub-contracting: 100% sub-contracting not permitted; B-BBEE status of sub-contractors needed if designated groups.
• Reverse e-auction: if used, complete tender without prices; prices will not be considered.

Procurement of DNS security managed services for 5 years: 1 year implementation, 4 years maintenance and support.

• Scope: supply and delivery of DNS security managed services.
• Service delivery: likely at Eskom locations; detailed in Tender Data (not extracted).

Pricing schedule: Include all duties, taxes (including VAT), levies. Prices fixed for contract duration; state in ZAR. Exchange rate and base date as per Tender Data. Include cataloguing line item. Arithmetical errors: amount in words prevails; decimal point errors corrected per rules.

Pricing:

• Include all duties, taxes (including VAT), levies in rates and prices.
• Prices fixed for contract duration; state in South African Rand.
• Exchange rate and base date as stipulated.
• No compensation for tender preparation costs.
• Insurance: Eskom may not provide full cover; tenderer to seek advice.
• Security for performance: provide names of at least two financial institutions for security.
• Cataloguing: provide line item for cataloguing; Eskom pays.
• SHEQ costs must be reflected in tender.

CSD registration: Central Supplier Database number/report must be provided at closing where required.

Tax compliance: valid tax pin/CSD report; non-compliance may lead to disqualification.

B-BBEE: certificate/affidavit/CSD report as required; level determines points.

CIDB: if stipulated, registration at closing or application proof with actual proof by contract award.

SHEQ: proof of safety, health, environment, quality systems at closing and/or contract award.

Designated materials: submit information on designated local content thresholds by contract award.

Contract Skills Development Goals (CSDG): applicable to contracts ≥ R5 million or CIDB grade ≥7; must achieve.

Contract Participation Goals (CPG): applicable to construction works; must achieve targeted enterprise engagement.

Comply with PPPFA, B-BBEE Codes, COIDA, OHS Act, CIDB regulations, NT instructions.

B-BBEE: Level as per CSD report or certificate/affidavit. If pre-qualification, proof at closing; else disqualification. If scoring, absence results in zero points for B-BBEE but not disqualification. Sub-contractor B-BBEE status required for designated groups.

SHEQ: Provide proof of safety, health, environment and quality systems, policies and capabilities at closing and/or contract award. All costs and personnel for SHEQ must be in tender. Compliance with OHS Act and Eskom SHEQ requirements.

Contract terms per Eskom Standard Conditions of Tender. Tenderer must sign Form of Agreement; contract prepared to include addenda and returnables. Validity period may be extended; failure to extend leads to exclusion. Eskom may negotiate with any tenderer.

Eligibility: no 100% sub-contracting; must meet pre-qualification criteria if stated; no restriction from doing business with Eskom. Proof of authority for agents. Compliance with legislation (PPPFA, CIDB, B-BBEE, COIDA, OHS).

Additional: Financial analysis - risk assessed; if too high, exclusion. Functionality - minimum threshold required. Specific Goals - zero points if no proof by closing. Ranking per PPPFA. Objective criteria only under section 2(1)(f).

The tender seeks a provider for Domain Name System (DNS) security managed services over a five-year period, comprising one year of implementation and four years of maintenance and support.

Scoring for specific goals: A maximum of 10 points (90/10 system) or 20 points (80/20 system) may be awarded for the specific goal specified. These points are added to price pointshol, and the total is rounded to two decimal places. Award is made to the tenderer with the highest total, subject to section 2(1)(f) of the Preferential Procurement Policy Framework Act.

Specific goals relate to SDL&I (Supplier Development, Localisation, and Industrialisation) objectives, including local procurement content, procurement from black-owned entities, job creation, and skills development.

Returnable documents for preference points:

• Valid B-BBEE certificate issued by a SANAS accredited verification agency, or a sworn affidavit (EME/QSE qualifying), or a CIPS affidavit.
• Proof of ownership/shareholding (preferably CIPC documentation) with shareholding breakdown.
• Certified ID copies of shareholder(s).
• Proof of Disability (where applicable).

Note: Eskom will not accept a Sworn Affidavit with an electronic signature.

Tenderers who do not provide documentation for preference points will not be disqualified, but:

• May only score points out of 90/80 for price.
• Score 0 points out of 10/20 for specific goals.

Submission method and address: Not stated in the provided text.

Evaluation method:

• Preference point system: 90/10 or 80/20 (as applicable).
• Price points and specific goal points are added; total rounded to two decimal places.
• Award to tenderer scoring the highest total points, subject to section 2(1)(f) of the PPPFA.

Specific goal (SD&I):

• Maximum 10 points (90/10 system) or 20 points (80/20 system) for specific goals.
• These points are added to price points.

