Managed security service: supply, implementation, and operation of zscaler app and platform for south african airways

Closing date: 10 July 2026 at 16:00. RFQ validity period: 180 days from issue date (02 July 2026).

Submission email: [email protected]. Department: Global Supply Management, South African Airways (Pty) Limited.

Submit all required documents via email to [email protected]. Maximum email attachment size is 2MB. If files exceed this, send in parts or provide a downloadable link (SAA is not responsible for corrupt links). Quotations must be submitted before 10 July 2026 at 16:00. Late or incomplete submissions will be disqualified. Required returnable documents: SAA Vendor application (Annexure 1), SBD 4 (Annexure 2), General Conditions of Contract (Annexure 3), managed service offering/operating model, incident escalation and response process, support team organogram, and SLA matrix (including incident response times, support hours, and escalation timelines). Failure to submit all required documents will result in disqualification.

Required documents: SAA Vendor application (Annexure 1), SBD 4 (Annexure 2), General Conditions of Contract (Annexure 3), managed service offering/operating model, incident escalation and response process, support team organogram, SLA matrix (including incident response times, support hours, escalation timelines). Submit via email to [email protected] (max 2MB per email; use parts or links if larger). Late or incomplete submissions are disqualified.

Mandatory requirements (100% compliance required): South African registration or authorized Zscaler partner status; minimum 5 years enterprise security experience with PO/contract evidence; managed service capability with 24x7 support including incident escalation process, support team organogram, and SLA matrix. Technical functionality threshold: 75%. Specific Goals allocation: B-BBEE Level 1-2 (10 points), 30%+ black women owned (10 points). Non-compliant or Level 3-8 B-BBEE contributors receive 0 points for that category.

Scope: Supply, licensing, implementation, configuration, optimization, and full operational management of the Zscaler App platform as a managed security service for SAA. Minimum solution components: Zscaler Internet Access (ZIA) and Zscaler Digital Experience (ZDX). Licensing must cover ~2,500 SAA users with a 10% growth buffer (no immediate commercial renegotiation for increases within buffer). SAA ICT retains ownership; service provider assumes operational responsibility. Key deliverables: Secure internet/SaaS access via cloud-based inspection, continuous threat protection (phishing, malware, ransomware), centralized visibility (user activity, policy enforcement, threat analytics), and measurable security maturity improvement. Platform must support on-premises and remote users, replacing perimeter-based security with a local client proxy. Scalability required without platform reimplementation; growth beyond buffer addressed via formal true-up at renewal.

Bidder must be a South African registered entity or authorized local Zscaler partner. Minimum 5 years' experience in enterprise secure access, ZTNA, secure web gateway, cloud firewall, or cloud-delivered security (POs/contracts required). Key personnel: Technical Lead/Architect (5+ years cybersecurity, 3+ years Zscaler), Secure Access/Network Security Specialist (3-5 years ZIA/ZPA), Identity & Access Specialist (Azure AD/Entra ID integration). Relevant certifications: ZCCA, ZCCP, CISSP, CISM, CEH, Security+, ITIL v4. CVs required (5+ CVs = 20 points, 4 CVs = 15, 3 CVs = 10, 1 CV = 5, none = 0).

Platform must secure internet and SaaS access via cloud-based inspection and policy enforcement. Must provide continuous protection against phishing, malware, ransomware, and advanced threats. Centralized visibility required for: user activity, threat analytics, policy enforcement logs, and application access monitoring. Evidence must include native Zscaler dashboards/reports (screenshots acceptable). Scoring: 5+ enterprise customers (10 points), 2-4 customers (5 points), limited/no dashboards (0 points).

Pricing must be exclusive of VAT and firm (fixed, subject only to statutory VAT changes). Structure pricing per individual component based on technical/functional requirements. Licensing model must include: baseline assets + 10% growth buffer, no penalties within buffer, formal true-up at renewal, transparent pricing, and predictable renewal terms. Scoring: Clear model (15 points), minor constraints (10 points), limited scalability/unclear terms (0 points).

Pricing must be exclusive of VAT and firm (fixed, subject only to statutory VAT changes). Prices should be structured per individual component based on technical/functional requirements. Payment terms and conditions subject to SAA General Conditions of Contract. Licensing model must include: baseline assets + 10% growth buffer, no penalties within buffer, formal true-up at renewal, transparent pricing, and predictable renewal terms. Commercial constraints or unclear terms may reduce scoring.

