What are the technical specifications?

The Postbank is a regulated financial institution that must comply with the Payment Card Industry Data Security Standard (PCI DSS). One of the mandatory requirements (Requirement 11.2.2) is the regular execution of external vulnerability scans by an Approved Scanning Vendor (ASV). Bidder is required to provide the following: • Design and implement solutions to meet all Postbank’s requirements for a Cloud based desktop solution (VDI) • submission requirement to support a PCI DSS compliant system. • Data & banking regulations, controls to deliver a compliant solution (data leaks prevention, ransomware prevention and POPI act compliance. • Deliver a fully compliant, auditable solution at both sites (Prod, DR). • Provide all necessary documentation, certifications, and training. • Provide a dedicated team of support agents to manage and support the system until handed over to the internal team. • The solution should be capable of being hosted on Postbank’s cloud of choice, e.g. AWS. • The solution should support +1000 users and be capable of being scaled up or down. 3. Objective of the bid The objective of this procurement is to secure the services of a qualified ASV to perform nonintrusive external vulnerability scans on Postbank’s systems for a period of 3 years, ensuring compliance with PCI DSS. The appointed vendor shall provide the following services: 4.1 PCI DSS External Vulnerability Scans • Conduct non-intrusive scans of Postbank’s external IP addresses and domain endpoints. • Ensure scans meet PCI DSS and ASV program requirements. • Identify vulnerabilities, misconfigurations, and risks. • Submit results to Postbank in the PCI-compliant report format. 4.2 Frequency • Quarterly scans (every 3 months including a maximum of 3 rescans after remediation), for a minimum of 12 scans over 3 years. • Additional ad-hoc scans may be requested by Postbank. of 41 4.3 Reporting • Deliver detailed vulnerability reports after each scan, including: • Summary of findings • Vulnerability severity (per PCI DSS/industry standard) • Technical vulnerability report with CVSS scoring • Recommended remediation steps • Remediation recommendations per vulnerability • PCI DSS compliance status for each scanned asset • Evidence of PCI DSS compliance status (Pass/Fail) • Reports must be submitted in PDF and editable formats. 4.4 Consultation • Provide guidance on remediation of critical vulnerabilities. • Offer consultation calls for interpreting results if required 4.5 Compliance • Scans must comply with the latest PCI DSS standard and ASV program guidelines. • Vendor must maintain valid ASV certification throughout the engagement • Maintain confidentiality and data protection of Postbank information - Vendor must sign a Non-Disclosure Agreement (NDA) prior to engagement 5. Deliverables Deliverable Description Frequency Format External Vulnerability Comprehensive report of all Quarterly PDF & findings, compliance status, and Scan Reports Excel/Word recommendations ASV Attestation of Formal attestation confirming scan meets Quarterly Signed PDF Scan Compliance PCI DSS ASV requirements Executive Summary High-level summary for management Quarterly PDF of 41 6. Bid Evaluation Process The bid will be evaluated in three (3) phases: • Phase 1: Mandatory Requirements Criteria - Only bidders that have complied with the Mandatory criteria will be considered for functional requirements evaluation • Phase 2: Functional Requirements Criteria - Only bidders that have complied with and have obtained a minimum of 60 points (Functional Requirements Evaluation) will be considered for price evaluation • Phase 3: Price and Specific Goals (80/20) 6.1 Phase 1: Mandatory Requirements Criteria Comply

Who should be contacted for queries about this tender?

{"name":null,"email":"RFP@PostBank.co.za","phone":null,"department":"/ PUBLIC ENTITY)","address":null}

The procurement of a qualified Approved Scanning Vendor (ASV) secured services to perform nonintrusive external vulnerability scans on Postbank’s systems for a period of 3 years.

The procurement of a qualified approved scanning vendor (asv) secured services to perform nonintrusive external vulnerability scans on postbank’s systems for a period of 3 years.

{"closingDate":"24 July 2026","closingTime":"11:00 am"}

{"name":null,"email":"[email protected]","phone":null,"department":"/ PUBLIC ENTITY)","address":null}

SIGNATURE OF BIDDER:................................................... CAPACITY UNDER WHICH THIS BID IS SIGNED:................................................... (Proof of authority must be submitted e.g. company resolution) DATE:

Valid ASV certification from PCI Security Standards Council; demonstrated experience with financial institution PCI DSS scans (references required); compliance with South African tax obligations (SARS PIN/CSD number); not disqualified via SBD 4 declarations (e.g., no state employment conflicts, no tender defaulters); foreign suppliers must complete questionnaire but may bid; joint ventures/consortia allowed with separate documentation per member; minimum 60 points in functional evaluation to proceed to price evaluation.

The Postbank is a regulated financial institution that must comply with the Payment Card

Industry Data Security Standard (PCI DSS). One of the mandatory requirements (Requirement

11.2.2) is the regular execution of external vulnerability scans by an Approved Scanning

Vendor (ASV).

