Provision of network perimeter firewall security hardware – gauteng tender (fsca)

Closing: 05 November 2026 at 11:00 (South African Standard Time).

Briefing session: 14 October 2026 at 11:00 — non-compulsory, maximum 1 hour, Microsoft Teams link on FSCA website.

Enquiry deadline: 16 October 2026 (questions in writing to [email protected]).

Bid validity: 120 days from closing, expiring 05 March 2027.

Estimated process dates:

• Compliance evaluation: 10 November 2026
• Functional evaluation: 13 November 2026
• Preference points: 16 November 2026
• Award: 26 November 2026
• Notification to bidders: 04 December 2026

Non-compulsory briefing session on 14 October 2026 at 11:00, maximum 1 hour, via Microsoft Teams. Link on FSCA website.

Administrative enquiries:

• Contact: Nobusi Mazwai
• Department: Supply Chain Management
• Telephone: (012) 422 2855 / (012) 367 7847
• Email: [email protected]

Content enquiries (conditions, rules, terms of reference):

• Email: [email protected]
• Deadline: 16 October 2026
• Questions must reference specific paragraph numbers.

Submission address:

Financial Sector Conduct Authority

Riverwalk Office Park, Block B

41 Matroosberg Road (Corner Garsfontein and Matroosberg Roads)

Ashlea Gardens, Extension 6

Menlo Park, Pretoria, 0081

GPS: Latitude -25.7843344, Longitude 28.268365

Submission method: physical only — place in the bid box at the FSCA reception or courier to the physical address. Bids sent by email, fax, telex or other electronic means will not be considered.

Packaging and marking:

• Two printed copies (one original, one copy) plus one electronic copy on a flash drive in PDF format.
• All bound in a sealed envelope marked with the bid number and bid name.
• Each page initialled in the bottom right-hand corner.
• Completed in blue or black ink; no correction fluid — changes must be scratched out and signed.

Returnable forms (all must be completed and signed):

• SBD 1 (Invitation to Bid): bidder and contact details, signed as the offer cover page.
• SBD 3.1 (Pricing Schedule): fixed prices, submitted on a separate sheet adjacent to the form.
• SBD 4 (Bidder's Disclosure): declares any interest or connection with the state.
• SBD 6.1 (Preference Points Claim): claims specific goal points; if not signed, 0 points for specific goals.

Disqualification risks:

• Late submissions, regardless of reason.
• Incomplete or unsigned returnable forms.
• Unauthorised alterations to bid documents.
• Bids with qualifications.
• Fraudulent or untrue information.
• Failure to meet mandatory pre-qualification criteria.

Mandatory forms: SBD 1 (Invitation to Bid), SBD 3.1 (Pricing Schedule), SBD 4 (Bidder's Disclosure), SBD 6.1 (Preference Points Claim). Failure to complete and sign any may lead to disqualification.

Evaluation stages:

1. Compliance: administrative and mandatory requirements — failure disqualifies.
2. Functional (desktop): minimum 80 out of 100 points to proceed.
3. Preference points: 80/20 system (80 price, 20 specific goals).
4. Site inspection: at FSCA's discretion; inconsistent information disqualifies.

Functional scoring (100 points total):

• Detailed proposal (40 points): how the solution will be deployed per scope.
• Track record (30 points): contactable reference letters for FortiGate end-to-end implementations.
• Deployment plan (30 points): detailed plan with turnaround timelines.

Price formula (80/20): Ps = 80(1 − (Pt − Pmin)/Pmin).

Specific goals (20 points):

• Youth ownership of 51% or more: 10 points.
• Enterprises owned by 51% or more black people: 10 points.
• Proof (B-BBEE certificate, sworn affidavit, CIPC) must be attached; otherwise 0 points.

Scope: Supply, install and configure Fortinet network perimeter firewall security hardware, plus business and managed support services for 5 years.

Equipment (TABLE 1):

• 2x FortiGate-401F (HA pair) with 5-year FortiCare Premium and FortiGuard UTP (PROD).
• 1x FortiGate-101F with 5-year FortiCare Premium and FortiGuard UTP (DR).
• 1x FortiAnalyzer-VM subscription license (5 years, 50 GB/day logging and analytics).
• 35x FortiAP-U231F indoor wireless access points (tri-radio).
• 35x 5-year 24x7 FortiCare contracts for the access points.
• 12x 10GE SFP+ transceiver modules.
• Professional services (6 weeks): architecture documentation, assessment, network and fibre cabling, implementation, removal of aged equipment.
• Business and managed support services (5 years).