Mandatory compliance: Valid Original Tax Clearance Certificate (submit if SAA does not have a current one). Bidder must be a South African registered entity or authorized local Zscaler partner. Proof of 5+ years' experience in enterprise secure access/ZTNA/cloud security (POs/contracts required). Capability to provide ongoing Zscaler support, monitoring, and service management. Key personnel requirements: Technical Lead/Architect (5+ years cybersecurity, 3+ years Zscaler), Secure Access/Network Security Specialist (3-5 years ZIA/ZPA), Identity & Access Specialist (Azure AD/Entra ID integration). Relevant certifications (e.g., ZCCA, ZCCP, CISSP, CISM, CEH, Security+, ITIL v4) advantageous. B-BBEE: Level 1-2 (10 points) or 30%+ Black Women Owned (10 points). Acceptable evidence: B-BBEE Certificate, Sworn Affidavit, or CIPC Certificate (consolidated scorecard for JVs). EME/QSE: 51% Black Owned (B-BBEE Certificate/Sworn Affidavit/CIPC Certificate).

Specific Goals (20 points total): B-BBEE Level 1-2 contributors (10 points), 30%+ Black Women Owned (10 points). Non-compliant or B-BBEE Level 3-8 contributors receive 0 points. Acceptable evidence: B-BBEE Certificate, Sworn Affidavit, or CIPC Certificate (consolidated scorecard for JVs). EME/QSE: 51% Black Owned (B-BBEE Certificate/Sworn Affidavit/CIPC Certificate).

Mandatory returnable documents: SAA Vendor application (Annexure 1), SBD 4 (Annexure 2), General Conditions of Contract (Annexure 3), managed service offering/operating model, incident escalation/response process, support team organogram, and SLA matrix (response times, support hours, escalation timelines). 100% compliance required; failure to submit all documents results in disqualification. Bidder must confirm compliance with statements (Yes/No + proof); 'No' responses lead to disqualification.

Evaluation methodology: 5-stage process (Administrative, Substantive, Technical Functionality, Price/Resource Rate, Specific Goals). Administrative: Compliance with returnable documents and signatures. Substantive: Mandatory requirements (100% compliance). Technical Functionality (100% total, 75% minimum threshold): Implementation Lead Time (10%), Vendor Authorization (30%), Platform Coverage (15%), Operational Dashboards (10%), Licensing Flexibility (15%), Key Personnel CVs (20%). Price/Resource Rate: 80 points. Specific Goals: B-BBEE Level 1-2 (10 points), 30%+ Black Women Owned (10 points). SAA may evaluate stages in parallel and is not obligated to award the contract or accept the lowest bid.

Submit the completed Vendor Application Form and all supporting documents via email to: [email protected]. Required returnable documents: if you are a contracted supplier, attach a copy of your contract; if not, attach a GSM Approval Schedule. Ensure all documents are valid and up-to-date.

Required returnable documents: Certified shareholders’ certificates. Additional documents: cancelled cheque or stamped bank confirmation letter (not older than one year), latest valid B-BBEE certificate, latest valid tax clearance certificate, CSD Registration Report, certified company registration documents, certified copies of shareholders' identity documents.

Vendors must be registered on the Central Supplier Database (CSD), possess a valid Tax Clearance Certificate, have a current B-BBEE Certificate or affidavit, provide proof of bank account validity, and be legally authorized to operate in South Africa. Companies must disclose B-BBEE status level, black ownership percentages, annual turnover, and enterprise development participation. Exempted Micro Enterprises (EME) and Qualifying Small Enterprises (QSE) have simplified requirements.

Bidder must disclose: Duration of enterprise operation (in months/years). Annual turnover for the previous financial year.

Payment terms: 15 days from invoice date. GSM Approval Schedule must be attached if not a contracted supplier. Bank details (name, branch, account number) and tax information (VAT registration, tax clearance certificate) are required for processing.

Mandatory compliance documents: Certified company registration documents, certified copies of shareholders' identity documents, certified shareholders’ certificates, cancelled cheque or stamped bank confirmation letter (not older than one year), latest valid B-BBEE certificate or affidavit, latest valid tax clearance certificate or SARS pin on official SARS documentation, CSD Registration Report. B-BBEE details required: certificate number, verification and expiry dates, applicable scorecard (EME, QSE, or General/Large), B-BBEE status level, enterprise development and value-adding status, percentage of black ownership, black women ownership, and black people with disabilities.

B-BBEE requirements: Provide certificate number, verification and expiry dates. Specify applicable scorecard (EME, QSE, or General/Large). Disclose B-BBEE status level, enterprise development participation (Yes/No), value-adding status (Yes/No), percentage of black ownership, black women ownership, and black people with disabilities. State how long the enterprise has been in operation (months/years) and the company’s annual turnover for the previous financial year.

Special conditions: If the bidder is a contracted supplier, attach a copy of the contract. If not, attach a GSM Approval Schedule. Negotiated contracted B-BBEE status must be disclosed (QSE or EME). Payment terms are 15 days from invoice date, and the GSM Approval Schedule must be submitted if applicable.

Contact details to be provided by the bidder: phone, email, fax, city, province, postal code, and contact person’s phone and cellular numbers. Submission email: [email protected].

