Supply, support and maintenance of public key infrastructure (pki) software, services, development and licensing — city of cape town, 72 months

Advertised: 02 October 2026

Clarification meeting / site visit

• Date: 22 October 2026
• Time: 12:00
• Venue: Microsoft Teams — https://teams.microsoft.com/meet/320473967638728?p=FJPAWS2R1E38HN1X9P
• Meeting ID: 320 473 967 638 728
• Passcode: wn225i6w
• Attendance: not compulsory, but strongly recommended

Closing

• Date: 02 November 2026
• Time: 10:00

Bid validity

• 120 days after the closing date, irrevocable and open for acceptance.
• Bids remain valid for a further 12 months after expiry of the original validity period unless the bidder notifies the CCT in writing otherwise.
• Validity may be extended by up to 6 months by mutual agreement and City Manager approval, except where the extension arises from an appeal or court ruling.

• Clarification meeting / site visit: 22 October 2026 at 12:00.
• Venue: Microsoft Teams — https://teams.microsoft.com/meet/320473967638728?p=FJPAWS2R1E38HN1X9P
• Meeting ID: 320 473 967 638 728
• Passcode: wn225i6w
• Attendance is not compulsory but is strongly recommended.

Tender enquiries

• Email: [email protected]
• Cc: [email protected]

Submission address

Tender Box 192

Tender & Quotation Boxes Office

2nd Floor (Concourse Level)

Civic Centre

12 Hertzog Boulevard

Cape Town

Supplier registration

• CCT Supplier Management / Registration Office, 2nd Floor (Concourse Level), Civic Centre, 12 Hertzog Boulevard, Cape Town
• Telephone: 021 400 9242/3/4/5
• CSD registration: https://secure.csd.gov.za
• CCT website: www.capetown.gov.za

Objections, complaints, queries and disputes

• The City Manager, c/o Manager: Legal Compliance Unit, Legal Services Department, Office of the City Manager
• Hand delivery: 20th Floor, Tower Block, 12 Hertzog Boulevard, Cape Town 8001
• Post: Private Bag X918, Cape Town, 8000
• Email: [email protected]

Access to information requests

• The City Manager, c/o Manager: Access to Information Unit, Legal Services Department, Office of the City Manager
• Hand delivery: 20th Floor, Tower Block, 12 Hertzog Boulevard, Cape Town 8001
• Post: Private Bag X918, Cape Town, 8000
• Email: [email protected]

Data protection requests

• The City Manager, c/o Information Officer, Office of the City Manager
• Hand delivery: 20th Floor, Tower Block, 12 Hertzog Boulevard, Cape Town 8001
• Post: Private Bag X9181, Cape Town, 8000
• Email: [email protected]

Submission method

• Sealed envelope placed in the official tender box before the closing time.
• Tender box: Box 192, Tender & Quotation Boxes Office, 2nd Floor (Concourse Level), Civic Centre, 12 Hertzog Boulevard, Cape Town.
• Envelope endorsement: tender number 085S/2026/27, the tender description, the tender box number and the closing date, plus the bidder's name and address.
• If the offer is too large for the box or the box is full, enquire at the Tender Distribution Office counter for alternative instructions; the bidder remains responsible for correct placement.
• Late tenders are not considered. The CCT will not accept tenders received after the closing date and time.
• The completed and signed Form of Offer and Acceptance (Contract C.2) plus all supporting documents must be submitted.

