This Tender Has Expired

SAMSA seeks a service provider to implement Public Key Infrastructure (PKI) and Certificate Lifecycle Management (CLM) services, including maintenance and support, for one year. The solution must address rising cyber threats by enabling secure communication, data confidentiality, and integrity through cryptography. PKI encrypts sensitive communications, while CLM provides centralized management of certificates, automated processes, and policy enforcement. The goal is to minimize errors and improve efficiency in certificate and key management.

Closing date: 19 June 2026 at 11h00. No briefing session is scheduled.

For bidding and technical enquiries, contact Ivor Mothoane. Telephone: 012 366 2600. Email: [email protected]. Submission email: [email protected]. Delivery address: SAMSA, 146 Lunnon Road, Hillcrest, Pretoria.

Submit bids via email to [email protected]. Email subject line must clearly indicate the RFQ number (HO-1697.2). Bids must be delivered by the closing date and time (19 June 2026, 11h00) to SAMSA, 146 Lunnon Road, Hillcrest, Pretoria. Late bids will not be accepted. All bids must be submitted on the official forms provided (not re-typed) or in the manner prescribed in the bid document. Price quoted must remain valid for at least 60 days after the closing date. SAMSA reserves the right to disqualify bidders with supporting documents not duly submitted in terms of the bid conditions. Inconsistent information may result in 0 points awarded for applicable goals.

ALL BID RESPONSE DOCUMENTS MUST BE EMAILED TO: [email protected] (EMAIL SUBJECT LINE MUST CLEARLY INDICATE THE RFQ NUMBER)

Evaluation follows the 80/20 or 90/10 Preferential Procurement Policy Framework Act (PPPFA) system, depending on the total bid value. Points are allocated as follows: 80/20 system (for bids up to R50M): 80 points for price, 20 points for specific goals (HDI ownership 7, women 5, disabled 2, youth 3, locality 3). 90/10 system (for bids above R50M): 90 points for price, 10 points for specific goals (HDI ownership 4, women 2, disabled 1, youth 1, locality 2). Specific goals require supporting documents (ID copies, CSD report, CK1/CIPC, B-BBEE certificate, medical certificate for disabled, proof of address for locality). Points are awarded pro-rata based on ownership. For consortia/JVs, points are calculated per partner’s contract allocation and ownership percentage. Failure to submit required documentation or inconsistent information may result in 0 points or disqualification. SAMSA may verify all claims at any stage.

Scope: Procurement, provisioning, implementation, maintenance, and support of Public Key Infrastructure (PKI) and Certificate Lifecycle Management (CLM) services for one year. Key requirements: 1) PKI and CLM capabilities enabling secure communication, confidentiality, and data integrity. 2) Protection of data in transit, at rest, and in use with strong encryption (minimum 256-bit). 3) Provision of digital identities using trusted certificates. 4) Crypto-agile, scalable solution supporting Quantum and Post-Quantum Cryptography. 5) Seamless integration between PKI and CLM platforms, SAMSA’s Internal CA, and future KMS/HSM. 6) Secure key generation, distribution, storage, and lifecycle management with automation (auto-renewal, key rotation). 7) High availability of keys, backup mechanisms, and comprehensive audit logging. 8) PKI must include a publicly trusted CA capable of issuing Standard, Multi-Domain, Wildcard, S/MIME, and Private Certificates. 9) CLM must provide centralized CSR management, automated certificate discovery/issuance/inventory/renewal/revocation, policy enforcement, secure storage, and reporting (compliance, history, audits, alerts). 10) Service provider must assist with configuration, implementation, and provide OEM technical support, maintenance, software updates, patches, and incident resolution. 11) Skills transfer and training for SAMSA ICT personnel. 12) Alignment with best practices and standards (NIST, ISO, POPIA, ECT Act). Mandatory: Valid accreditation certificate or official partner confirmation letter from SECTIGO or DigiCert.

