Managed security operations centre (soc) services – 5-Year contract

Land Bank is procuring fully managed Security Operations Centre (SOC) services for a period of five years. The service must provide continuous 24x7x365 security monitoring, detection, investigation, containment support, reporting, and continuous improvement across the Bank's technology environment. The SOC must integrate with Land Bank's existing security technologies and MDR capabilities, not replace them. The solution must ingest, process, analyse, and retain at least 70 GB of security log and event data per day. The current environment includes approximately 600 Windows laptops, 100 servers, 3 firewalls, 1 web application firewall, Microsoft 365/Azure, and various security platforms. The service must be scalable to accommodate growth. Minimum response and escalation times are specified by severity. Monthly reporting on SOC metrics is required and will form part of the SLA.

Closing date: 18 November 2026 at 11:00

Compulsory virtual briefing session: 05 November 2026 at 11:00

• Platform: Microsoft Teams
• Meeting link: https://teams.microsoft.com/meet/343052383485313?p=tsTuXb20SAdcokwy10
• Meeting ID: 343 052 383 485 313
• Passcode: FQ6Gz7HN
• Attendance is mandatory; company name must be registered in the meeting chat.

Written questions of clarification closing: 05 November 2026 at 16:00

Written response to all clarifications: 09 November 2026

Tender validity period: 180 business days from the closing date

Enquiries (bidding procedure and technical):

• Contact: Supply Chain Management
• Email: [email protected]

Expression of interest notification:

• Email: [email protected]
• Required details: company name, contact person(s), phone, CSD registration number, B-BBEE level, email address.

Submission address:

Land Bank Head Office, Tender Box

Lakefield Office Park, Block A, first floor

272 West Avenue

Die Hoewes, Centurion

Land Bank postal address:

P O Box 375

Pretoria, 0001

Submission method: hand delivery only; faxed or emailed bids are not accepted.

• One original proposal and one soft copy on a USB memory stick in PDF format.
• The USB must be sealed in a padded envelope and clearly marked.
• Hard and electronic copies must be clearly marked with the bidder's name and contact details, RFP number, RFP description, and closing date.
• The proposal must be signed by an authorised representative, with the signatory's initials at the bottom of every page.
• All returnable documents must be submitted with the bid before the closing time and date.
• Bids must be placed in the tender box at the delivery address before or on the closing date and time; late bids will not be considered.
• Bids must be submitted on the official forms provided, not re-typed.

Returnable forms and documents:

• SBD 1 (Invitation to Bid): fully completed and signed.
• SBD 4 (Declaration of Interest): fully completed and signed; a declared or identified conflict of interest renders the bid non-responsive.
• SBD 6.1 (Preference Points Claim): claims preference points under the PPPFA.
• Proof of CSD registration.
• Proof of tax compliance (SARS TCS PIN or CSD verification).
• Annexure A: Client Managed SOC Performance Reference Schedule, completed and signed by each reference client.
• Annexure B: Bidder's Disclosure.
• Annexure C: Covenant of Integrity.
• Annexure D: FICA requirements.
• Annexure H: Bribery and Corruption Declaration.
• Proof of authority (e.g., company resolution) for the signatory.

Disqualification risks:

• Missing any mandatory requirement or substantiating evidence.
• Failure to attend the compulsory virtual briefing session.
• Submissions where SOC services are completely subcontracted.
• Late bids, regardless of reason.
• Bids not placed in the tender box.
• Failure to provide outstanding essential documents within 5 working days of request.

Evaluation is in three stages; a bidder must qualify for each stage to proceed to the next.

