RFI 14-2026-2027: independent network infrastructure and separation from dtic-managed services

Closing date: 06 November 2026 at 16:00

Compulsory briefing session: None (N/A)

Enquiries:

• Contact: CCSA Supply Chain Management
• Email: [email protected]
• Telephone: +27(0) 12 394 3200 / 3320

Submission:

• Method: email
• Submission email: [email protected]

Physical address:

DTI Campus, Mulayo (Block C)

77 Meintjies Street

Sunnyside, Pretoria

Postal address:

Private Bag X23

Lynnwood Ridge

0040, South Africa

Submission method: email

Submission email: [email protected]

• Submit one emailed response including all supporting documents.
• The original copy must be signed by an authorised employee, agent or representative of the respondent.
• The email subject line must clearly state the responding organisation's name, the RFI number and the RFI description.
• Respondents must register their interest by providing company name, contact person, telephone, cell number and email address, with the RFI number in the subject line, so that addenda and clarifications are communicated.
• Responses must outline costing implications and any economic factors (e.g. exchange rate) that may pose a risk to the costing.

Returnable documents:

• Proof of registration on the Central Supplier Database (CSD) report.

Confidentiality:

• All information related to the RFI must be treated as strictly confidential during and after completion; disclosure requires prior written approval from the Commission.

This is a Request for Information (RFI), not a tender. It will not result in an award or appointment. Responses are used for market analysis, refinement of requirements, procurement planning and budget estimation. Any subsequent procurement will be through a separate process.

Mandatory document:

• Proof of registration on the Central Supplier Database (CSD) report.

The Competition Commission requires the implementation of a fully independent network infrastructure and separation from DTIC-managed network services. The solution must support approximately 250 users with capacity for growth over the next five to ten years.

Scope of work:

• Core network design, supply, installation and commissioning.
• Distribution-layer deployment for Block C and Block G.
• Access-layer deployment and migration.
• Structured-cabling and communications-room verification.
• Fibre path, strand, connector and optical-loss certification.
• Network migration, cutover, rollback and stabilisation services.
• As-built documentation, configuration records and knowledge transfer.

Security services:

• Network segmentation and least-privilege inter-zone access.
• Network Access Control using Aruba ClearPass.
• 802.1X and identity-based access control.
• Remote-access and multifactor-authentication integration.
• Security policy, logging and audit-control implementation.

Network services:

• Commission-owned DNS and DHCP services.
• Microsoft Active Directory and Microsoft Entra ID integration.
• Certificate Services integration for EAP-TLS.
• Time synchronisation, central logging, monitoring and configuration backup.

Required solution architecture:

• Core layer: Aruba CX 8325 deployed as a resilient pair.
• Distribution layer: Aruba CX 8100 resilient pairs for Block C and Block G.
• Access layer: Aruba CX 6100 and Aruba CX 6200M.
• Security layer: Retained FortiGate 200F high-availability pair.
• Network access control: Aruba ClearPass.
• Network management: Aruba Central.
• Service monitoring: Aruba UXI plus an independent MSP monitoring platform.

Existing equipment to be reused:

• Aruba CX 8325 core switch: 1
• Aruba CX 6100 48-port PoE+ access switches: 16
• Aruba CX 6200M 24-port PoE+ access switches: 3
• FortiGate 200F firewalls: 2

Additional equipment (minimum quantities):

• Aruba CX 8325 core switch: 1
• Aruba CX 8100 distribution switches: 4
• Aruba CX 6100 access switches: 0
• Aruba ClearPass N1000 appliances: 2
• ClearPass concurrent endpoint licence: 1 x 1,000 endpoints
• Aruba UXI sensors and subscriptions: 2
• Aruba Central licences: for all managed network devices
• Optical transceivers, DACs, patch leads and accessories: as required by the approved detailed design

Network segmentation (VLANs):

• VLAN 10: Network Management – restricted to authorised ICT administration
• VLAN 20: Corporate Users – controlled access to approved services
• VLAN 30: Voice Services – QoS-enabled and separated from user data
• VLAN 40: Printers and Peripherals – restricted service-specific access
• VLAN 50: Server Infrastructure – protected critical-services segment
• VLAN 60: Guest Network – internet-only; no internal access
• VLAN 70: Mobile Devices – role-based and restricted access
• VLAN 80: CCTV and Surveillance – isolated from corporate user networks
• VLAN 90: Forensic Environment – highly restricted; no internet by default
• VLAN 100: Infrastructure Services – NTP, monitoring, logging, backup and management services

Security and access control:

