Managed cybersecurity services provider (mssp) – 5-Year contract – nhbrc

Closing date: 23 November 2026 at 11:00

Briefing session: 06 November 2026 at 11:00 (non-compulsory, hybrid)

Briefing venue: virtual via Microsoft Teams link https://teams.microsoft.com/meet/3827446403645322?p=5Tthd24bZa9lg1CYg5

RFP availability: from 06 November 2026 on the NHBRC website (www.nhbrc.org.za/current-tenders) and eTender Portal (https://www.etenders.gov.za/)

SCM enquiries:

• Contact: Mr Bernard Kekana
• Department: Supply Chain Management
• Email: [email protected]
• Email (also): [email protected]
• Enquiry response times: weekdays 08:30 to 16:30

Submission:

• Method: online via eTender Portal
• Submission portal: https://www.etenders.gov.za/
• Mark bid for attention: Supply Chain Manager

Submission method: online only via the National Treasury e-Tender Portal at https://www.etenders.gov.za/.

• No physical or emailed proposals accepted.
• Late submissions are not accepted.
• Bids must be marked for the attention of the Supply Chain Manager.
• Bids must remain valid for 90 days from the closing date.
• Bidders must complete all mandatory forms online on eTender where indicated.

Returnable forms (all must be completed, signed and submitted):

• Pricing Schedule: completed and signed, with detailed cost breakdown and annual escalation; unsigned schedule disqualifies the bid.
• SBD 4 (Bidders Disclosure Form): discloses whether any director or shareholder is employed by the state or connected to the NHBRC.
• SBD 1 (Invitation to Bid): bidder and contact details, signed as the offer cover page.
• SBD 6.1 (Preference Claim Form): claims preference points; must be completed and signed even if no points are claimed.
• ISO/IEC 27001:2022 certificate (valid, covering the SOC/managed security services environment).
• ISO 9001 certificate (valid, for a Quality Management System).
• Cyber Security Professional Indemnity and/or Cyber Liability Insurance certificate or policy schedule, with minimum coverage of R10,000,000.00; certified copy required, must remain valid for the full contract duration.
• Company profile with MCSSP project list (scope, timelines, technologies, outcomes).
• Minimum three contactable reference letters on client letterhead, signed, confirming scope and duration, with client contact details.
• CVs for all proposed key personnel.
• Organogram for the entire project team.
• Project plan / migration plan with objectives, scope, timelines, resources, risk management, work breakdown structure, methodology, process flows, and deliverables.
• Proof of OEM certifications/authorised reseller or managed service agreements for security technologies.
• Disclosure of SOC location(s) in South Africa, data handling practices, and any subcontractors/sub-processors.

Disqualification risks:

• Any mandatory document omitted, incomplete, or unsigned.
• Submission of false, fraudulent, or misleading information.
• Bids received after the closing date and time.
• Any entity involved in more than one bid for this RFP.
• Material change in bidder control/composition without prior written NHBRC approval.
• Non-compliance with online bid submission rules.

Evaluation is in three stages:

Stage 1 – Compliance check: mandatory documents must be complete, signed and submitted. Failure disqualifies the bid.

Stage 2 – Functionality (100 points total):

• Stage 2A – Paper-based technical evaluation (80 points). Minimum qualifying score: 60/80. Only bidders scoring 60 or more proceed to Stage 2B.
• Stage 2B – Live SOC demonstration (20 points). Mandatory for shortlisted bidders. Minimum qualifying score: 10/20. Demonstration must use the bidder's own operational SOC environment; simulated or non-operational environments result in disqualification.
• Final Technical Score (FTS) = Stage 2A + Stage 2B. Minimum FTS to proceed to Stage 3: 80/100.