Bidder is required to provide the following:

Design and implement solutions to meet all Postbank’s requirements for a Cloud based

desktop solution (VDI)

submission requirement to support a PCI DSS compliant system.
Data & banking regulations, controls to deliver a compliant solution (data leaks

prevention, ransomware prevention and POPI act compliance.

Deliver a fully compliant, auditable solution at both sites (Prod, DR).
Provide all necessary documentation, certifications, and training.
Provide a dedicated team of support agents to manage and support the system until

handed over to the internal team.

The solution should be capable of being hosted on Postbank’s cloud of choice, e.g.

Aws.

The solution should support +1000 users and be capable of being scaled up or down.

3. Objective of the bid

The objective of this procurement is to secure the services of a qualified ASV to perform

nonintrusive external vulnerability scans on Postbank’s systems for a period of 3 years,

ensuring compliance with PCI DSS.

The appointed vendor shall provide the following services:

4.1 PCI DSS External Vulnerability Scans

Conduct non-intrusive scans of Postbank’s external IP addresses and domain endpoints.
Ensure scans meet PCI DSS and ASV program requirements.
Identify vulnerabilities, misconfigurations, and risks.
Submit results to Postbank in the PCI-compliant report format.

4.2 Frequency

Quarterly scans (every 3 months including a maximum of 3 rescans after remediation), for

a minimum of 12 scans over 3 years.

Additional ad-hoc scans may be requested by Postbank.

of 41

4.3 Reporting

Deliver detailed vulnerability reports after each scan, including:
Summary of findings
Vulnerability severity (per PCI DSS/industry standard)
Technical vulnerability report with CVSS scoring
Recommended remediation steps
Remediation recommendations per vulnerability
PCI DSS compliance status for each scanned asset
Evidence of PCI DSS compliance status (Pass/Fail)
Reports must be submitted in PDF and editable formats.

4.4 Consultation

Provide guidance on remediation of critical vulnerabilities.
Offer consultation calls for interpreting results if required

4.5 Compliance

Scans must comply with the latest PCI DSS standard and ASV program guidelines.
Vendor must maintain valid ASV certification throughout the engagement
Maintain confidentiality and data protection of Postbank information - Vendor must sign a

Non-Disclosure Agreement (NDA) prior to engagement

5. Deliverables

Deliverable Description Frequency Format

External Vulnerability Comprehensive report of all Quarterly PDF &

findings, compliance status, and Scan Reports Excel/Word

recommendations

ASV Attestation of Formal attestation confirming scan meets Quarterly Signed PDF

Scan Compliance PCI DSS ASV requirements

Executive Summary High-level summary for management Quarterly PDF

of 41

6. Bid Evaluation Process

The bid will be evaluated in three (3) phases:

Phase 1: Mandatory Requirements Criteria - Only bidders that have complied with

the Mandatory criteria will be considered for functional requirements evaluation

Phase 2: Functional Requirements Criteria - Only bidders that have complied with

and have obtained a minimum of 60 points (Functional Requirements Evaluation) will

be considered for price evaluation

Phase 3: Price and Specific Goals (80/20)

6.1 Phase 1: Mandatory Requirements Criteria

Comply

and binding. The onus to enquire and obtain clarity in this regard rests with the Bidder(s).

The Bidder(s) shall take care to restrict its enquiries in this regard to the most reasonable

interpretations required to ensure the necessary consensus.

2.2 Preferential procurement reform

2.2.1 POSTBANK supports B-BBEE as an essential ingredient of its business. In accordance

with government policy, POSTBANK insists that the private sector demonstrates its

commitment and track record to B-BBEE in the areas of ownership (shareholding), skills

transfer, employment equity and procurement practices (SMME Development) etc.

2.2.2 POSTBANK shall apply the principles of the Preferential Procurement Policy Framework

Act, (Act No. ) to this proposal read together with the Preferential Regulations,

2022.

of 41

2.4 Objection to brand specific requirements

2.4.1 Any bidder who has reasons to believe that the RFB/P specification is based on a

specific brand must inform POSTBANK within seven (7) days after the publication of the

0 points

0-1 Reference Letter

2 Reference Letters 20 points

3-4 Reference Letters 40 points

5 or more Reference Letters 50 points

Company Experience 30

10 points

1- 2 years’ experience

3 years’ experience 20 points

of 41

4 or more years of experience 30 points

Total Points Allocation 100

6.3 Phase 3: Price and Specific Goals (80/20)

Commercial – Price and Specific goals

Section 1 .................................................................................................................................. 5

Bidder’s details .................................................................................................................... 5

Section 2 .................................................................................................................................. 6

Bid terms of reference ..................................................................................................... 6

Section 3 .................................................................................................................................. 8

Specification ......................................................................................................................... 9

Section 4 .................................................................................................................................. 9

Pricing schedule/costing model......................................................................15

Section 5 ................................................................................................................................ 15

STANDARD BID DOCUMENTS (SBDs) ................................................................................... 18

Section 6 ................................................................................................................................ 18

Government procurement: general conditions of contract – july 2011 .. 26

of 41

Section 1

Bidder’s details

threshold – 60 points will be evaluated on pricing.