Stage 1 — Mandatory/Prequalification (pass/fail):

• Full pricing proposal submitted.
• 24x7x365 SOC monitoring and response capability, with support within South Africa and local escalation/incident response contacts.
• Disclosure of any subcontractors or third parties used.
• Capability to ingest and process at least 70 GB of security log/event data per day.
• At least five years' demonstrable experience providing managed SOC services.
• Three contactable client references, at least one from banking; references must complete and sign Annexure A.
• Valid ISO/IEC 27001 certificate, SOC 2 Type II report, or substantiated equivalent.
• Compliance with POPIA/data protection requirements.
• Disclosure of locations from which SOC services are delivered and where Land Bank data is processed/stored.
• Incident escalation/support capability during and after South African business hours.
• Audited financial statements for the most recent two financial years, signed by an independent auditor, plus a signed declaration confirming going concern and no business rescue/liquidation proceedings.
• Attendance at the compulsory virtual briefing session, with company name registered in the meeting chat.

Stage 2 — Technical evaluation (scored, minimum threshold 70 points):

• Total technical score: 100 points.
• Scoring categories:

1. SOC experience and capability — 10 points.
2. SOC architecture and integration — 15 points.
3. Monitoring, detection, use cases and playbooks — 15 points.
4. SOC operating model and personnel — 10 points.
5. Managed SOC onboarding project plan — 10 points.
6. Reporting, governance and continuous improvement — 10 points.
7. Demonstrated managed SOC performance and client references — 30 points.

• Minimum threshold: 70 points to proceed to Stage 3.
• Substantiation must be referenced with a unique reference number (e.g., binder/folio, chapter, section, page); evidence that cannot be located may be treated as non-compliant.
• Statements of compliance without supporting evidence may not earn points.
• Playbook scoring (Table 6): three anonymised sample playbooks for ransomware, credential compromise, and data exfiltration, each demonstrating six elements; points from 0 to 6 based on completeness, testing, and operational use.
• References: Land Bank may independently verify references; unverifiable references or performance criteria may receive zero points; material misrepresentation is dealt with under procurement conditions.

Stage 3 — Price and specific goals:

• Either the 90/10 or 80/20 preference point system applies, determined by the lowest/highest acceptable tender.
• The bidder's commitment to preference goals is legally binding for the contract duration.

Land Bank requires a comprehensive, fully managed Security Operations Centre (SOC) service providing continuous 24x7x365 security monitoring, detection, investigation, containment support, reporting, and continuous improvement across the Bank's technology environment.

The SOC must complement and integrate with Land Bank's existing security technologies and Managed Detection and Response (MDR) capabilities; it is not intended to replace them.

The successful bidder must provide an overarching security monitoring and response capability that correlates security events across the Bank's environment and provides a consolidated view of threats and incidents.

Minimum log ingestion: 70 GB of security log and event data per day, either through Land Bank's existing SIEM/security platforms or directly into the bidder's managed SOC platform.

Current environment includes:

• On-premises Active Directory integrated with Microsoft Entra ID.
• Approximately 600 Windows end-user laptops.
• Approximately 100 servers, mostly Windows with some Linux.
• 3 firewalls and 1 web application firewall.
• Routers, switches, and other network infrastructure.
• Microsoft 365 and Azure cloud services.
• Security platforms: endpoint detection and response, firewalls, VPN, PAM, IAM, data leak prevention, data security and analytics, email security, antivirus.

The solution must be scalable to accommodate reasonable growth in log volumes and additional data sources during the contract period.

Minimum service levels (response and escalation times):

• Critical: SOC response < 1 hour, escalation time 2 hours.
• High: SOC response < 2 hours, escalation time 4 hours.
• Medium: SOC response < 4 hours, escalation time 6 hours.
• Low: SOC response < 8 hours, escalation time next business day.

Monthly reporting on SOC metrics, which will form part of the SLA:

• Mean Time to Detect (MTTD)
• Mean Time to Acknowledge & Analyse (MTTA&A)
• Mean Time to Respond
• Mean Time to Resolution
• Number of Security Incidents
• False Positive Rate (FPR)
• False Negative Rate (FNR)
• Cost/Impact of an Incident
• Incident Escalation Rate
• Incident Closure Rate
• Incident Containment Rate

The bidder must provide a proposed implementation timeline, key milestones, dependencies, responsibilities, and acceptance criteria for onboarding the managed SOC service.