No specific important dates are stated in this document beyond the closing date already recorded in the tender listing. The General Conditions of Contract define 'Closing time' as the date and hour specified in the bidding documents for receipt of bids.

No specific contact details, SCM officials, or technical contacts are provided in this document. Bidders should consult the main tender documentation for relevant contact persons.

The document does not contain specific submission instructions, required returnable documents, or submission address for this tender. Bidders should refer to the main tender documentation for submission requirements. The General Conditions of Contract state that bid invitations are published in the Government Tender Bulletin and may be accessed electronically from www.treasury.gov.za.

The document does not contain technical specifications for the Zscaler App and platform. It provides only the General Conditions of Contract framework. The GCC states that goods supplied must conform to standards mentioned in the bidding documents and specifications. The document covers inspection and testing provisions: pre-bidding testing costs are borne by the bidder; supplier premises must be open for inspection during production or execution; non-compliant supplies may be rejected; rejected supplies must be removed and replaced by the supplier at their cost.

Inspection and testing provisions: pre-bidding testing costs borne by bidder. Supplier premises must be open for inspection at all reasonable hours during production, execution, or on completion. If supplies comply with contract requirements, inspection costs paid by purchaser. If supplies do not comply, costs paid by supplier. Non-compliant supplies may be rejected. Rejected supplies held at supplier's cost and risk; supplier must remove and replace immediately. If supplier fails to replace, purchaser may procure substitute goods and recover costs from supplier. Goods must conform to standards mentioned in bidding documents and specifications. Supplier must keep records open for audit by purchaser's appointed auditors.

Pricing: prices charged must not vary from quoted bid prices except as authorized in SCC or through bid validity extension requests. Payment: method and conditions specified in SCC. Supplier must submit invoice with delivery note. Payment within 30 days of invoice submission. Payment in Rand unless otherwise stipulated. Incidental services: prices must be agreed in advance and not exceed prevailing rates. Spare parts: supplier must provide spare parts as elected by purchaser; must notify purchaser in advance of spare parts production termination; must provide blueprints and specifications at no cost upon termination.

Payment terms: purchaser must pay within 30 days of invoice submission. Payment will be made in Rand unless otherwise stipulated in SCC. Prices must not vary from quoted prices except as authorized in SCC. Performance security: successful bidder must provide security within 30 days of contract award notification, in the form of a bank guarantee, irrevocable letter of credit, or certified cheque. Insurance: goods must be fully insured in a freely convertible currency against loss or damage during manufacture, acquisition, transportation, storage, and delivery.

Tax compliance: no contract may be concluded with a bidder whose tax matters are not in order. An original tax clearance certificate from SARS must be submitted prior to award. Anti-corruption: corrupt or fraudulent practices are prohibited. Bidders or contractors found engaging in collusive bidding may be referred to the Competition Commission and could face bid invalidation, contract termination, restriction from public sector business for up to 10 years, or damages claims. National Industrial Participation Programme may apply to contracts subject to NIP obligations. Supplier must indemnify purchaser against third-party patent, trademark, or industrial design infringement claims.

National Industrial Participation Programme: administered by Department of Trade and Industry; applicable to contracts subject to NIP obligation.

Contract duration and amendments: no variation or modification of contract terms except by written amendment signed by all parties. Assignment: supplier may not assign obligations without purchaser's prior written consent. Subcontracts: supplier must notify purchaser in writing of all subcontracts; this does not relieve supplier of obligations. Delays: supplier must notify purchaser promptly of any conditions impeding delivery; purchaser may extend time with or without penalties. Penalties: for late delivery, purchaser may deduct penalties calculated at prime interest rate per day of delay. Termination for default: purchaser may terminate if supplier fails to deliver, fails to perform obligations, or engages in corrupt or fraudulent practices. Termination for insolvency: purchaser may terminate if supplier becomes bankrupt or insolvent. Force majeure: supplier not liable for non-performance due to events beyond control such as wars, fires, floods, epidemics, quarantine restrictions, or freight embargoes. Dispute resolution: parties must attempt mutual consultation; if unresolved after 30 days, either party may initiate mediation; if mediation fails, disputes settled in South African courts. Governing language: contract in English. Applicable law: South African law applies. Notices: served by registered or certified mail to address provided in bid.

Tax requirements: foreign suppliers responsible for all taxes, duties, and levies imposed outside South Africa. Local suppliers responsible for all taxes, duties, and license fees until delivery. Tax clearance certificate (original from SARS) required before contract award. Insurance: goods must be fully insured in freely convertible currency against loss or damage incidental to manufacture, acquisition, transportation, storage, and delivery. Performance security: amount specified in SCC; must be provided within 30 days of award notification; returned within 30 days of contract completion including warranty obligations.

Penalty provisions: if supplier fails to deliver within specified time, purchaser may deduct penalties at prime interest rate per day of delay and may terminate the contract.