Supply, delivery, installation and configuration of a cloud-based vulnerability management system (12-Month licence)

Closing

• 06 October 2026 at 11:00 (South African Standard Time).

Advertisement

• 01 October 2026.

Bid validity

• 90 days from the closing date.

Clarification questions

• Submit to [email protected] no later than 24 hours before the closing date.

No compulsory briefing or site visit is stated.

Bidding procedure enquiries

• Contact: Supply Chain Management
• Telephone: 012 432 1309
• Email: [email protected]

Technical enquiries

• Contact: SCM
• Telephone: 012 432 1308

RFQ queries

• Email: [email protected]
• Deadline: no later than 24 hours before the closing date

Submission

• Method: online submission via the e-tender portal
• No email submission

Postal address

National Lotteries Commission (NLC)

P.O Box 1556

Brooklyn Square 0083

Pretoria

Submission method

• Online submission through the e-tender portal only.
• No email submissions will be accepted.
• Submissions must be addressed to Supply Chain Management, NLC.

Format

• Submit in PDF, protected against modification, deletion or addition.
• Financial/pricing information must be a separate attachment from the technical/functional response.
• Mark the submission prominently with the bidder's name, tender number and tender title.
• Submit at least 30 minutes before the closing time; the bidder carries the risk of transmission delays, network problems, load shedding or difficulty using the e-tender portal.
• Late or incomplete submissions will not be accepted.

Returnable documents

• SBD 1 (Invitation to Bid): bidder and contact details, signed as the offer cover page.
• SBD 4 (Declaration of Interest): discloses state employment or relationships involving directors, shareholders or members; a false disclosure disqualifies the bid.
• SBD 6.1 (Preference Points Claim Form): claims the specific-goals preference points.
• POPIA consent form: consents to the processing of the bidder's personal information for the procurement.
• CSD registration report showing a valid tax compliance status on the closing date.
• Valid B-BBEE certificate or sworn affidavit; a joint venture must submit a consolidated B-BBEE certificate or affidavit.
• Valid OEM certificate or equivalent written OEM authorisation.
• Completed pricing schedule/quotation.

Disqualification risks

• Any mandatory document omitted or unsigned.
• Bids not meeting the mandatory pre-qualification requirements.
• Late or incomplete submissions.
• Collusion with other bidders, or canvassing NLC officers between closing and award.

Returnable documents: completed and signed SBD 1, SBD 4 and SBD 6.1; signed POPIA consent form; CSD report showing a valid tax compliant status; valid B-BBEE certificate or sworn affidavit; valid OEM certificate or equivalent written OEM authorisation; and the completed pricing schedule/quotation.

System

• 80/20 preference point system under the PPPFA and the Preferential Procurement Regulations, 2022.
• Price: 80 points.
• Specific goals: 20 points.
• Total: 100 points.
• No minimum functionality or qualifying score is stated.

Stage 1 — Closing and opening

• Closing: 06 October 2026 at 11:00 (South African Standard Time). Late quotations are not accepted.

Stage 2 — Administrative compliance and mandatory requirements

• Bidders must submit all mandatory documents; non-compliant bids are disqualified and not evaluated further.

Stage 3 — Price and specific goals (80/20)

• Price: 80 points, scored on the lowest acceptable tender.
• Specific goals: 20 points, allocated as follows:
• Black ownership: 100% = 8 points; 51% to 99% = 4 points; less than 51% = 0 points.
• Black women ownership: 100% = 4 points; 30% to 99% = 2 points; less than 30% = 0 points.
• Black youth ownership: 100% = 4 points; 30% to 99% = 2 points; less than 30% = 0 points.
• Owners with disability: 20% or more = 4 points; more than 10% but less than 20% = 2 points; less than 10% = 0 points.
• Supporting evidence: IDs, a CIPC report from within three months of closing or a recent CSD report; B-BBEE certificate or sworn affidavit; a doctor's letter confirming disability plus a CSD report not older than one year.
• Failure to submit the required proof means the specific-goals points are not claimed.

Stage 4 — Due diligence

• NLC may verify the accuracy and authenticity of information, inspect premises, validate compliance, check references with previous clients and National Treasury's Restricted Suppliers database, and assess financial stability.

Stage 5 — Contract and award

• NLC may negotiate with the preferred bidder and request a best and final offer before concluding the contract.

Scope

• Supply, deliver, install and configure a cloud-based vulnerability management system for the National Lotteries Commission, licensed for 12 months.
• Quantity: 1 licensed instance.
• Coverage: 500 user devices and servers (Windows and Linux).

Scanning

• Real-time vulnerability scanning of user laptops, servers (Windows and Linux), network devices (switches, routers, firewall) and the website www.nlcsa.org.za.

Monitoring and reporting

• Real-time dashboard monitoring.
• Risk assessment report based on a score matrix (for example a risk score between 0 and 1000, or percentages).
• Reporting on End of Support operating systems, obsolete hardware, End of Life and End of Support software.
• Reporting on known exploitable vulnerabilities.
• Reporting on vulnerability severity levels: Low, Medium, High, Critical.

Remediation

• Patching capability for detected vulnerabilities where applicable.