Required elements in the onboarding plan:

• Discovery/environment assessment: activities and timelines for asset discovery and environment assessment.
• Log-source onboarding/integration: activities and timelines.
• Telemetry/log-quality validation: activities and timelines.
• Detection/use-case baseline: activities and timelines.
• Playbook development: activities and timelines.
• MDR/DFIR integration: activities and timelines for integrating MDR and DFIR services.
• SLA and escalation establishment: aligned with Land Bank requirements.
• Testing before go-live: service readiness testing.
• Knowledge transfer/documentation: delivery of documentation.
• Project plan: detailed implementation plan showing milestones, resources, dependencies, responsibilities, and acceptance criteria.

For client references, the bidder must complete the prescribed Client SOC Performance Reference Schedule (Annexure A) for each of three references, using the prescribed calculation methodology for MTTD, MTTR, and FPR. Performance information must represent actual service performance, not proposed SLA commitments.

Mandatory experience requirements:

• At least five years' demonstrable experience providing managed SOC services.
• Experience providing managed SOC services within a banking environment; at least one of three client references must be from banking, with financial services or public sector organisations making up the rest.
• Three contactable client references for 24x7x365 managed SOC services delivered for at least 12 months; each reference must complete and sign Annexure A.

Technical evaluation of experience (10 points):

• 0: Not provided.
• 4: Meets minimum requirements — 5 years SOC operations, no banking or public-sector experience.
• 7: Good enterprise SOC experience, 5 years minimum, public-sector experience, no banking-sector experience.
• 10: Extensive SOC experience, 5 years minimum, banking-sector and public-sector experience.

Personnel requirements (10 points in technical evaluation):

• 24x7x365 operating model: shift model/roster, SOC locations.
• Tier 1, 2 & 3 capability: staffing numbers by tier, role descriptions.
• SOC management/escalation: organogram, escalation matrix.
• Qualifications/certifications: at least one relevant certification per level, e.g., CISSP, CySA+, GSEC, GCIH, CSA, SC-200.
• Capacity: adequate staffing/customer resource model, at least one per tier per shift.
• Business continuity: SOC BCP/DR summary, alternate SOC arrangements.
• Local escalation capability: SA escalation/support capability demonstrated.

Quality requirements are embedded in the technical evaluation criteria:

• Monitoring, correlation and triage: documented triage, multi-source correlation, and evidence of continuous operational monitoring.
• Detection engineering/use cases: custom use-case development, detection tuning, and continuous use-case improvement.
• Playbook quality and maturity: three sample playbooks (ransomware, credential compromise, data exfiltration) must demonstrate six elements: detection triggers, investigation/validation steps, severity/classification, containment/response actions, escalation/notification/approval requirements, and recovery/closure/evidence preservation/lessons learned. Points awarded based on completeness, testing, and operational use.
• MITRE ATT&CK coverage: mapping and coverage/gap management.
• False-positive management: defined measurement and reduction process.
• Monthly SOC reporting: alert/incident volumes by severity, trends, SLA performance, MTTD/MTTR, false-positive optimisation, detection coverage, threat hunting, risks/recommendations.
• Executive reporting: clear communication of security posture, material incidents, actionable recommendations, understandable to non-technical executives.
• Incident reporting: sample incident report covering summary, classification, timeline, affected systems, investigation, containment, impact, recovery, recommendations.
• Service governance: structured process covering SLA performance, significant incidents, risks, outstanding actions, service issues, improvement initiatives.
• Continuous improvement: evidence that operational findings lead to measurable improvements (e.g., detection-rule changes, use-case additions, playbook updates, AI utilisation, false-positive tuning, threat-hunt actions, lessons-learned register).
• Customer visibility: appropriate visibility into SOC operations via portal/dashboard with read-only functionality and incident/ticket visibility.