Deliverables:

• Review and document current Check Point and Fortinet perimeter network, including segmentation, VPN, IPSec tunnels, wireless infrastructure and NAT rulesets.
• Prepare high-level and low-level designs with sign-off before implementation.
• Prepare and sign off as-built design after implementation.
• Deinstall aged Check Point firewall and Fortinet wireless equipment after new solution is live.

Installation sites:

• Primary: FSCA Riverwalk Office Park, Block B, 41 Matroosberg Road, Menlo Park, Pretoria.
• Disaster recovery: FSCA DR site, Building 5, Waterfall Corporate Campus, 74 Waterfall Drive, Waterfall City.

Timelines:

• Equipment delivery within 30 calendar days of purchase order.
• Installation and configuration within 6 weeks of delivery.

Service level targets (TABLE 2):

• P1 Critical: immediate response, 1 hour resolution.
• P2 High: immediate response, 4 hours resolution.
• P3 Medium: response within 2 hours, resolution within 1 working day.
• P4 Low: response within 4 hours, resolution next business day.

The bidder must submit a detailed proposal and deployment plan with turnaround timelines, covering how the solution will be deployed per the scope of work. The plan must address the review of current infrastructure, high-level and low-level designs, implementation, and as-built documentation.

The bidder must provide contactable reference letters from clients where a FortiGate end-to-end solution was successfully implemented. Each reference must include: client company name, contact person, telephone and email, nature and duration of contract, and Fortinet solution implementation details.

The contractor must:

• Provision and test firewall and wireless equipment after installation.
• Maintain current firmware patch levels per FSCA's patch management principles.
• Manage and facilitate all support calls and escalations with Fortinet until resolution.
• Meet the service level targets in TABLE 2 (response and resolution times).

Only fixed prices accepted. Pricing schedule must be on a separate sheet adjacent to SBD 3.1. All-inclusive fee statement required.

Pricing format: fixed prices only, in South African Rand, all-inclusive.

Pricing schedule must be submitted on a separate sheet adjacent to SBD 3.1.

No bid security, bonds, guarantees or retention mentioned.

Bid validity: 120 days from closing date.

FSCA may apply National Treasury cost containment hourly rates for consultants.

All costs of preparing and presenting the bid are for the bidder's account.

Pre-qualification (mandatory):

• Must be an accredited Fortinet Engage Preferred Services and Engage Tech Support Partner, located, operating and trading in South Africa.
• FSCA may verify accreditation with Fortinet.
• Bidders not meeting this are eliminated.

Registration:

• Must be registered on the Central Supplier Database (CSD) — no award without it.
• Valid tax compliance status required.

B-bbee:

• 80/20 preference point system applies.
• Specific goals: 51% youth ownership (10 points), 51% black ownership (10 points).
• Proof required: valid B-BBEE certificate, sworn affidavit, or CIPC documents.

Returnable forms: SBD 1, SBD 3.1, SBD 4, SBD 6.1 (see submission guidelines).

80/20 preference point system applies. Specific goals: 51% youth ownership (10 points), 51% black ownership (10 points). Proof required: valid B-BBEE certificate, sworn affidavit, or CIPC documents. Failure to submit proof results in 0 points for specific goals.

Contract duration: 5 years, commencing 28 February 2027 or earlier.

The contractor must facilitate the Fortinet Trade-up End-of-Order (EOO) for further purchase discounts on aged Check Point and Fortinet wireless equipment (ANNEXURE A).

Installation and configuration services must be provided during and after normal working hours, Monday to Friday.

Monthly performance and SLA reviews are compulsory; bi-weekly reviews in the initial stages at no additional cost.

FSCA may cancel the contract for corrupt acts, fraud, bad faith, anti-competitive behaviour, or unsatisfactory performance.

South African law applies; bidders must accept jurisdiction of South African courts and provide a domicilium citandi et executandi.

The contractor must facilitate the Fortinet Trade-up End-of-Order (EOO) for aged equipment. Installation and configuration services must be provided during and after normal working hours. Monthly and bi-weekly SLA reviews are required at no additional cost.

Pre-qualification: must be an accredited Fortinet Engage Preferred Services and Engage Tech Support Partner, operating in South Africa. Bidders not meeting this are eliminated.

Evaluation stages: compliance, functional (minimum 80/100), preference points (80/20), and site inspection at FSCA's discretion. Functional criteria: detailed proposal (40), track record (30), deployment plan (30).