Request for quotation: qualys vmdr trurisk platform supply, licensing, and implementation

This is a vendor application form for local and domestic stations.

Submission email: [email protected]

Completed vendor application form with all supporting documents must be emailed to [email protected].

Required documentation:

• Cancelled cheque or stamped bank confirmation letter (not older than one year)
• Latest valid B-BBEE Certificate or affidavit
• Latest valid Tax Clearance Certificate or SARS PIN on official SARS documentation
• CSD Registration Report

Payment terms: 15 days from invoice, with GSM approval schedule for contracted suppliers.

Payment Terms: 15 days from invoice, subject to GSM approval schedule for contracted suppliers.

CSD Registration: Required

Tax Compliance: Valid Tax Clearance Certificate or SARS PIN required.

B-BBEE: Details required include certificate number, verification and expiry dates, applicable scorecard (EME, QSE, or General/Large), status level, enterprise development, value adding, percentage black ownership, black women ownership, black people with disabilities, years in operation, and annual turnover.

B-BBEE details required: certificate number, verification and expiry dates, applicable scorecard (EME, QSE, or General/Large), status level, enterprise development (yes/no), value adding (yes/no), percentage black ownership, black women ownership, black people with disabilities, years in operation, and annual turnover.

Contact details required: registered and trading names, physical and postal addresses, phone, email, fax, city, province, postal code, contact person with phone and cellular numbers.

The procurement is for the supply, licensing, implementation and configuration of the Qualys VMDR TruRisk platform, inclusive of Policy Compliance (PC) and Web Application Scanning (WAS), for South African Airways. The solution must support a minimum of 3,400 assets with a 10% growth buffer. SAA ICT retains ownership and leads governance, implementation oversight and final acceptance. The successful bidder operates the platform as a managed service, providing continuous visibility into vulnerabilities, configuration weaknesses, application-layer risks and overall cyber risk. Required capabilities include Cloud Agents, asset inventory, internal/external scanning, TruRisk prioritisation, patch detection, SSL/TLS monitoring and PCI ASV scanning. PC assesses configurations against CIS Benchmarks and ISO/IEC 27001. WAS must cover at least 30 web applications with OWASP Top 10 detection. Scope is limited to licensed modules; excluded modules require separate approval.

Closing date: 19 October 2026 at 16:00

Issue date: 13 October 2026

Validity of RFQ: 180 days

Submission email: [email protected]

Procurement official: not named in document (contact via submission email)

SAA Business Unit: Global Supply Management

Submission method: email to [email protected]. Maximum email size 2MB; send larger files in parts or provide a downloadable link. SAA is not responsible for corrupt or unopenable links.

Returnable documents (all must be completed, signed and submitted with the quotation):

• SAA Vendor Document (Annexure 1): vendor application and supporting documents.
• SBD 4 (Declaration of Interest): discloses whether any director or shareholder is employed by the state or connected to anyone at SAA.
• General Conditions of Contract (Annexure 3): acceptance of SAA's standard contract terms.
• Company registration documents.
• Proof of Qualys authorised reseller/partner status for VMDR, PC and WAS (current accreditation letters or partner certificates).
• Valid Original Tax Clearance Certificate if SAA does not hold one.
• B-BBEE certificate, sworn affidavit or CIPC certificate (for specific goals points).
• CVs with certifications for key personnel.
• Implementation timeline in table format.
• Evidence of experience: PO's, contracts or customer reference letters.
• Platform coverage evidence: customer references, screenshots/reports, licensing evidence.
• Sample reports from the Qualys platform.

Disqualification risks:

• Quotations received after the closing date and time.
• Incomplete submissions or missing returnable documents.
• Non-compliance with any Phase 1 mandatory criteria.
• Failure to meet scope and licensing requirements.
• Failure to meet eligibility and mandatory requirements.

Evaluation stages (sequential, but SAA may run stages in parallel):

1. Administrative responsiveness: all returnable documents completed, signed and returned by closing date/time.
2. Substantive responsiveness (Phase 1 – mandatory):

• Bidder must be a South African registered entity or legally recognised local partner/reseller authorised to deliver Qualys solutions in South Africa. Company registration documents required.
• Proof of Qualys authorised reseller/partner status for VMDR, PC and WAS. Accreditation letters or partner certificates must be current and in the bidder's name.
• Non-compliance with any Phase 1 criterion results in the bid being deemed non-responsive.