Stage 2A scoring breakdown (80 points):

• Bidder experience (10 points): minimum 5 years' proven track record; points scale from 0 (0 years) to 5 (5+ years).
• Client reference letters (20 points): points scale from 0 (0 letters) to 5 (6+ letters); letters must correspond to claimed experience.
• Project team capability (30 points): organogram and CVs for four roles, each scored out of 3 points (total 12 points):
• Project Manager: NQF 7 qualification, PMP/PRINCE2/CSM/MPI-ACP certification, 5 years' ISO 27001 implementation experience.
• Chief Information Security Officer: NQF 7 in computer science/ICT, CISSP/CCSIO/CISM/CASP+ certification, 5 years' cybersecurity project management experience.
• SOC Lead: NQF 7 in computer science/cybersecurity/ICT, Security+, CompTIA CySA+, CEH certifications, 5 years' SOC technical/management experience.
• Cyber Security Architect: NQF 7 in computer science/cybersecurity/ICT, CISSP/CISM/CCSP plus SABSA/TOGAF/Microsoft Cybersecurity Architect Expert/GIAC GDSA certification, 5 years' cybersecurity experience.
• Migration plan (20 points): project plan with objectives, scope, timelines, resources, risk management, work breakdown structure, methodology, process flows, and deliverables; points scale from 0 (no items) to 5 (all 5 items).

Stage 2B – Live SOC demonstration scoring (20 points):

• SOC architecture & integration (5 points)
• Incident detection & response (5 points)
• Endpoint & identity controls (3 points)
• Vulnerability & patch management (2 points)
• Compliance, data protection & reporting (5 points)

Stage 3 – Price and preference points (80/20 system):

• Price: 80 points, calculated using the PPPFA 80/20 formula.
• Preference points: 20 points allocated as follows:
• Women: 12 points
• Youth: 6 points
• Disabilities: 2 points
• Military Veterans: 0 points
• Preference points are calculated based on equity ownership percentage.
• Only bidders achieving the minimum FTS of 80 proceed to Stage 3.

The NHBRC seeks to appoint a Managed Cybersecurity Services Provider (MCSP) for a five-year period to deliver end-to-end cybersecurity services across its national network of offices (head office in Sunninghill, Gauteng, plus 9 provincial and 12 satellite offices).

Key objectives:

• Strengthen security posture through defence-in-depth.
• Provide 24/7/365 monitoring, detection, triage, containment, and incident response.
• Reduce cyber risk through continuous exposure management.
• Support compliance with ISO/IEC 27001, POPIA, PFMA and internal policies.
• Improve cybersecurity maturity and security culture.

Current environment (indicative):

• Hybrid environment with cloud/hosted services (Microsoft Azure and others).
• Microsoft 365 tenant with E3 and E5 licensing.
• Perimeter security: FortiGate firewall, VPN (e.g., OpenVPN).
• Approximately 650 workstations, 300 tablets (Windows and iOS), Cisco switching, network printers.

Scope of works (detailed in Annexure A):

• Layered security: cloud, network, server/infrastructure, application, database, identity/access, endpoint/device, and data security.
• 24/7/365 SOC: SIEM/SOAR, EDR/XDR, use-case catalogue, runbooks/playbooks, threat hunting (weekly baseline, monthly deep hunts), operational resilience.
• Incident response and forensics: NIST-aligned playbooks, IR retainer with surge capacity, forensic capability with chain-of-custody, POPIA-aligned breach communications, post-incident RCA reports.
• Vulnerability assessment and penetration testing: authenticated scanning, exposure prioritisation, annual internal/external pen tests, semi-annual web/app/API tests, retesting within 30–60 days.
• Threat intelligence: actionable intel mapped to MITRE ATT&CK, IOC/IOA updates, monthly threat landscape reports.
• Attack surface management / continuous threat exposure management (ASM/CTEM): external monitoring, exposure scoring, credential exposure monitoring.
• Data and document security: encryption/password protection, secure external sharing controls, audit logging.
• Cyber awareness: annual programme, quarterly phishing simulations, executive briefings.
• Policy development: Cyber Incident Response Plan, Third-Party Access and Supplier Security Policy, SOC Engagement Plan, and policies for identity/privileged access, vulnerability/patch management, acceptable use, data classification/retention.

Deliverables:

• Onboarding pack: architecture/data-flow diagrams, log source register, RACI, escalation matrix, communications plan, onboarding schedule.
• Operational artefacts: SOC runbooks, IR playbooks, use-case catalogue, detection tuning notes, automation catalogue.
• Reporting: daily/weekly operational summaries, monthly KPI and risk posture report, quarterly executive maturity and improvement roadmap.
• Assurance outputs: risk and maturity assessment with roadmap, updated cybersecurity risk register.
• Testing outputs: vulnerability reports, penetration testing reports, retest evidence.
• Training outputs: awareness programme artefacts, phishing simulation reports, attendance records, knowledge transfer evidence.