Returnable schedules — complete, sign and submit with the bid

• F.1 Contract Price Adjustment: records the price adjustment basis claimed.
• F.2 Certificate of Authority for Partnerships/Joint Ventures/Consortiums: authorises the bid and the signatory; attach the JV/consortium agreement where applicable.
• F.3 Declaration for Procurement above R10 million.
• F.4 Preference Points Claim Form (Preferential Procurement Regulations 2022): claims preference points for specific goals.
• F.5 Declaration of Interest – State Employees (MBD 4 amended): discloses state employment links of directors, members or shareholders.
• F.6 Conflict of Interest Declaration.
• F.7 Declaration of Tenderer's Past Supply Chain Management Practices (MBD 8).
• F.8 Authorisation for the Deduction of Outstanding Amounts Owed to the CCT.
• F.9 Certificate of Independent Tender Determination: certifies the price was set without collusion.
• F.10 Proposed Deviations and Qualifications by Tenderer.
• F.11 List of Other Documents Attached by Tenderer.
• F.12 Record of Addenda to Tender Documents.
• F.13A and F.13F Information to be Provided with the Tender.
• F.13B valid OEM/OSM price lists.
• F.13C functionality responses for Schedules A and B.
• F.14 Appeal Application.

Disqualification risks

• Any returnable schedule left incomplete or unsigned.
• A tender that does not comply in all respects with the Conditions of Tender, the Specifications, the pricing instructions and the Contract.
• Material deviation or qualification of the tender terms.
• OEM/OSM authorisation not valid as at the closing date (Schedules A, B and C).
• Functionality score below the minimum for Schedules A and B.

• F.1 Contract Price Adjustment.
• F.2 Certificate of Authority for Partnerships/Joint Ventures/Consortiums.
• F.3 Declaration for Procurement above R10 million.
• F.4 Preference Points Claim Form (Preferential Procurement Regulations 2022).
• F.5 Declaration of Interest – State Employees (MBD 4 amended).
• F.6 Conflict of Interest Declaration.
• F.7 Declaration of Tenderer's Past Supply Chain Management Practices (MBD 8).
• F.8 Authorisation for the Deduction of Outstanding Amounts Owed to the CCT.
• F.9 Certificate of Independent Tender Determination.
• F.10 Proposed Deviations and Qualifications by Tenderer.
• F.11 List of Other Documents Attached by Tenderer.
• F.12 Record of Addenda to Tender Documents.
• F.13A and F.13F Information to be Provided with the Tender.
• F.13B OEM/OSM price lists.
• F.13C functionality responses.
• F.14 Appeal Application.

All returnable documents must be completed, signed and submitted with the bid.

Evaluation order

• Responsiveness test first: completeness, signing, and conformity with the Conditions of Tender, Specifications and pricing instructions without material deviation.
• Functionality evaluation for Schedules A and B, then price and preference scoring.
• A two-stage proposal system is not used.
• Award goes to the bidder with the highest total adjudication points.

Functionality

• Minimum qualifying score: 60 out of 100 for Schedule A (PKI system, ADCS + AVX).
• Minimum qualifying score: 60 out of 100 for Schedule B (integrated PKI replacement solution).
• Schedule A criteria include integration with non-domain Windows servers, SLES 15+/RHEL 9+ Apache servers and AIX 7.3, automatic certificate discovery, integration with the AppViewX PKI system, vendor roadmap, certificate management use-case examples, backup and restore process, and PKI reference track record.
• Schedule B criteria include solution architecture, X.509 lifecycle management across corporate network and DMZs, migration plan from AppViewX with minimal downtime, client certificate issuance to non-domain Windows and non-Windows servers, Linux and AIX integration, certificate discovery, management dashboard and reporting, revocation process, backup and restore, CRL distribution points, automated provisioning, IT service continuity and disaster recovery, expired certificate removal, public CA integration with a 47-day certificate lifecycle, and PKI reference track record.
• Schedule F.13C must be completed and returned for each functionality question.
• Joint ventures must include a statement describing which aspects of the work each party will perform.

Price and preference

• 80/20 price/preference system applies to responsive tenders up to and including R50 000 000 (all taxes included).
• Preference points: 20 in total, made up of 8 points for Promotion of Micro and Small Enterprises, 6 points for Enterprise Supplier Development and Socio-Economic Development, and 6 points for Skills Development or an Employee Share Scheme.
• Price points are calculated on the sum of prices/rates against estimated quantities.
• Preference points are awarded only on sufficient, relevant and verifiable documentary proof; unverified claims are not scored.