Pricing must be submitted on the prescribed pricing schedule, with a total bid price (excl VAT), VAT at 15%, and total incl VAT.

The schedule covers five years, with annual quantities of 1 for SOC services and any additional costs.

Prices must be valid for 180 days and firm for the contract duration.

All pricing must exclude VAT, with VAT shown separately.

The price schedule must be completed in non-erasable ink; correction fluid/tape is not permitted.

The bidder must provide incremental costs for exceeding 70 GB/day log ingestion or device increases, specifying:

• Cost per additional 1 GB/day of log ingestion.
• Cost per additional 10 GB/day of log ingestion.
• Cost per additional 100 endpoints/devices, where device-based pricing applies.
• Any additional storage/retention costs.
• Volume bands or discounts.
• Minimum purchase increments.
• Thresholds below which additional capacity is free.

Land Bank will not entertain price adjustments; the pricing document is assumed complete and covering all costs.

Pricing format:

• Complete the Bidder's Costing Proposal and include it in the hard copy and on the USB.
• Provide a total bid price.
• Prices must exclude VAT, with VAT shown separately.
• Prices must be valid for 180 days and firm for the duration of the contract.
• No price adjustments will be entertained; the pricing document is assumed complete and covering all costs.
• The price schedule must be completed in non-erasable ink; correction fluid/tape is not permitted.

Pricing schedule structure:

• Item 1.1: SOC services covering all requirements — annual, quantity 1 for each of the five years.
• Item 1.2: Any additional cost — annual, quantity 1 for each of the five years.
• Total bid price (excl VAT), VAT at 15%, and total incl VAT.

Additional cost requirements (for exceeding 70 GB/day or device increases):

• Cost per additional 1 GB/day of log ingestion.
• Cost per additional 10 GB/day of log ingestion.
• Cost per additional 100 endpoints/devices, where device-based pricing applies.
• Any additional storage/retention costs.
• Volume bands or discounts applicable.
• Any minimum purchase increments.
• Any threshold below which additional capacity is provided at no additional cost.

Financial capacity:

• Audited annual financial statements for the most recent two completed financial years, signed by an independent auditor or registered accounting professional.
• A signed declaration by the auditor confirming the bidder is a going concern with no known material financial concerns, and is not subject to business rescue, liquidation, or similar insolvency proceedings.

Tax compliance:

• Bidders must be tax compliant and submit their unique SARS TCS PIN to enable verification.
• A printed TCS certificate may be submitted with the bid.
• For consortia/JVs/subcontractors, each party must submit a separate TCS certificate/PIN/CSD number.
• If no TCS PIN is available, a CSD number must be provided.
• Tax status will be verified through CSD or SARS e-filing pin prior to award.

CSD registration:

• Proof of registration as a vendor on the National Treasury Central Supplier Database (CSD) is required.

B-bbee:

• B-BBEE level must be provided in the expression of interest.
• Preference points claimed via SBD 6.1 under the Preferential Procurement Regulations 2011.
• Either the 90/10 or 80/20 preference point system applies.

State employment:

• Bids will not be considered from persons in the service of the state, companies with directors who are persons in the service of the state, or close corporations with members who are persons in the service of the state.

FICA and compliance:

• FICA requirements must be met (Annexure D).

Popia:

• Bidders must demonstrate compliance with POPIA/data protection requirements, including a data privacy policy and confirmation of processing arrangements.

Information security:

• Valid ISO/IEC 27001 certificate, SOC 2 Type II report, or substantiated equivalent internationally recognised assurance/certification.

Subcontracting:

• Submissions where SOC services are completely subcontracted will not be considered.

Contract duration: five (05) years.

The successful bidder will be required to sign a written contract form (SBD 7).

A draft Service Level Agreement (Annexure G) is included; the SOC metrics and service levels will form part of the SLA.