3. Technical functionality (Phase 2 – scored out of 100):

• Minimum qualifying threshold: 75%.
• Implementation lead time (10 points): 0-6 weeks = 10; 6-8 weeks = 5; more than 8 weeks = 0.
• Experience (20 points): minimum 5 years delivering vulnerability management, compliance or application security solutions at enterprise level. Evidence: 3 PO's/contracts/reference letters = 20; 2 = 10; 1 = 5; 0 = 0.
• Platform coverage (10 points): ability to deliver VMDR TruRisk (min 3,400 assets), PC and WAS (min 30 applications) with growth buffer and true-up. Evidence: +2500 VMDR = 10; 1500-2499 = 5; 1-1499 = 2; claims without documentation = 0.
• TruRisk & reporting capability (10 points): dashboards, risk analytics, trends, compliance posture, WAS findings. Evidence from 5+ enterprise customers = 10; 2-4 = 10; 0-1 or partial = 5; none = 0. Evidence must be native Qualys dashboards/reports, screenshots or exported reports.
• Licensing flexibility & commercial model (10 points): clear model covering 3,400 assets + 10% buffer, no penalty within buffer, formal true-up at renewal, transparent pricing, predictable renewal terms = 10; minor constraints = 5; limited scalability or unclear terms = 0.
• Technical Lead/Architect (20 points): min 5 years cybersecurity experience including 3 years managing Qualys implementations. Certifications: Qualys VMDR/WAS Specialist plus CISSP, CISM, CEH, Security+ or ITIL v4 (or equivalent). CVs: 3+ = 20; 2 = 10; none = 0.
• Vulnerability Management Specialist (10 points): min 3-5 years experience including hands-on Qualys VMDR administration. Certifications as above. CVs: 4+ = 10; 3 = 5; none = 0.
• Web Application Security Specialist (10 points): min 3 years web application security experience (Qualys WAS preferred). Certifications as above. CVs: 4+ = 10; 3 = 5; none = 0.

4. Price and Specific Goals (Phase 3):

• Price: 80 points.
• Specific Goals: 20 points.
• B-BBEE Level 1 and 2: 10 points (Level 3-8 or non-compliant = 0).
• 51% or more black women owned: 10 points.

5. Post-tender negotiations (if applicable) before Letter of Award.

SAA is not obligated to accept the lowest quotation and may withdraw the RFQ at any time.

Scope: supply, licensing, implementation and configuration of the Qualys VMDR TruRisk platform, inclusive of Policy Compliance (PC) and Web Application Scanning (WAS), for South African Airways (SAA).

Managed service responsibilities:

• Operation of the Qualys platform as a managed service, including day-to-day vulnerability tracking and resolution, compliance and web application scanning.
• Provide continuous visibility into technical vulnerabilities, configuration weaknesses, application-layer risks, overall cyber risk exposure, and tracking/resolution of vulnerabilities.
• Enable automated discovery, assessment, prioritisation and reporting of risks across infrastructure, endpoints, externally exposed assets and web applications.

Licensing requirements:

• Minimum 3,400 VMDR vulnerability management licenses to cover SAA's current asset population.
• Growth buffer of up to 10% above baseline 3,400 assets; increases within buffer must not trigger immediate commercial renegotiation.
• Sustained growth beyond buffer addressed through formal license true-up at contract renewal or as agreed.
• Ability to scale during contract period without platform reimplementation.

VMDR TruRisk capabilities required:

• Deployment and operation of Qualys Cloud Agents for continuous vulnerability and configuration assessment.
• Asset inventory, discovery, tagging and classification.
• Internal and external vulnerability scanning, including authenticated and unauthenticated scans.
• TruRisk prioritisation (severity, exploitability, threat intelligence, asset criticality).
• Patch detection and visibility.
• SSL/TLS certificate discovery and monitoring.
• PCI ASV external vulnerability scanning with compliance-aligned reports.

Policy Compliance (PC):

• Configuration assessment against CIS Benchmarks and industry-recognised secure configuration standards.
• Identification of misconfigurations, configuration drift and deviations from approved baselines.
• Compliance dashboards and reporting aligned to CIS Controls and ISO/IEC 27001.
• PC activities limited to assessment, monitoring and reporting; configuration remediation remains SAA's responsibility unless agreed otherwise.