Pricing will be evaluated in accordance with the 80/20 preference point system, where: o

80 points are allocated to price; o 20 points are allocated to specific goals (where

applicable).

of 41

Section 5

Yes/ No Must be a PCI Security Standards Council (PCI SSC) Approved Scanning Vendor (ASV) - Valid ASV certification. Provide valid ASV certification Demonstrated experience performing PCI DSS external vulnerability scans for financial institutions - References from previous clients with similar scope and regulatory requirements 6.2 Phase 2: Functional Requirements Criteria A minimum of 60 points is required for bidders to considered for price evaluation.

Points Allocation: 80 points

B-BBEE Details: ally applicable to all

matters addressed in this RFB/P. It, however, remains the exclusive domain and election

of POSTBANK as to which of these stipulations are applicable and to what extent.

Bidders are hereby acknowledging that the decision of POSTBANK in this regard is final

and binding. The onus to enquire and obtain clarity in this regard rests with the Bidder(s).

The Bidder(s) shall take care to restrict its enquiries in this regard to the most reasonable

interpretations required to ensure the necessary consensus.

2.2 Preferential procurement reform

2.2.1 POSTBANK supports B-BBEE as an essential ingredient of its business. In accordance

with government policy, POSTBANK insists that the private sector demonstrates its

commitment and track record to B-BBEE in the areas of ownership (shareholding), skills

transfer, employment equity and procurement practices (SMME Development) etc.

2.2.2 POSTBANK shall apply the principles of the Preferential Procurement Policy Framework

Act, (Act No. ) to this proposal read together with the Preferential Regulations,

2022.

of 41

2.4 Objection to brand specific requirements

2.4.1 Any bidder who has reasons to believe that the RFB/P specification is based on a

specific brand must inform POSTBANK within seven (7) days after the publication of the

Rfb/p.

2.5 Instructions for submitting bids

2.5.1 Bid responses must be submitted to the email address as stipulated on the cover page

of 41

Section 3

3. Special Conditions of the Bid

3.1 POSTBANK shall not make upfront payment.

3.2 The preparation of response shall be made without obligation to acquire any of the items

included in any bidder’s proposal or to select any proposal.