Award structure

• Schedules A and B: a single tenderer is appointed per schedule, and either Schedule A or Schedule B will be awarded.
• Schedules C and D: one highest-ranked tenderer plus one alternative tenderer per schedule, with work allocated on a winner-takes-all basis; work passes to the alternative only if the winner declines.
• The CCT may appoint fewer tenderers or none if insufficient responsive bids are received.

Scope

• Supply, support and maintenance of public key infrastructure, software, services, development and licensing for the City of Cape Town.
• Contract period: 72 months from the commencement date.
• Bidders may tender for all schedules or fewer, as indicated in the Schedule of Preference.

Schedule A — support and maintenance of the existing AppViewX PKI system

• Annual licensing of the PKI and certificate lifecycle management solution, priced per IP address/asset.
• Integration with non-domain Windows web servers, SUSE Linux Enterprise Server 15+ and Red Hat 9+ Apache web servers, and AIX 7.3 Apache web servers.
• Automatic discovery of all certificates, domain and non-domain, including self-signed, rogue, expired, mismatched and SHA1/SSL/TLS certificates.
• Integration with the AppViewX PKI system for timely certificate renewal.
• Vendor roadmap for the AppViewX solution, including operating system constraints.
• Backup and restore process for AppViewX.

Schedule B — supply, installation, configuration and integration of a new or alternative PKI system, with ongoing support and maintenance

• Solution architecture for clients and devices on the corporate network and Internet Hosting DMZ, integrating with the existing ADCS system.
• Full X.509 certificate lifecycle management across the corporate network, Internet Hosting DMZ and third-party DMZ (the DMZs sit on a separate trusted domain for Internet/Extranet services).
• Migration plan from the current AppViewX solution with minimal or no downtime, stating the downtime required.
• Certificate issuance and management for non-domain Windows servers and non-Windows server operating systems and applications.
• Integration with SLES 15+ and RHEL 9+ (Apache HTTP Server, Apache Tomcat, NGINX, lighttpd) and AIX 7.3.
• Automatic discovery of internal and external certificates, including public CA certificates.
• Management dashboard, notifications and technical reporting; timely certificate renewal.
• Certificate revocation process and multiple CRL distribution points, with OCSP support.
• Automated provisioning of certificates for Windows, Unix and Linux clients and workstations.
• IT service continuity strategy, architecture, design and procedures for failure of hardware, database, keys or capacity.
• Removal of expired certificates from workstations and servers.
• Integration with public certificate authorities such as Sectigo, DigiCert and GoDaddy, with a proposed 47-day certificate lifecycle.

Schedule C — public certificate authority certificates

• DigiCert or equivalent SSL certificates.
• Advanced Electronic Signature (AeSign) certificates.

Schedule D — cyber security development programme.

General

• Where the tender names a trade mark, name, patent, design, type, origin or producer, it is to be read as "or equivalent".
• OEM/OSM authorisation or accreditation is required for the items listed in the Price Schedule for Schedules A, B and C, valid as at the closing date.

• Schedule B: a migration plan from the current AppViewX solution to the proposed solution with minimal or no downtime, stating the downtime required.
• Schedule B: an IT service continuity strategy, architecture, design and detailed procedures for failure of hardware, database corruption, keys or capacity restrictions.
• Schedule A: a backup and restore process for AppViewX.
• Both schedules: evidence of certificate management processes covering discovery, renewal and revocation, and integration with public certificate authorities.
• Schedule B: a certificate revocation process and the CRL distribution points or techniques offered.
• Schedule B: a process for removing expired certificates from workstations and servers.
• Schedule B: automated provisioning of certificates for Windows, Unix and Linux environments.