Information to be provided by the bidder

• Estimated delivery lead time from receipt of an NLC purchase order.
• Method of delivery of the goods to NLC.
• What is required for installation and configuration, and how long it will take.

Duration

• A once-off service, effective from the date of appointment and issue of an official NLC purchase order.

No minimum years of experience or key personnel qualifications are stated. The National Industrial Participation Programme applies to contracts with imported content and is obligatory; bidders must sign and submit the relevant Standard Bidding Document. Quotations must be submitted in English.

NLC conducts regular supplier performance reviews against the contract deliverables using supplier evaluation forms, with at least an annual review for contracts longer than a year and a review at completion for shorter contracts. Ad-hoc reviews are held where non-performance is identified outside the review period. Non-performance is addressed by a formal letter setting out the underperforming areas and the remedial action required within specified time frames; failure to comply leads to escalating performance management action. Either party may request a joint performance review.

The price schedule covers the supply, delivery, installation and configuration of a cloud-based vulnerability management system: one licensed instance capable of scanning user laptops, servers (Windows and Linux), network devices and the website, with real-time dashboard monitoring, reporting, coverage of 500 devices and patching capability. Quantity is 1 and the bidder must state a single total price, all inclusive.

Pricing format

• Complete the price schedule for the supply, delivery, installation and configuration of the vulnerability management system.
• One line item, quantity 1.
• State a single total price, all inclusive, in Rand.
• Financial/pricing information must be submitted as a separate attachment from the technical response.

Contract price adjustment

• NLC may negotiate with the preferred bidder and request a best and final offer before award.

No bid security, performance guarantee, retention or stated payment terms are specified.

Central Supplier Database

• Bidders must self-register on National Treasury's CSD at https://secure.csd.gov.za/ and provide their CSD registration number and a CSD summary report.
• A valid tax compliance status must be in place on the closing date.
• NLC may not award to a bidder not registered on the CSD.
• Only foreign suppliers with no locally registered entity are exempt, and they must complete the foreign supplier questionnaire.

Tax

• Submit a SARS tax compliance status PIN or a printed TCS certificate.
• In consortia, joint ventures or sub-contracting arrangements, each party must submit a separate TCS certificate/PIN and CSD number.

B-bbee

• Submit a valid B-BBEE certificate or sworn affidavit (EME/QSE) to claim preference points.
• A joint venture must submit a valid joint/consolidated B-BBEE certificate or affidavit.

Product authorisation

• Submit a valid certificate from the Original Equipment Manufacturer or equivalent written OEM authorisation.

Standard forms

• SBD 1 (Invitation to Bid): signed offer cover page with bidder details.
• SBD 4 (Declaration of Interest): discloses state employment and related interests; non-disclosure of linked CSD-registered companies disqualifies the bid.
• SBD 6.1 (Preference Points Claim Form): claims specific-goals points.
• POPIA consent form: consents to processing of personal information.

Other

• Bidders in the service of the state, companies with directors in the service of the state, and close corporations with members in the service of the state will not be considered.
• Listing on the Register for Tender Defaulters or the List of Restricted Suppliers disqualifies the bidder.
• The bidder warrants that all employees, including sub-contractors, are covered under the Compensation for Occupational Injuries and Diseases Act, and may be asked for proof of good standing with the Compensation Fund.
• The National Industrial Participation Programme applies to contracts with imported content; bidders must sign and submit the relevant Standard Bidding Document.
• Quotations must be submitted in English.

The bidder warrants that all employees, including those of any sub-contractor, are covered under the Compensation for Occupational Injuries and Diseases Act, and that cover remains in force for the duration of the adjudication and any subsequent agreement. The Commission may request proof of registration and good standing with the Compensation Fund. Personal information is processed in line with POPIA and the Commission's data privacy policy, and bids are treated as contractually binding. The bidder must notify the Commission in writing of any unauthorised access to personal information, including through cybercrime, and report it to the relevant authorities.

The service is a once-off engagement effective from the date of appointment and issue of an official NLC purchase order. No goods may be delivered or services rendered before an official purchase order is received. Bidders and their agents may not issue news releases about the RFQ or any resulting agreement without the Commission's consent. The RFQ document is confidential and its intellectual property vests with the Commission. Late and incomplete submissions are not accepted.

Mandatory documents: completed and signed SBD 1, SBD 4 and SBD 6.1; signed POPIA consent form; CSD registration with a valid tax compliant status; valid B-BBEE certificate or sworn affidavit; valid OEM certificate or equivalent written OEM authorisation. Bids that do not fully meet the mandatory requirements are disqualified.

Evaluation uses the 80/20 preference point system. Stage 1: closing and opening on 06 October 2026 at 11:00, with late bids rejected. Stage 2: administrative compliance and mandatory requirements, with non-compliant bids disqualified. Stage 3: 80 points for price and 20 points for specific goals — black ownership up to 8 points, black women ownership up to 4 points, black youth ownership up to 4 points, and ownership by persons with disability up to 4 points. Stage 4: due diligence, including verification, office inspection, reference checks and financial stability assessment. Stage 5: contract and award, with possible negotiation and a request for best and final offers.