Service level KPIs (minimum targets):

• 24/7 SOC coverage: 100%
• P1 MTTD: ≤ 15 minutes
• P1 MTTR (containment): ≤ 2 hours
• P2 triage: ≤ 30 minutes (95%)
• Critical vulnerability remediation: ≤ 7 days
• Reporting timeliness: 100%

SOC location and data sovereignty:

• SOC must be fully operational 24/7/365 and located in South Africa.
• All analyst access to NHBRC data must be from within South Africa unless explicitly approved in writing.
• Bidder must describe SOC physical security, resiliency, and continuity arrangements.

The bidder must submit a detailed project proposal outlining the implementation and transition to managed services, including:

• Implementation phases and milestones
• Platform onboarding and integration approach
• Risk and change management approach
• Knowledge transfer and capacity-building plan
• Process flows, timelines (six months for migration), and deliverables relevant to NHBRC requirements.

The migration plan is scored in Stage 2A (20 points) based on submission of: objectives, scope, timelines, resources, risk management, work breakdown structure, methodology, process flows, and deliverables.

Bidder experience requirements:

• Minimum 5 years' proven experience delivering enterprise-grade managed cybersecurity services.
• Demonstrable experience servicing public sector entities or similarly regulated organisations in South Africa.
• Demonstrable operational capability to provide 24/7/365 SOC services.
• Minimum 3 contactable reference letters for similar MCSSP engagements, on client letterhead, signed, confirming scope and duration, with client contact details.
• Reference letters must correspond directly to claimed experience.

Key personnel requirements (with CVs):

• Project Manager: NQF 7 qualification, PMP/PRINCE2/CSM/MPI-ACP certification, 5 years' ISO 27001 implementation experience.
• Chief Information Security Officer: NQF 7 in computer science/ICT, CISSP/CCSIO/CISM/CASP+ certification, 5 years' cybersecurity project management experience.
• SOC Lead: NQF 7 in computer science/cybersecurity/ICT, Security+, CompTIA CySA+, CEH certifications, 5 years' SOC technical/management experience.
• Cyber Security Architect: NQF 7 in computer science/cybersecurity/ICT, CISSP/CISM/CCSP plus SABSA/TOGAF/Microsoft Cybersecurity Architect Expert/GIAC GDSA certification, 5 years' cybersecurity experience.

Additional resource certifications: CISSP, CISM, GCIH/GCFA, OSCP, Microsoft Security Certifications.

Experience areas: SOC operations and monitoring, incident detection and response, cyber threat intelligence, vulnerability and penetration testing, cloud and endpoint security management.

Quality management requirements:

• Valid ISO 9001 certificate for a Quality Management System (mandatory).
• Valid ISO/IEC 27001:2022 certification applicable to the bidder's managed security services/SOC environment (mandatory).
• Alignment with recognised cybersecurity frameworks: NIST Cybersecurity Framework and/or COBIT.
• Security-by-design: align to MITRE ATT&CK, ISO/IEC 27001, NIST CSF and relevant NIST publications, OWASP, and CIS Benchmarks.
• Co-managed transparency: runbooks, playbooks, detections, dashboards, and operational artefacts must be visible to NHBRC; no black-box operations.
• Compliance-first: controls and processes must support POPIA, PFMA, and NHBRC policy requirements.
• Cost transparency: full cost model including telemetry/logging, retention, automation, licensing, and optimisation measures.
• Data sovereignty: SOC operations and analyst access for NHBRC data must be based in South Africa.

Pricing Schedule requirements:

• Must be completed and signed, including a detailed cost breakdown and annual escalation.
• Must be signed by the bidder or an authorised individual (with resolution attached). If not signed, the bidder is disqualified.
• The pricing schedule is a mandatory document for disqualification.

Preference points:

• The 80/20 preference point system applies (price 80 points, preference 20 points).
• Preference points are allocated: Women 12, Youth 6, Disabilities 2, Military Veterans 0.
• Preference points are calculated based on equity ownership percentage.

Insurance:

• Cyber liability/professional indemnity insurance with minimum coverage of R10,000,000.00 required.