The bidder's commitment to preference goals is legally binding for the contract duration.

Land Bank reserves the right to opt in or opt out of quoted modules or elements during the contracting phase.

Prices remain firm for the duration of the agreement; no price adjustments will be entertained.

The contract is subject to the Preferential Procurement Policy Framework Act, 2000, the Preferential Procurement Regulations, and the General Conditions of Contract (GCC).

Evaluation is in three stages: mandatory/prequalification, technical, and price/specific goals.

Stage 1 is pass/fail; failure to meet any mandatory requirement disqualifies the bid.

Stage 2 technical evaluation is scored out of 100 points; minimum threshold is 70 points to proceed.

Technical scoring categories:

• SOC experience and capability: 10 points.
• SOC architecture and integration: 15 points.
• Monitoring, detection, use cases and playbooks: 15 points.
• SOC operating model and personnel: 10 points.
• Managed SOC onboarding project plan: 10 points.
• Reporting, governance and continuous improvement: 10 points.
• Demonstrated managed SOC performance and client references: 30 points.

Stage 3 applies either the 90/10 or 80/20 preference point system.

Substantiating evidence must be referenced with a unique reference number; unlocatable evidence may be treated as non-compliant.

Bidder must tender strictly in accordance with the scope of work supplied by the Land Bank.

In case of conflict between these Terms and Conditions and the RFP, the RFP conditions prevail.

Governing law: Republic of South Africa.

These terms and conditions are non-negotiable and binding if the proposal is successful.

Closing date and time: 18 November 2026 at 09:00.

Briefing session: may be convened if the Land Bank deems it necessary; if held, attendance is compulsory and failure to attend results in disqualification.

Briefing venue: Land Bank Head Office, Lakefield Office Park, Building A, First Floor, 272 Lenchen Avenue (corner of Lenchen Avenue and West Avenue), Die Hoewes, Centurion.

Briefing date and time not specified in this annexure.

Submission format: one original hard copy and one soft copy on USB flash drive.

Tender number and subject must appear on the front cover of the original bid.

Late bids will not be accepted.

No entity may be involved in more than one bid; violation may result in disqualification.

Material change in control or composition of the bidder after submission requires prior written approval from the Land Bank.

Bid validity: 120 business days from date of submission.

Land Bank may request extension of validity period; bidder may not change the bid unless the change is a direct and unavoidable consequence of the extension.

Bidder must tender strictly in accordance with the scope of work supplied by the Land Bank (clause 21).

No detailed scope, deliverables, quantities, locations, standards, service levels or capacity requirements are provided in this annexure.

Land Bank reserves the right not to accept any bid, including the lowest priced.

Land Bank may accept a bid in whole or in part; price adjusted according to the pricing schedule in the bid.

No further pricing details, bill of quantities, rates or payment schedules provided in this annexure.

Prices quoted must be exclusive of VAT; VAT shown separately at the standard rate on the tax invoice.

No price increases permitted for the duration of the Service Provider Agreement; cost increases may not be passed to the Land Bank.

Successful bidder must furnish security to the satisfaction of the Land Bank when called upon (clause 13.1.3).

Land Bank may accept a bid in whole or in part; price adjusted according to the pricing schedule in the bid.

Bid validity: 120 business days from submission date.

Must be registered on the National Treasury Central Supplier Database (CSD).

Must possess all necessary approvals, registrations, certificates, permits, licences and authorisations to perform the services.

Must not be listed on National Treasury's database of restricted suppliers or register of tender defaulters.

Must not have been found guilty of a serious breach of any law in the preceding 5 years.

Must not have acted fraudulently, improperly or in bad faith towards the Land Bank or any government department or public body.

Must not have withdrawn a bid after the advertised closing date and time.

Must not have failed or refused to sign a contract when called upon.

Must not have carried out a previous contract unsatisfactorily or breached its conditions.

Must not have made misleading or incorrect statements in bid documents.