• Deploy redundant Aruba ClearPass services.
• Support IEEE 802.1X, RADIUS and TACACS+ as applicable.
• Implement EAP-TLS certificate-based authentication for managed endpoints.
• Integrate with Active Directory, Microsoft Entra ID and Certificate Services.
• Provide device profiling and role-based or dynamic network assignment.
• Provide controlled guest onboarding and internet-only guest access.
• Support restricted access for printers, voice devices, cameras and other non-802.1X devices.
• Retain and integrate the FortiGate 200F high-availability pair.
• Implement VLAN gateway interfaces, DHCP relay and inter-zone security policies.
• Apply least-privilege access and explicit deny controls between restricted networks.
• Enable logging on critical security policies and administrative activity.
• Review and rationalise obsolete, duplicate and overly permissive rules.
• Validate firewall failover, session continuity and redundant uplinks.
• Use encrypted management protocols (HTTPS, SSH v2, SNMPv3, SFTP/SCP, secure syslog).
• Disable insecure legacy protocols where technically possible.
• Require multifactor authentication for privileged administrative access.
• Restrict administrative access to the management network.
• Integrate security logs with the Commission's central monitoring or SIEM capability.
• Implement protected, version-controlled configuration backups and tested restoration procedures.

Monitoring and management:

• Aruba Central: centralised inventory, health and topology visibility; configuration management, templates and backup; firmware lifecycle and compliance reporting; telemetry, alerts, performance analytics and operational reporting; zero-touch provisioning where supported.
• Independent monitoring platform: vendor-independent, capable of monitoring Aruba, Fortinet, ClearPass, core services and connectivity. Acceptable examples include PRTG, SolarWinds, ManageEngine OpManager, Zabbix or IRIS NMS, subject to Commission approval.

Availability, resilience and recovery:

• Resilient core and distribution switching.
• Redundant links from access to upstream layers where supported.
• FortiGate high-availability operation and tested failover.
• Primary and secondary internet connectivity with automatic failover.
• Redundant DNS, DHCP and Active Directory services.
• Redundant ClearPass services.
• Automated configuration backup and documented restoration processes.
• UPS, power-distribution and cooling readiness for all communications rooms.

Recovery time objectives:

• Network infrastructure: 4 hours
• Active Directory: 1 hour
• DNS and DHCP: 2 hours
• Internet connectivity: 30 minutes
• Security services: 1 hour
• Forensic environment: 24 hours

Implementation and migration approach:

• Four migration waves: core infrastructure; core network services; production services; security and DTIC dependency removal.
• Each wave must include a detailed method of procedure, approved change record, communication plan, test script, acceptance criteria, rollback plan and post-change review.
• Production cutovers must be coordinated with the Commission, DTIC, VOX and other affected stakeholders.

Mandatory deliverables:

• Project initiation and detailed project plan.
• Current-state validation and site-readiness report.
• High-Level Design and approved Low-Level Design.
• Detailed bill of materials and licensing schedule.
• Implementation and configuration standards.
• Migration, cutover and rollback plans.
• Security segmentation matrix and firewall rule requirements.
• IP addressing, VLAN, DNS and DHCP design.
• Test plans, test evidence and acceptance reports.
• As-built physical and logical network diagrams.
• Configuration backups and golden configuration templates.
• Operational runbooks, recovery procedures and escalation matrix.
• Asset register and warranty/support schedule updates.
• Knowledge-transfer sessions and administrator training.
• Post-implementation support and stabilisation report.
• Project closure report and formal operational handover.

Testing and acceptance criteria:

• Physical infrastructure: equipment, optics, fibre, power and environmental readiness verified.
• Core and distribution: redundancy and failover tests completed successfully.
• Connectivity: all approved campus links operational at designed capacity.
• DNS and DHCP: name resolution, lease allocation and failover verified.
• Identity and NAC: corporate, guest, printer, voice and restricted-device scenarios validated.
• Security segmentation: approved allow/deny matrix confirmed through testing.
• Internet resilience: primary/secondary path failover verified.
• Monitoring: alerts, dashboards, escalation and reporting operational.
• Backups and recovery: configuration restoration demonstrated.
• Business services: user acceptance completed with no unresolved critical defects.
• DTIC separation: no production dependency on DTIC network services remains.
• Handover: documentation, training, support and asset records accepted.

Support, warranty and stabilisation:

• Manufacturer-backed warranties and support for all supplied equipment and licences.
• Proposal must specify support hours, severity definitions, response and restoration targets, escalation paths, replacement arrangements, subscription periods and renewal costs.
• Post-implementation stabilisation period required, during which the service provider remains responsible for correcting implementation defects and supporting operational handover.