3.3 POSTBANK may request written clarification regarding any aspect of

HDI Requirement: 51%

SBD 6.1 PREFERENCE POINTS CLAIM FORM IN TERMS OF THE PREFERENTIAL PROCUREMENT REGULATIONS 2022 This preference form must form part of all tenders invited. It contains general information and serves as a claim form for preference points for specific goals. NB: BEFORE COMPLETING THIS FORM, TENDERERS MUST STUDY THE GENERAL CONDITIONS, DEFINITIONS AND DIRECTIVES APPLICABLE IN RESPECT OF THE TENDER AND PREFERENTIAL PROCUREMENT REGULATIONS, 2022 1. GENERAL CONDITIONS 1.1 The following preference point systems are applicable to invitations to tender: - the 80/20 system for requirements with a Rand value of up to R50 000 000 (all applicable taxes included); and - the 90/10 system for requirements with a Rand value above R50 000 000 (all applicable taxes included). 1.2 To be completed by the organ of state a) The applicable preference point system for this tender is the 80/20 or 90/10 preference point system. 1.3 Points for this tender (even in the case of a tender for income-generating contracts) shall be awarded for: (a) Price; and (b) Specific Goals. 1.4 To be completed by the organ of state: The maximum points for this tender are allocated as follows: POINTS PRICE 80 SPECIFIC GOALS 20 Total points for Price and SPECIFIC GOALS 100 1.5 Failure on the part of a tenderer to submit proof or documentation required in terms of this tender to claim points for specific goals with the tender, will be interpreted to mean that preference points for specific goals are not claimed. 1.6 The organ of state reserves the right to require of a tenderer, either before a tender is adjudicated or at any time subsequently, to substantiate any claim in regard to preferences, in any manner required by the organ of state. 2. DEFINITIONS (a) “tender” means a written offer in the form determined by an organ of state in response to an invitation to provide goods or services through price quotations, competitive tendering process or any other method envisaged in legislation; (b) “price” means an amount of money tendered for goods or services, and includes all applicable taxes less all unconditional discounts; (c) “rand value” means the total estimated value of a contract in Rand, calculated at the time of bid invitation, and includes all applicable taxes; (d) “tender for income-generating contracts” means a written offer in the form determined by an organ of state in response to an invitation for the origination of income-generating contracts through any method envisaged in legislation that will result in a legal agreement between the organ of state and a third party that produces revenue for the organ of state, and includes, but is not limited to, leasing and disposal of assets and concession contracts, excluding direct sales and disposal of assets through public auctions; and (e) “the Act” means the Preferential Procurement Policy Framework Act, 2000 (Act No. ). 3. FORMULA FOR PROCUREMENT OF GOODS AND SERVICES 3.1. POINTS AWARDED FOR PRICE 3.1.1 THE 80/20 OR 90/10 PREFERENCE POINT SYSTEMS A maximum of 80 or 90 points is allocated for price on the following basis: 80/20or90/10 Pt−Pmin Pt−Pmin Ps= 80(1− )orPs= 90(1− ) Pmin Pmin Where Ps=Points scored for price of tender under consideration Pt=Price of tender under consideration Pmin=Price of lowest acceptable tender 3.2. FORMULA FOR DISPOSAL OR LEASING OF STATE ASSETS AND INCOME GENERATING PROCUREMENT 3.2.1. POINTS AWARDED FOR PRICE A maximum of 80 or 90 points is allocated for price on the following basis: 80/20 or 90/10 Pt−Pmax Pt−Pmax Ps= 80(1+ )orPs= 90(1+ ) Pmax Pmax Where Ps=Points scored for price of tender under consideration Pt=Price of tender under consideration Pmax=Price of highest acceptable tender 4. POINTS AWARDED FOR SPECIFIC GOALS 4.1. In terms of Regulation 4(2); 5(2); 6(2) and 7(2) of the Preferential Procurement Regulations, preference points must be awarded for specific goals stated in the tender. For the purposes of this tender the tenderer will be allocated points based on the goals stated in table 1 below as may be supported by proof/ documentation stated in the conditions of this tender: 4.2. In cases where organs of state intend to use Regulation 3(2) of the Regulations, which states that, if it is unclear whether the 80/20 or 90/10 preference point system applies, an organ of state must, in the tender documents, stipulate in the case of— (a) an invitation for tender for income-generating contracts, that either the 80/20 or 90/10 preference point system will apply and that the highest acceptable tender will be used to determine the applicable preference point system; or (b) any other invitation for tender, that either the 80/20 or 90/10 preference point system will apply and that the lowest acceptable tender will be used to determine the applicable preference point system, then the organ of state must indicate the points allocated for specific goals for both the 90/10 and 80/20 preference point system. Table 1: Specific goals for the tender and points claimed are indicated per the table below. (Note to organs of state: Where either the 90/10 or 80/20 preference point system is applicable, corresponding points must also be indicated as such. Note to tenderers: The tenderer must indicate how they claim points for each preference point system.) Number of points Number of points claimed (80/20 system) The specific goals allocated allocated points in terms of this tender (80/20 system) (To be completed by the tenderer) (To be completed by the organ of state) Historically Disadvantaged 8 individuals (51% and above) Women (51% and above) 7 Disabled (51% and above) 5 DECLARATION WITH REGARD TO COMPANY/FIRM 4.3. Name of company/firm: .................................................................. 4.4. Company registration number: .......................................................... 4.5. TYPE OF COMPANY/ FIRM  Partnership/Joint Venture / Consortium  One-person business/sole propriety  Close corporation  Public Company  Personal Liability Company  (Pty) Limited  Non-Profit Company  State Owned Company [Tick applicable box] 4.6. I, the undersigned, who is duly authorised to do so on behalf of the company/firm, certify that the points claimed, based on the specific goals as advised in the tender, qualifies the company/ firm for the preference(s) shown and I acknowledge that: i) The information furnished is true and correct; ii) The preference points claimed are in accordance with the General Conditions as indicated in paragraph 1 of this form; iii) In the event of a contract being awarded as a result of points claimed as shown in paragraphs 1.4 and 4.2, the contractor may be required to furnish documentary proof to the satisfaction of the organ of state that the claims are correct; iv) If the specific goals have been claimed or obtained on a fraudulent basis or any of the conditions of contract have not been fulfilled, the organ of state may, in addition to any other remedy it may have – (a) disqualify the person from the tendering process; (b) recover costs, losses or damages it has incurred or suffered as a result of that person’s conduct; (c) cancel the contract and claim any damages which it has suffered as a result of having to make less favourable arrangements due to such cancellation; (d) recommend that the tenderer or contractor, its shareholders and directors, or only the shareholders and directors who acted on a fraudulent basis, be restricted from obtaining business from any organ of state for a period not exceeding 10 years, after the audi alteram partem (hear the other side) rule has been applied; and (e) forward the matter for criminal prosecution, if deemed necessary. .............................................. SIGNATURE(S) OF TENDERER(S) SURNAME AND NAME: ................................................................ DATE:............................................................... ADDRESS:............................................................... ................................................................ ................................................................

2.1 Precedence of documents

2.1.1 This RFB/P consists of a number of sections (see list). Where there is a contradiction in

terms between the clauses, phrases, words, stipulations or terms and herein referred to

generally as stipulations in this RFB/P and the stipulations in any other document

attached hereto, or the RFB/P submitted hereto, the relevant stipulations in this RFB/P

shall take precedence.