Must not have caused the Land Bank damage or unrecoverable costs.

Must not have instituted court proceedings against the Land Bank in bad faith.

No entity may participate in more than one bid.

Material change in control or composition requires Land Bank approval.

Warranties:

• Bidder warrants possession of all necessary approvals, registrations, certificates, permits, licences and authorisations to perform the services.
• Bidder warrants registration on the National Treasury Central Supplier Database.

Default events (clause 13):

• Failure to conclude formal contract within stipulated period.
• Failure to accept an order.
• Failure to furnish security when required.
• Failure to comply with any Land Bank condition.
• Withdrawal of bid after closing.
• Refusal to sign contract.
• Unsatisfactory performance or breach of previous contract.
• Fraudulent, improper or bad faith conduct.
• Misleading or incorrect statements in bid documents.
• Causing Land Bank damage or unrecoverable costs.
• Instituting court proceedings against Land Bank in bad faith.
• Conviction for serious breach of law in preceding 5 years.
• Listing on restricted suppliers database or register of tender defaulters.

Disqualification extends to associates, agents and employees.

Site visits: Land Bank reserves right to inspect sites or request supporting documentation.

Bidder obligations: deemed to have examined RFP, made own enquiries, not relied on warranties outside RFP.

Acceptance: Land Bank not bound to accept lowest or any bid; may accept in whole or part with price adjustment.

Confidentiality: RFP confidential; bids become Land Bank property; proprietary information must be identified.

Contract documents: Service Provider Agreement, these Terms and Conditions, General and Special Conditions of Contract, and any schedules.

VAT: prices exclusive of VAT, shown separately on tax invoice.

Governing law: South Africa.

Closing date: 18 November 2026 at 09:00

Completion of the Bribery and Corruption Declaration (Annexure G) is mandatory.

Bidders must declare whether any member has been charged, convicted, or implicated in bribery or corruption within the last 5 years.

If any question is answered affirmatively, full details must be provided including the date of charge and nature thereof, current status of charge, date of conviction (if any), court where prosecuted, details of members convicted (facts giving rise to charges, charges preferred, and court judgement details), full details of any contract alleged to have been affected by bribery or corruption, and any sentence imposed on the member.

Bidders with such findings may be disqualified from the tender or required to provide full details for evaluation purposes.

Bribery and Corruption Declaration (Annexure G): All bidders must complete and submit the declaration form.

The declaration requires disclosure of whether any member has been charged with, convicted of, or implicated in bribery or corruption within the last 5 years.

If any question is answered affirmatively, the bidder must provide: (1) date of charge and nature thereof; (2) current status of charge; (3) date of conviction (if any); (4) court where prosecuted; (5) details of members convicted, facts giving rise to charges, charges preferred, and court judgement details; (6) full details of any contract alleged to have been affected by bribery or corruption; (7) any sentence imposed on the member.

Failure to complete the declaration truthfully or omission of required information may result in disqualification.

Bribery and Corruption Declaration requirements: The tenderer must provide information for the last 5 years regarding each of its members and/or partners (including directors, employees, or agents) whose conduct rendered the tenderer directly or vicariously responsible.

Whether any member has been charged with any act of bribery and/or corruption.

Whether any member has been convicted of any act of bribery and/or corruption.

Whether any member has been implicated in or alleged to have been involved in any corrupt practices, collusion, bribery or related practices.

Whether there is any reason to believe that a charge will be laid against a member arising from an act of bribery and/or corruption.

If any question is answered affirmatively, full details must be provided including: the date of the charge and the nature thereof; the current status of the charge; the date of conviction (if any); the court in which the charges are being/where prosecuted; the details of the members convicted, the facts giving rise thereto, the charges preferred against the member and the details of any judgement by the relevant court; full details of any contract which was or is alleged to have been affected by the act of bribery and/or corruption; any sentence imposed on the member.

The declaration must be signed at the designated location on the specified date.