Submit a pricing schedule inclusive of VAT for: CLM (1), Standard Domain Certificates (12), Multi-Domain Certificates (1), Wildcard Certificates (1), Private Certificates (80), S/MIME Certificates (20), and once-off configuration/implementation cost. Total bid price must be clearly stated.

Pricing must be inclusive of VAT. Submit a detailed pricing schedule for: CLM (1), Standard Domain Certificates (12), Multi-Domain Certificates (1), Wildcard Certificates (1), Private Certificates (80), S/MIME Certificates (20), and once-off configuration/implementation cost. Delivery costs are included in the total quotation and not evaluated separately. Total bid price must be clearly stated. Validity period: Prices must remain valid for at least 60 days after the closing date.

Mandatory compliance: 1) Tax compliance: Valid SARS TCS PIN or CSD registration. Submit TCS certificate or PIN; CSD number acceptable if no TCS PIN. Apply via SARS e-filing (www.sars.gov.za). 2) Central Supplier Database (CSD) registration, not older than 3 months. 3) Valid B-BBEE certificate. 4) CK1/CIPC registration document. 5) ID copies of all listed owners as per CSD report. 6) Proof of address (utility bill, bank statement, municipal councillor’s letter) not older than 3 months for locality points. 7) Medical certificate/assessment for disabled ownership claims. 8) Consortium/JV ownership form (if applicable) detailing contract allocation percentages and ownership in specific goals. 9) Signed SBD forms (SBD1, SBD4, SBD6.1). 10) Valid accreditation from SECTIGO or DigiCert (non-negotiable; failure to submit results in disqualification). Disqualification risks: Directors/trustees/shareholders employed by the state, listing on Register for Tender Defaulters or List of Restricted Suppliers, inconsistent or fraudulent information, or non-submission of required documents.

Bid is subject to the Preferential Procurement Policy Framework Act, 2000. Points are awarded for HDI ownership, women, disabled, youth, and locality. Supporting documents (ID copies, CSD, CK1/CIPC, B-BBEE certificate, medical certificates, proof of address) are mandatory for claiming points.

Contract duration: One year. Successful bidder may be required to sign a written contract form (SBD7). The solution must include provisioning, implementation, maintenance, and support of PKI and CLM, with seamless integration, strong encryption (256-bit), and support for Quantum/Post-Quantum Cryptography. Future integration with KMS and HSM is required. Service provider must configure, implement, and provide OEM technical support, maintenance, updates, patches, and incident resolution. Skills transfer and training for SAMSA ICT personnel are mandatory.

Bids must be emailed to [email protected] with the RFQ number in the subject line or delivered to SAMSA, 146 Lunnon Road, Hillcrest, Pretoria by 19 June 2026 at 11h00. Late bids will not be accepted. All bids must use official forms. Price validity: 60 days post-closing. SAMSA reserves the right to disqualify non-compliant bids.

Bidders must: 1) Ensure tax compliance with valid SARS PIN or CSD registration. 2) Submit TCS certificate or PIN (apply via SARS e-filing). 3) Provide CSD number if no TCS PIN. 4) Not be persons in the service of the state or entities with such directors/members. Foreign suppliers must complete a questionnaire to determine tax obligations in RSA. Failure to comply may render the bid invalid.

Evaluation uses the PPPFA 80/20 or 90/10 preference point system. For 80/20: 80 points for price, 20 for specific goals (HDI ownership 7, women 5, disabled 2, youth 3, locality 3). For 90/10: 90 points for price, 10 for specific goals (HDI ownership 4, women 2, disabled 1, youth 1, locality 2). Points require supporting documents (ID copies, CSD, CK1/CIPC, B-BBEE, medical certificates, proof of address). Ownership points are pro-rata. Consortia/JVs must detail contract allocation and ownership percentages. SAMSA may verify claims and disqualify bidders for fraudulent or inconsistent information.