2.1.2 Where this RFB/P is silent on any matter, the relevant stipulations addressing such

matter and which appear in the PPPFA shall take precedence. Bidders shall refrain from

incorporating any additional stipulations in its proposal submitted in terms hereof other

than in the form of a clearly marked recommendation that POSTBANK may in its sole

discretion elect to import or to ignore. Any such inclusion shall not be used for any

purpose of interpretation unless it has been so imported or acknowledged by

is free of any errors and omissions and that he/she is able to deliver the service on the quoted

price.

Name of delegated signatory: ..................................................................

(PRINT) in his capacity of

Designation of signatory: ...................................................................

(PRINT) who warrants his authority to sign on behalf of

Signature:....................................................................

Name of bidder (company) : .....................................................................

Date: ...................................................................

skill and knowledge in an activity for the execution of a contract.

of 41

I CERTIFY THAT THE INFORMATION FURNISHED IN PARAGRAPHS 1, 2 and 3 ABOVE

3.1 Unless otherwise indicated in the bidding documents, the purchaser shall not be liable for

any expense incurred in the preparation and submission of a bid. Where applicable a non-

refundable fee for documents may be charged.

3.2 With certain exceptions, invitations to bid are only published in the Government Tender

10.1 Delivery of the goods shall be made by the supplier in accordance with the terms specified

in the contract. The details of shipping and/or other documents to be furnished by the

supplier are specified in SCC.

10.2 Documents to be submitted by the supplier are specified in SCC.

16. Payment

of 41

17. Prices

18. Contract amendments

19. Assignment

20. Subcontracts

21. Delays in the supplier’s performance

22. Penalties

23. Termination for default

24. Dumping and countervailing duties

25. Force Majeure

26. Termination for insolvency

27. Settlement of disputes

28. Limitation of liability

29. Governing language

30. Applicable law

31. Notices

32. Taxes and duties

33. National Industrial Participation Programme (NIPP)

34. Prohibition of restrictive practices

General conditions of contract

1. Definitions

1 The following terms shall be interpreted as indicated:

1.1 “Closing time” means the date and hour specified in the bidding documents for the receipt

of Bids.

1.2 “Contract” means the written agreement entered into between the purchaser and the

supplier, as recorded in the contract form signed by the parties, including all attachments

and appendices thereto and all documents incorporated by reference therein.

1.3 “Contract price” means the price payable to the supplier under the contract for the full and

proper performance of his contractual obligations.

1.4 “Corrupt practice” means the offering, giving, receiving, or soliciting of anything of value

to influence the action of a public official in the procurement process or in contract

execution.

1.5 "Countervailing duties" are imposed in cases where an enterprise abroad is subsidized by

its government and encouraged to market its products internationally.

1.6 “Country of origin” means the place where the goods were mined, grown or produced or

from which the services are supplied. Goods are produced when, through manufacturing,

of 41

processing or substantial and major assembly of components, a commercially recognized

new product results that is substantially different in basic characteristics or in purpose or

utility from its components.

1.7 “Day” means calendar day.

1.8 “Delivery” means delivery in compliance of the conditions of the contract or order.

1.9 “Delivery ex stock” means immediate delivery directly from stock actually on hand.

1.10 “Delivery into consignees store or to his site” means delivered and unloaded in the

specified store or depot or on the specified site in compliance with the conditions of the

contract or order, the supplier bearing all risks and charges involved until the supplies are

so delivered and a valid receipt is obtained.

1.11 "Dumping" occurs when a private enterprise abroad market its goods on own initiative in

the RSA at lower prices than that of the country of origin and which have the potential to

harm the local industries in the RSA.

1.12 “Force majeure” means an event beyond the control of the supplier and not involving the

supplier’s fault or negligence and not foreseeable. Such events may include, but is not

restricted to, acts of the purchaser in its sovereign capacity, wars or revolutions, fires,

floods, epidemics, quarantine restrictions and freight embargoes.

1.13 “Fraudulent practice” means a misrepresentation of facts in order to influence a

procurement process or the execution of a contract to the detriment of any bidder, and

includes collusive practice among bidders (prior to or after bid submission) designed to

establish bid prices at artificial non-competitive levels and to deprive the bidder of the

benefits of free and open competition.

1.14 “GCC” means the General Conditions of Contract.

1.15 “Goods” means all of the equipment, machinery, and/or other materials that the supplier

is required to supply to the purchaser under the contract.

1.16 “Imported content” means that portion of the bidding price represented by the cost of

components, parts or materials which have been or are still to be imported (whether by

the supplier or his subcontractors) and which costs are inclusive of the costs abroad, plus

freight and other direct importation costs such as landing costs, dock dues, import duty,

sales duty or other similar tax or duty at the South African place of entry as well as

transportation and handling charges to the factory in the Republic where the supplies

covered by the bid will be manufactured.