Web Application Scanning (WAS):

• Minimum 30 web applications onboarded and scanned.
• Authenticated and unauthenticated scans supported where technically feasible.
• Automated detection of OWASP Top 10 risks (SQL injection, XSS, insecure authentication, misconfigurations).
• Risk classification, vulnerability reporting and remediation guidance.

Scope boundaries:

• Strictly limited to VMDR TruRisk, PC and WAS modules explicitly licensed.
• Excluded modules (unless separately approved): Qualys Patch Management, EDR, Container Security, CSPM, File Integrity Monitoring, Malware Protection.

SAA ICT retains overall ownership of the environment and leads governance, implementation oversight and final acceptance sign-off.

Bidders must provide a detailed implementation timeline in table format showing time to onboard SAA, configure the platform and commence scanning after contract award. Scoring: 0-6 weeks = 10 points; 6-8 weeks = 5 points; more than 8 weeks = 0 points.

Bidder must be a Qualys accredited partner or authorised reseller with demonstrable experience in supply, implementation and configuration of Qualys VMDR TruRisk, PC and WAS in enterprise environments. Must demonstrate proven experience delivering enterprise vulnerability management, configuration compliance and/or web application security solutions at scale comparable to SAA. Must show capability to provide a fully managed Qualys service.

Key personnel requirements:

• Technical Lead/Architect: minimum 5 years cybersecurity experience, including 3 years managing Qualys implementations. Certifications: Qualys VMDR/WAS Specialist plus CISSP, CISM, CEH, Security+ or ITIL v4 (or equivalent). CVs required.
• Vulnerability Management Specialist: minimum 3-5 years experience, including hands-on Qualys VMDR administration. Certifications as above. CVs required.
• Web Application Security Specialist: minimum 3 years web application security experience (Qualys WAS preferred). Certifications as above. CVs required.

Experience evidence: minimum 5 years delivering vulnerability management, compliance or application security solutions at enterprise level, supported by PO's, contracts or customer reference letters.

All prices must be exclusive of VAT and firm (fixed), subject only to statutory changes such as VAT. Pricing must be provided per individual component of the solution, based on technical and functional requirements. Service, pricing and availability will be considered. The commercial model must cover 3,400 assets plus 10% growth buffer, with no penalty within buffer, formal true-up at renewal, transparent pricing and predictable renewal terms.

Pricing format:

• All prices must be exclusive of VAT.
• Prices must be firm (fixed), subject only to statutory changes such as VAT.
• Pricing must be provided per individual component of the solution, based on technical and functional requirements.
• Service, pricing and availability will be taken into consideration.

Commercial model (evaluated in Phase 2):

• Clear licensing model covering 3,400 assets + 10% growth buffer, no penalty within buffer, formal true-up at renewal, transparent pricing and predictable renewal terms.

Contract conditions:

• All purchases made through an official purchase order; no goods or services to be delivered before receiving an official order/contract.
• SAA may negotiate price(s) and contract terms with the preferred bidder.

Mandatory eligibility:

• South African registered entity or legally recognised local partner/reseller authorised to deliver Qualys solutions in South Africa.
• Qualys accredited partner or authorised reseller for VMDR, PC and WAS, with current accreditation letters or partner certificates in the bidder's name.
• Demonstrable experience in supply, implementation and configuration of Qualys VMDR TruRisk, PC and WAS in enterprise environments.
• Proven experience delivering enterprise vulnerability management, configuration compliance and/or web application security solutions at organisational scale comparable to SAA.
• Capability to provide a fully managed Qualys service, including licensing, initial configuration, Cloud Agent enablement, vulnerability scanning configuration and WAS onboarding, in collaboration with SAA ICT.

Tax compliance:

• Valid Original Tax Clearance Certificate required; if SAA does not hold a valid one, the bidder must submit an original with the RFQ. Failure may invalidate the quote.

B-BBEE (Specific Goals – 20 points):

• B-BBEE Level 1 and 2: 10 points (Level 3-8 or non-compliant = 0).
• 51% or more black women owned: 10 points.
• Evidence: B-BBEE certificate, sworn affidavit or B-BBEE CIPC certificate. For joint ventures, a consolidated scorecard accepted as per DTIC guidelines. EME or QSE that are 51% black owned may submit certificate, sworn affidavit or CIPC certificate.

Returnable forms:

• SAA Vendor Document (Annexure 1).
• SBD 4 (Declaration of Interest).
• General Conditions of Contract (Annexure 3).