Pricing Schedule:

• Must be completed and signed, including a detailed cost breakdown and annual escalation.
• Must be signed by the bidder or an authorised individual (with resolution attached). Unsigned schedule disqualifies the bid.

Insurance:

• Cyber Security Professional Indemnity and/or Cyber Liability Insurance with minimum coverage of R10,000,000.00 (Ten Million Rand).
• Certified copy of the insurance certificate or policy schedule required; must remain valid for the full contract duration, with evidence of renewal provided to NHBRC.

Bid validity:

• Bids must remain valid and irrevocable for 90 days from the closing date.

Costs:

• All costs associated with preparing and submitting the bid are the bidder's responsibility.
• The NHBRC will not reimburse any bid preparation costs.

Contract management:

• The contract will be managed under the General Conditions of Contract (GCC) as issued by National Treasury, plus an SLA.

CSD registration:

• Bidder must be registered on the National Treasury's Central Supplier Database (CSD) and remain registered, with up-to-date information, for the contract duration.

Tax compliance:

• Bidder must be tax compliant at bid submission and for the contract duration.
• A SARS Tax Clearance Certificate must be provided annually.

Certifications (mandatory, with evidence):

• Valid ISO/IEC 27001:2022 certification applicable to the bidder's managed security services/SOC environment.
• Valid ISO 9001 certificate for a Quality Management System.
• Proof of OEM certifications/authorised reseller or managed service agreements for security technologies (SIEM/XDR, EDR, network/perimeter security, cloud security platforms).

Experience requirements:

• Minimum 5 years' proven experience delivering enterprise-grade managed cybersecurity services.
• Demonstrable experience servicing public sector entities or similarly regulated organisations in South Africa.
• Demonstrable operational capability to provide 24/7/365 SOC services.
• Minimum 3 contactable reference letters for similar MCSSP engagements.

Resource qualifications:

• Key personnel must hold relevant certifications (CISSP, CISM, GCIH/GCFA, OSCP, Microsoft Security Certifications) and have experience across SOC, IR/forensics, cloud security (Azure), IAM, and GRC.

B-bbee:

• Preference points are allocated under the 80/20 system (see evaluation criteria).
• SBD 6.1 Preference Claim Form must be completed and signed even if no points are claimed.
• B-BBEE level and evidence requirements are not further specified in the document.

The NHBRC is committed to adhering to the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA). The bidder must support compliance with POPIA, including breach communications and data protection controls.

Contract duration: five (05) years.

General conditions:

• The contract will be managed under the General Conditions of Contract (GCC) as issued by National Treasury, plus an SLA.
• The NHBRC reserves the right to amend, modify or withdraw the RFP at any time without prior notice or liability.
• Amendments will be communicated in writing; oral amendments are not considered.
• The NHBRC may carry out site inspections or request supporting documentation to verify bid information.
• A bid constitutes a binding offer, irrevocable for 90 days from submission.
• No agreement is reached until a binding contract is concluded with the preferred bidder.
• The RFP is confidential; use, reproduction or disclosure of its contents is prohibited.
• The RFP may not be distributed outside South Africa without compliance with applicable laws.
• No entity may be involved in more than one bid; violation may lead to disqualification.
• Any material change in bidder control/composition after submission requires prior written NHBRC approval; failure may lead to disqualification.
• The NHBRC may require a formal presentation of the bid at a date and time it determines; all expenses borne by the bidder.
• The NHBRC may waive irregularities at its sole discretion.
• The NHBRC reserves the right to accept or reject any proposal.
• Bids received after the closing date and time will be rejected.
• The NHBRC may request replacement of any resource that does not meet SLA performance expectations, subject to written approval.
• Some activities may be required outside normal business hours to avoid disruption to NHBRC operations.

Additional evaluation criteria details:

• Stage 2A paper-based evaluation (80 points) includes: bidder experience (10), client reference letters (20), project team capability (30), migration plan (20).
• Minimum Stage 2A score to proceed to Stage 2B: 60/80.
• Stage 2B live SOC demonstration (20 points) is mandatory for shortlisted bidders; minimum score 10/20.
• Final Technical Score (FTS) = Stage 2A + Stage 2B; minimum FTS to proceed to Stage 3: 80/100.
• Stage 3: price and preference points (80/20 system).
• Bidders failing the minimum functionality threshold are disqualified and not evaluated for price and preference.