1.17 “Local content” means that portion of the bidding price which is not included in the

imported content provided that local manufacture does take place.

1.18 “Manufacture” means the production of products in a factory using labour, materials,

components and machinery and includes other related value-adding activities.

1.19 “Order” means an official written order issued for the supply of goods or works or the

of 41

rendering of a service.

1.20 “Project site,” where applicable, means the place indicated in bidding documents.

1.21 “Purchaser” means the organisation purchasing the goods.

1.22 “Republic” means the RSA.

1.23 “SCC” means the Special Conditions of Contract.

1.24 “Services” means those functional services ancillary to the supply of the goods, such as

transportation and any other incidental services, such as installation, commissioning,

provision of technical assistance, training, catering, gardening, security, maintenance and

other such obligations of the supplier covered under the contract.

1.25 “Written” or “in writing” means handwritten in ink or any form of electronic or mechanical

writing.

2 Application

2.1 These general conditions are applicable to all Bids, contracts and orders including Bids

for functional and professional services, sales, hiring, letting and the granting or acquiring

of rights, but excluding immovable property, unless otherwise indicated in the bidding

documents.

2.2 Where applicable, SCC are also laid down to cover specific supplies, services or works.

2.3 Where such SCC are in conflict with these general conditions, the special conditions shall

apply.

3 General

3.1 Unless otherwise indicated in the bidding documents, the purchaser shall not be liable for

any expense incurred in the preparation and submission of a bid. Where applicable a non-

refundable fee for documents may be charged.

3.2 With certain exceptions, invitations to bid are only published in the Government Tender

Bulletin. The Government Tender Bulletin may be obtained directly from the Government

Printer, Private Bag X85, Pretoria 0001, or accessed electronically from

www.treasury.gov.za

4 Standards

4.1 The goods supplied shall conform to the standards mentioned in the bidding documents

and specifications.

1 Use of contract documents and information; inspection

5.1 The supplier shall not, without the purchaser’s prior written consent, disclose the contract,

or any provision thereof, or any specification, plan, drawing, pattern, sample, or

of 41

information furnished by or on behalf of the purchaser in connection therewith, to any

person other than a person employed by the supplier in the performance of the contract.

Disclosure to any such employed person shall be made in confidence and shall extend

only so far as may be necessary for purposes of such performance.

5.2 The supplier shall not, without the purchaser’s prior written consent, make use of any

document or information mentioned in GCC clause 5.1 except for purposes of performing

the contract.

5.3 Any document, other than the contract itself mentioned in GCC clause 5.1 shall remain

the property of the purchaser and shall be returned (all copies) to the purchaser on

completion of the supplier’s performance under the contract if so required by the

purchaser.

5.4 The supplier shall permit the purchaser to inspect the supplier’s records relating to the

performance of the supplier and to have them audited by auditors appointed by the

purchaser, if so required by the purchaser.

6 Patent rights

6.1 The supplier shall indemnify the purchaser against all third-party claims of infringement of

patent, trademark, or industrial design rights arising from use of the goods or any part

thereof by the purchaser.

7 Performance security

7.1 Within thirty (30) days of receipt of the notification of contract award, the successful bidder

shall furnish to the purchaser the performance security of the amount specified in SCC.

7.2 The proceeds of the performance security shall be payable to the purchaser as

compensation for any loss resulting from the supplier’s failure to complete his obligations

under the contract.

7.3 The performance security shall be denominated in the currency of the contract, or in a

freely convertible currency acceptable to the purchaser and shall be in one of the following

forms:

7.3.1 a bank guarantee or an irrevocable letter of credit issued by a reputable bank located

in the purchaser’s country or abroad, acceptable to the purchaser, in the form

provided in the bidding documents or another form acceptable to the purchaser; or

7.3.2 a cashier’s or certified cheque

7.4 The performance security will be discharged by the purchaser and returned to the supplier

not later than thirty (30) days following the date of completion of the supplier’s

performance obligations under the contract, including any warranty obligations, unless

of 41

otherwise specified in SCC.

8. Inspections, tests and analyses

8.1 All pre-bidding testing will be for the account of the bidder.

8.2 If it is a bid condition that supplies to be produced or services to be rendered should at

any stage during production or execution or on completion be subject to inspection, the

premises of the bidder or contractor shall be open, at all reasonable hours, for inspection

by a representative of the Department or an organisation acting on behalf of the

Department.

8.3 If there are no inspection requirements indicated in the bidding documents and no mention

is made in the contract, but during the contract period it is decided that inspections shall

be carried out, the purchaser shall itself make the necessary arrangements, including

payment arrangements with the testing authority concerned.

8.4 If the inspections, tests and analyses referred to in clauses 8.2 and 8.3 show the supplies

to be in accordance with the contract requirements, the cost of the inspections, tests and

analyses shall be defrayed by the purchaser.