All goods and services are subject to the SAA General Conditions of Contract, available from the local Procurement office. Purchases are made only through an official purchase order; no delivery before an order/contract is issued. The bidder must ensure SAA holds a valid Original Tax Clearance Certificate; if not, the bidder must submit one with the RFQ. Failure to do so may invalidate the quote.

Eligibility requirements: must be a Qualys accredited partner or authorised reseller with demonstrable experience in supply, implementation and configuration of Qualys VMDR TruRisk, PC and WAS in enterprise environments. Must demonstrate proven experience delivering enterprise vulnerability management, configuration compliance and/or web application security solutions at organisational scale comparable to SAA. Must demonstrate capability to provide a fully managed Qualys service, including licensing, initial configuration, Cloud Agent enablement, vulnerability scanning configuration and WAS onboarding, in collaboration with SAA ICT. Failure to meet these requirements results in disqualification.

Evaluation follows five steps: 1) returnable documents, 2) mandatory substantive requirements, 3) technical functionality (minimum 75%), 4) price (80 points) and specific goals (20 points), 5) post-tender negotiations before Letter of Award. Stages may run in parallel. Quotations with deviations from requirements are eliminated. SAA is not obligated to accept the lowest quotation and may withdraw the RFQ at any time.

Table of clauses for the General Conditions of Contract (GCC) covering definitions, application, standards, use of documents, patent rights, performance security, inspections, packing, delivery, insurance, transportation, incidental services, spare parts, warranty, payment, prices, amendments, assignment, subcontracts, delays, penalties, termination for default, anti-dumping, force majeure, termination for insolvency, dispute resolution, limitation of liability, governing language, applicable law, notices, taxes and duties, NIP Programme, and prohibition of restrictive practices.

Quality and inspection requirements: goods must conform to standards in bidding documents. Pre-bidding testing at bidder's cost. Purchaser may inspect supplier premises at reasonable hours. If inspections show compliance, purchaser bears cost; if non-compliance, supplier bears cost. Non-compliant supplies may be rejected. Rejected supplies held at supplier's risk and cost; supplier must remove and replace promptly. Purchaser may purchase substitutes at supplier's expense if supplier fails to replace. Rights to cancel contract for breach preserved.

Performance security: successful bidder must furnish performance security within 30 days of contract award notification; amount specified in Special Conditions of Contract (SCC). Acceptable forms: bank guarantee or irrevocable letter of credit from a reputable bank, or cashier's/certified cheque. Security discharged 30 days after completion of all obligations including warranty.

Payment: method and conditions per SCC. Supplier must submit invoice with delivery note. Payment within 30 days of invoice submission. Currency: South African Rand unless SCC stipulates otherwise.

Prices: fixed at bid prices; adjustments only as authorised in SCC or bid validity extension.

Penalties: for late delivery, penalty calculated on delivered price of delayed goods/services using current prime interest rate per day of delay until actual delivery.

Warranty: goods warranted new, unused, latest models, defect-free for 12 months after delivery/acceptance or 18 months after shipment, whichever earlier. Supplier must repair/replace defective goods within period specified in SCC.

Insurance: goods must be fully insured in a freely convertible currency against loss/damage during manufacture, acquisition, transportation, storage, and delivery as per SCC.

Tax clearance: no contract awarded to bidder whose tax matters are not in order; original tax clearance certificate from SARS required prior to award.

National Industrial Participation Programme (NIPP): applies to contracts subject to NIP obligation, administered by the Department of Trade and Industry.

Prohibition of restrictive practices: collusive bidding (bid rigging) prohibited under Competition Act. Purchaser may refer matter to Competition Commission; if found guilty, may invalidate bids, terminate contract, restrict bidder from public sector business for up to 10 years, and claim damages.

General legal compliance: contract governed by South African law; all correspondence in English; supplier must comply with applicable laws and regulations.

General clause: purchaser not liable for bid preparation costs; non-refundable document fee may apply. Anti-dumping/countervailing duties: state not liable for increases after bid date; favourable differences paid to state. Notices: served by registered/certified mail; time reckoned from posting.

Prohibition of restrictive practices: collusive bidding (bid rigging) prohibited under Competition Act. Purchaser may refer matters to Competition Commission. If found guilty, purchaser may invalidate bids, terminate contracts, restrict from business with public sector for up to 10 years, and claim damages.

Fragment referencing contract cancellation and substitution of supplies; no evaluation criteria for the tender.