• Bidders must show how many years they have actively provided public key infrastructure solutions, naming client organisations, the solutions provided, implementation dates and project duration, plus reference contact details for verification.
• Schedule A: actual AppViewX certificate management reports covering use cases such as certificate expiry, non-compliant certificates and certificate types; three or more different use-case reports score highest.
• Schedule B: case studies of similar implementations, which may be anonymised but must state the industry concerned; two or more case studies score highest.
• Schedule B: actual certificate management reports covering certificate expiry, non-compliant certificates and certificate types.
• The CCT may assess the bidder's professional and technical qualifications, competence, financial resources, equipment, facilities, managerial capability, reliability, capacity, experience, reputation and personnel, including existing CCT contracts.
• Bidders must have the legal capacity to contract and must not be insolvent, in receivership, under business rescue, bankrupt or being wound up.
• Joint ventures must state which aspects of the work each party will undertake.

• The CCT may require testing to demonstrate that aspects of the offer comply with requirements, at the bidder's cost.
• Bidders must cooperate fully with the CCT's external service provider appointed to perform a due diligence review and risk assessment, on written instruction.
• Samples, inspections, tests and analysis are not applicable to this tender.
• The CCT may verify the financial offer, unit rates and prices, and the bidder's technical qualifications, competence, financial resources, equipment, facilities, managerial capability, reliability, capacity, experience, reputation and personnel, including existing contracts with the CCT.

Price Schedule (Section C.4) covers Schedules A, B, C and D.

• Schedule A: annual licensing of AppViewX PKI and certificate management solutions, priced per IP address/asset; labour rates in Table A.3.
• Schedule B: equivalent PKI and certificate management solutions, priced per IP address/asset; labour rates in Table B.3.
• Schedule C: public certificate authority certificates — DigiCert or equivalent SSL certificates and Advanced Electronic Signature (AeSign) certificates; labour rates in Table C.3.
• Schedule D: cyber security development programme.
• Pricing is by fixed mark-up percentage; the mark-up is awarded and OEM prices are for evaluation only.
• Mark-up percentage = [(Profit ÷ Cost Price) × 100] %; final price = OEM price × mark-up % × estimated quantities.
• Valid OEM/OSM price lists naming the proposed products must be submitted in Schedule F.13B.
• Bidders must comply with all pricing instructions on the Price Schedule.

Tender fee

• R200 non-refundable, payable to the City of Cape Town for a hard copy of the tender document.
• The fee does not apply to documents downloaded from the website.

Pricing format

• Price Schedule in Section C.4, with separate tables for Schedules A, B, C and D.
• Pricing is by fixed mark-up percentage for the relevant items in Schedules A to D; the mark-up percentage is what is awarded, while OEM prices are used for evaluation only.
• Mark-up percentage = [(Profit ÷ Cost Price) × 100] %.
• Final price = OEM price × mark-up % × estimated quantities.
• Labour rates are priced ad hoc: Schedule A Table A.3, Schedule B Table B.3, Schedule C Table C.3.
• Valid OEM/OSM price lists, including proposed product names, must be provided in Schedule F.13B.
• Price points are scored on the sum of prices/rates against estimated quantities.

Arithmetic corrections

• Where words and figures differ, the amount in words governs.
• Where a line item total differs from unit rate × quantity, the line item total governs and the rate is corrected.
• Where the total of prices is wrong, the total governs and the bidder is asked to revise selected item prices to reach the tendered total.
• Rates or lump sums that are unpriced, excessively high or low, or out of balance may be queried and must be justified; the CCT may require amendment.

Guarantees and insurance

• Annexure A: pro forma insurance broker's warranty.
• Annexure C: pro forma performance security/guarantee.
• Annexure D: pro forma advance payment guarantee.
• Annexure B: monthly project labour report.

Appeals

• Administration fee: R300, payable at Municipal Offices or the Civic Centre using the GL Data Capture Receipt, or by EFT to the CCT's Nedbank account, reference 198158966; proof of payment must accompany the appeal.
• Surcharge for vexatious, frivolous or manifestly inappropriate appeals: ½ (administrative cost of the tender appeal) + 0.25% of the appellant's tender price.
• Unpaid fees or surcharges are added as a sundry tariff to the bidder's municipal account, or recovered under the CCT's Credit Control and Debt Collection By-law, 2006.