8.5 Where the supplies or services referred to in clauses 8.2 and 8.3 do not comply with the

contract requirements, irrespective of whether such supplies or services are accepted or

not, the cost in connection with these inspections, tests or analyses shall be defrayed by

the supplier.

8.6 Supplies and services which are referred to in clauses 8.2 and 8.3 and which do not

comply with the contract requirements may be rejected.

8.7 Any contract supplies may on or after delivery be inspected, tested or analyzed and may

be rejected if found not to comply with the requirements of the contract. Such rejected

supplies shall be held at the cost and risk of the supplier who shall, when called upon,

remove them immediately at his own cost and forthwith substitute them with supplies

which do comply with the requirements of the contract. Failing such removal the rejected

supplies shall be returned at the suppliers cost and risk. Should the supplier fail to provide

the substitute supplies forthwith, the purchaser may, without giving the supplier further

opportunity to substitute the rejected supplies, purchase such supplies as may be

necessary at the expense of the supplier.

8.8 The provisions of clauses 8.4 to 8.7 shall not prejudice the right of the purchaser to cancel

the contract on account of a breach of the conditions thereof, or to act in terms of Clause

23 of GCC.

9 Packing

of 41

9.1 The supplier shall provide such packing of the goods as is required to prevent their

damage or deterioration during transit to their final destination, as indicated in the contract.

The packing shall be sufficient to withstand, without limitation, rough handling during

transit and exposure to extreme temperatures, salt and precipitation during transit, and

open storage. Packing, case size and weights shall take into consideration, where

appropriate, the remoteness of the goods’ final destination and the absence of heavy

handling facilities at all points in transit.

9.2 The packing, marking, and documentation within and outside the packages shall comply

strictly with such special requirements as shall be expressly provided for in the contract,

including additional requirements, if any, specified in SCC, and in any subsequent

instructions ordered by the purchaser.

10 Delivery and documents

10.1 Delivery of the goods shall be made by the supplier in accordance with the terms specified

in the contract. The details of shipping and/or other documents to be furnished by the

supplier are specified in SCC.

10.2 Documents to be submitted by the supplier are specified in SCC.

11 Insurance

11.1 The goods supplied under the contract shall be fully insured in a freely convertible currency

against loss or damage incidental to manufacture or acquisition, transportation, storage and

delivery in the manner specified in the SCC.

12 Transportation

12.1 Should a price other than an all-inclusive delivered price be required, this shall be

specified in the SCC.

13 Incidental services

13.1 The supplier may be required to provide any or all of the following services, including

additional services, if any, specified in SCC:

13.1.1 performance or supervision of on-site assembly and/or commissioning of the

supplied goods;

13.1.2 furnishing of tools required for assembly and/or maintenance of the supplied goods;

13.1.3 furnishing of a detailed operations and maintenance manual for each appropriate

unit of the supplied goods;

13.1.4 performance or supervision or maintenance and/or repair of the supplied goods, for

of 41

a period of time agreed by the parties, provided that this service shall not relieve the

supplier of any warranty obligations under this contract; and

13.1.5 training of the purchaser’s personnel, at the supplier’s plant and/or on-site, in

assembly, start-up, operation, maintenance, and/or repair of the supplied goods.

13.2 Prices charged by the supplier for incidental services, if not included in the contract price

for the goods, shall be agreed upon in advance by the parties and shall not exceed the

prevailing rates charged to other parties by the supplier for similar services.

14 Spare parts

14.1 As specified in SCC, the supplier may be required to provide any or all of the following

materials, notifications, and information pertaining to spare parts manufactured or

distributed by the supplier:

14.1.1 such spare parts as the purchaser may elect to purchase from the supplier, provided

that this election shall not relieve the supplier of any warranty obligations under the

contract; and

14.1.2 in the event of termination of production of the spare parts:

14.1.2.1 Advance notification to the purchaser of the pending termination, in sufficient

time to permit the purchaser to procure needed requirements; and

14.1.2.2 following such termination, furnishing at no cost to the purchaser, the

blueprints, drawings, and specifications of the spare parts, if requested.

15.1 The supplier warrants that the goods supplied under the contract are new, unused, of the

most recent or current models, and that they incorporate all recent improvements in design

and materials unless provided otherwise in the contract. The supplier further warrants

that all goods supplied under this contract shall have no defect, arising from design,

materials, or workmanship (except when the design and/or material is required by the

purchaser’s specifications) or from any act or omission of the supplier, that may develop

under normal use of the supplied goods in the conditions prevailing in the country of final

destination.

15.2 This warranty shall remain valid for twelve (12) months after the goods, or any portion

thereof as the case may be, have been delivered to and accepted at the final destination

indicated in the contract, or for eighteen (18) months after the date of shipment from the

port or place of loading in the source country, whichever period concludes earlier, unless

specified otherwise in SCC.

15.3 The purchaser shall promptly notify the supplier in writing of any claims arising under this

of 41

warranty.