Objective criteria:

• Not mandatory to submit, but a condition for contract award.
• Failing to meet objective criteria may lead to the second-ranked tenderer being recommended for award.

SDL&I objectives:

• Do not form part of scoring but commitments become contractual obligations.
• Tenderers completing and submitting objectives but not meeting Eskom's targets are not disqualified.

B-BBEE points for specific goals (as per table):

• Level 1: 10 (90/10), 20 (80/20)
• Level 2: 9, 18
• Level 3: 6, 14
• Level 4: 5, 12
• Level 5: 4, 8
• Level 6: 3, 6
• Level 7: 2, 4
• Level 8: 1, 2
• Non-compliant: 0, 0

Scope: Domain Name System (DNS) Security Managed Services.

Duration: 5 years total — 1 year implementation, 4 years maintenance and support.

Local procurement content:

• Tenderers must separate local and imported components as per the Price Schedule.
• Local procurement content is total spend minus imported component.
• Tenderers must submit proposals in the provided table, considering source of origin (e.g., country of software copyright registration, hardware manufacturing, citizenship of resources).

Procurement spend on entities with at least 51% black ownership:

• Tenderers encouraged to procure/spend on designated groups for indirect expenses (overheads) and direct subcontracting spend.
• Record activities subcontracted to designated black-owned enterprises in the table.

Jobs:

• Tenderers must propose the type and number of jobs to be created and retained in South Africa as a result of the contract.

Skills development (SDL&I):

• Tenderers must identify and develop unemployed graduates from universities, schools, and TVET campuses.
• Skills profiles list includes: Agile change agents, Agile product management, application development practitioners, architecture practice, business analysis, computational science, data engineering/operations/science, DevOps, digital, user experience, service design, technology finance/procurement, organisation design, resource management, incident management, security leadership/operations/risk, teaching, learning & development, project delivery, service operations/strategy/architecture, software engineering, infrastructure engineers, infrastructure platform management, testing.
• Obligation: skill one candidate for every R2 million spend cumulatively through purchase orders/instructions.
• Proof required: letter of competence, proof of attendance, service contract, or certificate of compliance.
• Implementation within one month after threshold is reached.
• Candidates from all provinces; composition representative of South African demographics.
• Skills development may involve tenderers directly and their supply network; SETA accredited training providers may be approached.
• Tenderers bear full cost of skills development; Eskom makes no financial contribution. Tenderers advised to approach SETAs for grants and SARS for tax rebates.

Security/retention for SDL&I obligations:

• Eskom will retain 2.5% of every invoice amount (excluding VAT) if the tenderer fails to submit SDL&I performance reports biannually or fails to meet SDL&I obligations.
• Retained amounts released only upon compliance, as determined by Eskom's review of reports.
• Reports submitted using the Data Collection Template.
• Eskom reviews reports within 60 days of receipt and notifies in writing of non-compliance.
• Suppliers must implement corrective measures before the next report, failing which retention clauses are invoked.

B-BBEE requirements:

• Valid B-BBEE certificate / sworn affidavit is a condition for contract award.
• Annual total revenue R10 million or less (EME): may submit a sworn affidavit.
• Annual total revenue R50 million or less (QSE): must comply with all elements of QSE scorecard relevant to sector, unless at least 51% black owned, then sworn affidavit acceptable.
• Annual total revenue above R50 million: must submit a valid B-BBEE certificate.

Sworn affidavit validity requirements:

• Deponent's name and ID number as per identity document.
• Designation (director, owner, member) indicated.
• Enterprise name as per CIPC registration documents and business address.
• Percentage of black ownership, black female ownership, designated group (or black beneficiaries for specialised enterprises under Statement 004). No blank spaces.
• Total revenue for year under review, indicating whether based on audited financial statements or management accounts.
• Financial year end (day/month/year).
• B-BBEE status level (only one level).
• Empowering supplier status; for QSEs, basis for empowering supplier status.
• Deponent's signature date and Commissioner of Oath's signature date must be the same.
• Commissioner of Oath must sign and stamp; cannot be an employee or ex officio of the enterprise.

B-BBEE improvement/retention plan:

• Submit within 30 days of signing the contract.
• Level 1: maintain.
• Level 2 or 3: maintain/improve as per proposal.
• Level 4 at award: must achieve Level 3 by end of first year, then improve one level per year thereafter.
• Level 5-8 or non-compliant at award: must achieve Level 4 by end of first year, then improve at least one level per year from second year.

Objective criteria: not mandatory but a condition for contract award.

The form is a quality requirements acknowledgement for the provision of Domain Name System (DNS) Security Managed Services, spanning implementation, maintenance and support over five years: one year of implementation followed by four years of maintenance and support. The bidder must complete and sign the form to acknowledge and accept Eskom's Supplier Quality Requirements as set out in specification 240-105658000 and the ISO 9001 standard.