Project success criteria:

• All approved users, devices and services operate on Commission-controlled infrastructure.
• DNS and DHCP services operate independently of DTIC.
• Security segmentation and access-control requirements are implemented and tested.
• Monitoring, alerting, configuration backup and operational reporting are functional.
• Critical redundancy and failover mechanisms are successfully tested.
• The forensic environment remains isolated in accordance with approved requirements.
• All DTIC network dependencies identified for removal are decommissioned.
• The Commission's ICT team receives complete documentation, training and operational control.
• All critical and high-severity implementation defects are resolved before final acceptance.

Dependencies and assumptions:

• Timely access to the SSC, Block C, Block G and all communications rooms.
• Cooperation from DTIC for infrastructure access, migration coordination and decommissioning.
• Cooperation from VOX for firewall, wireless and connectivity changes.
• Successful fibre, cabling, power, UPS and cooling validation.
• Availability of approved IP addressing, change windows and business representatives for testing.
• Final governance approval for Aruba Central deployment and associated data-sovereignty considerations.

The RFI seeks information on implementation approaches, lead times, dependencies and indicative costs for establishing a fully independent network infrastructure and separating from DTIC-managed network services. Responses will inform market analysis, refinement of requirements, procurement planning and budget estimation.

Service provider must demonstrate enterprise campus network design and implementation experience, current Aruba technical capability (AOS-CX, VSX, Aruba Central, ClearPass), Fortinet integration and firewall migration capability, and experience with Microsoft Active Directory, DNS, DHCP, Entra ID and certificate-based authentication. Must provide project management, engineering, testing, documentation and knowledge transfer, and have access to manufacturer support and escalation channels. Must name a project manager, lead network architect and cybersecurity specialist, and submit reference projects of comparable complexity.

All pricing is indicative and for market analysis and budget purposes only. Pricing must be transparent and itemised, separating hardware, software, professional services, cabling, training, project management, post-implementation support, annual support and optional items. State amounts in ZAR excluding VAT, show VAT separately. Provide an itemised bill of materials with quantities, unit rates and licence metrics. Separate once-off costs from recurring charges and optional items. Any alternative solution must be priced separately from the baseline.

All pricing is indicative and for market analysis and budget purposes only. This RFI will not result in an award or appointment.

Pricing must be transparent and itemised, and the financial response must separate:

• Hardware and physical accessories.
• Software, subscriptions and licences.
• Professional services and implementation.
• Cabling, fibre testing and remediation.
• Training and knowledge transfer.
• Project management and documentation.
• Post-implementation support and managed services.
• Annual support and renewal costs.
• Optional items and future expansion rates.
• Taxes and all other charges.

Completion instructions:

• State all amounts in South African rand (ZAR), excluding VAT unless indicated otherwise. Show VAT separately at the applicable rate, or indicate if not applicable.
• Do not include the purchase price of existing assets to be reused; identify any associated configuration, support or renewal costs separately.
• Provide an itemised supporting bill of materials with product/model or SKU, quantities, unit rates, licence metrics and terms.
• Where quantities are not specified, state the assumed quantity and sizing basis.
• Separate once-off costs from recurring charges and optional items, and avoid double counting bundled or prepaid charges.
• Any alternative solution must be priced separately from the specified baseline, with differences explained.

Pricing schedules:

• Schedule A: Once-off equipment and implementation costs.
• Schedule B: Recurring licences, subscriptions, support and managed services (first 12 months).
• Schedule C: Optional items, alternatives and future expansion rates.
• Schedule D: Indicative budget summary and respondent confirmation.

Supporting assumptions and qualifications must include: implementation duration and equipment lead times; support hours, response/restoration targets and warranty periods; licence/subscription terms and renewal costs; exclusions and Commission/third-party dependencies; provisional allowances for unverified site conditions; currency/exchange-rate assumptions, pricing base date and escalation factors; and identification of costs not estimated and their likely budget impact.

Mandatory document:

• Proof of registration on the Central Supplier Database (CSD) report.

Service provider requirements:

• Demonstrated enterprise campus network design and implementation experience.
• Current Aruba technical capability relevant to AOS-CX, VSX, Aruba Central and ClearPass.
• Fortinet integration and firewall migration capability.
• Experience with Microsoft Active Directory, DNS, DHCP, Entra ID and certificate-based authentication.
• Ability to provide project management, engineering, testing, documentation and knowledge transfer.
• Access to manufacturer support and escalation channels.
• A named project manager, lead network architect and cybersecurity specialist.
• Submission of reference projects of comparable complexity.

This RFI does not create any contractual rights or obligations. All information provided by the Commission must be treated as confidential and used only to prepare a response. Respondents must restrict access to persons who require it for this purpose and ensure those persons are bound by confidentiality obligations. No Commission information may be disclosed or reproduced for another purpose without prior written approval. The Commission may use submitted information for internal evaluation, planning, budgeting and procurement preparation, subject to applicable legal obligations.