15.4 Upon receipt of such notice, the supplier shall, within the period specified in SCC and with

all reasonable speed, repair or replace the defective goods or parts thereof, without costs

to the purchaser.

15.5 If the supplier, having been notified, fails to remedy the defect(s) within the period

specified in SCC, the purchaser may proceed to take such remedial action as may be

necessary, at the supplier’s risk and expense and without prejudice to any other rights

which the purchaser may have against the supplier under the contract.

16 Payment

16.1 The method and conditions of payment to be made to the supplier under this contract shall

be specified in SCC.

16.2 The supplier shall furnish the purchaser with an invoice accompanied by a copy of the

delivery note and upon fulfilment of other obligations stipulated in the contract.

16.3 Payments shall be made promptly by the purchaser, but in no case later than thirty (30)

days after submission of an invoice or claim by the supplier.

16.4 Payment will be made in rand unless otherwise stipulated in SCC.

17 Prices

17.1 Prices charged by the supplier for goods delivered and services performed under the

contract shall not vary from the prices quoted by the supplier in his bid, with the exception

of any price adjustments authorised in SCC or in the purchaser’s request for bid validity

extension, as the case may be.

18 Contract amendments

18.1 No variation in or modification of the terms of the contract shall be made except by written

amendment signed by the parties concerned.

19 Assignment

19.1 The supplier shall not assign, in whole or in part, its obligations to perform under the

contract, except with the purchaser’s prior written consent.

20 Subcontracts

20.1 The supplier shall notify the purchaser in writing of all subcontracts awarded under this

contract if not already specified in the bid. Such notification, in the original bid or later,

shall not relieve the supplier from any liability or obligation under the contract.

of 41

4.1 PCI DSS External Vulnerability Scans

Conduct non-intrusive scans of Postbank’s external IP addresses and domain endpoints.
Ensure scans meet PCI DSS and ASV program requirements.
Identify vulnerabilities, misconfigurations, and risks.
Submit results to Postbank in the PCI-compliant report format.

4.2 Frequency

Quarterly scans (every 3 months including a maximum of 3 rescans after remediation), for

a minimum of 12 scans over 3 years.

Additional ad-hoc scans may be requested by Postbank.

of 41

4.3 Reporting

Deliver detailed vulnerability reports after each scan, including:
Summary of findings
Vulnerability severity (per PCI DSS/industry standard)
Technical vulnerability report with CVSS scoring
Recommended remediation steps
Remediation recommendations per vulnerability
PCI DSS compliance status for each scanned asset
Evidence of PCI DSS compliance status (Pass/Fail)
Reports must be submitted in PDF and editable formats.

4.4 Consultation

Provide guidance on remediation of critical vulnerabilities.
Offer consultation calls for interpreting results if required

4.5 Compliance

Scans must comply with the latest PCI DSS standard and ASV program guidelines.
Vendor must maintain valid ASV certification throughout the engagement
Maintain confidentiality and data protection of Postbank information - Vendor must sign a

Non-Disclosure Agreement (NDA) prior to engagement

4.3. Name of company/firm: ..................................................................

4.4. Company registration number: ..........................................................

4.5. Type of company/ firm

 Partnership/Joint Venture / Consortium

 One-person business/sole propriety

 Close corporation

 Public Company

 Personal Liability Company

 (Pty) Limited

 Non-Profit Company

 State Owned Company

[Tick applicable box]

4.6. I, the undersigned, who is duly authorised to do so on behalf of the company/firm,

certify that the points claimed, based on the specific goals as advised in the

tender, qualifies the company/ firm for the preference(s) shown and I acknowledge

that:

i) The information furnished is true and correct;

ii) The preference points claimed are in accordance with the General Conditions as

indicated in paragraph 1 of this form;

of 41

iii) In the event of a contract being awarded as a result of points claimed as shown in

paragraphs 1.4 and 4.2, the contractor may be required to furnish documentary proof

to the satisfaction of the organ of state that the claims are correct;

iv) If the specific goals have been claimed or obtained on a fraudulent basis or any of

the conditions of contract have not been fulfilled, the organ of state may, in addition

to any other remedy it may have –

(a) disqualify the person from the tendering process;

(b) recover costs, losses or damages it has incurred or suffered as a

result of that person’s conduct;

as a result of having to make less favourable arrangements due

to such cancellation;

(d) recommend that the tenderer or contractor, its shareholders and

directors, or only the shareholders and directors who acted on a

fraudulent basis, be restricted from obtaining business from any

organ of state for a period not exceeding 10 years, after the audi

alteram partem (hear the other side) rule has been applied; and

(e) forward the matter for criminal prosecution, if deemed necessary.

..............................................

Signature(s) of tenderer(s)

Surname and name: ................................................................

Date:...............................................................

Address:...............................................................

...............................................................

of 41

Section 7

Government procurement: general conditions of contract – july 2011