Registration

• National Treasury Central Supplier Database (CSD) registration required; register on written request within the stated period, failing which no orders can be raised or payments processed.
• CCT Supplier Database registration required on the same basis.
• For joint ventures, both registration requirements apply to each party individually.
• Bidders must keep their CSD and CCT database information updated.

Tax

• Bidders must be registered with SARS and tax compliant, or be a foreign supplier not required to register for tax compliance.
• Evidence: a valid Tax Compliance Status PIN issued by SARS, submitted with the tender or to the Supplier Management Unit; the CCT verifies it via CSD or e-Filing.
• A bid may be rejected if proof of tax compliance is not provided within the stated timeframe.

Eligibility

• The bidder, its representatives, directors or members must not be restricted for abuse of the supply chain management system.
• Must not have been found guilty of contravening the Competition Act.
• Must not be an advisor or consultant to the CCT whose prior or current obligations create a conflict of interest or unfair advantage.
• Must not be a person, advisor, corporate entity or director involved with the bid specification committee.
• Must have legal capacity to contract and must not be insolvent, in receivership, under business rescue, bankrupt or being wound up.
• Must be able to perform the contract free of conflicts of interest.

OEM/OSM authorisation

• Required for Schedules A, B and C, valid as at the closing date.
• Direct OEM/OSM: written confirmation on letterhead that the bidder will supply, support and manage warranty processes and escalations.
• Direct accreditation with the OEM/OSM: official written confirmation on the OEM/OSM's letterhead authorising resale, support and warranty management.
• Accreditation through a distributor: two documents — an authorisation letter from the accredited distributor to the bidder, and an authorisation letter from the OEM/OSM to the distributor.
• Proof must be appended to Schedule F.13A.

B-BBEE and preference

• Preference points for specific goals require sufficient, relevant and verifiable documentary proof; unverified claims are not awarded points.
• Each entity in a consortium or joint venture must submit separate B-BBEE certificates or sworn statements.

Other

• Bidders must cooperate with the CCT's external service provider for due diligence review and risk assessment when instructed in writing.
• Corrupt or fraudulent practices disqualify a bidder immediately.

• Bidders must comply with the Occupational Health and Safety Act and its Regulations, and with the Health and Safety Specification.
• The bid must demonstrate, in sufficient detail, the competencies and resources needed to deliver the goods or services in accordance with the Act, the Regulations and the Health and Safety Specification.
• An Occupational Health and Safety Agreement (Contract C.3) forms part of the contract documentation.

Contract framework

• The tender, its evaluation and acceptance, and any resulting contract are subject to the CCT's Supply Chain Management Policy as at the date of advertisement and as amended.
• Contract period: 72 months from the commencement date.
• The CCT may accept or reject any tender, accept part of a tender or items from multiple manufacturers, and is not obliged to accept the lowest or any tender.
• The CCT may cancel the tender before contract formation where there is no longer a need, funds are unavailable, no acceptable tenders are received, there is a material irregularity, or market-related pricing cannot be negotiated. It incurs no liability and gives written reasons on written request.
• The CCT may nominate a Standby Bidder at award, to be considered if the contract is later terminated.

Objections, disputes and appeals

• Objections, complaints, queries or disputes must be lodged in writing within 14 days of the decision or action.
• Appeals under Section 62 of the Municipal Systems Act must be lodged with the City Manager within 21 days of notification of the decision, in writing, setting out the reasons, how the appellant's rights were affected, the remedy sought, and attaching a copy of the notification.
• The appeal authority may confirm, vary or revoke the decision, without detracting from rights already accrued.
• Rights to approach the High Court and rights under PAJA and PAIA are unaffected.
• A fixed administration fee of R300 applies to appeals, with a possible surcharge for vexatious, frivolous or manifestly inappropriate appeals.

Other

• POPIA governs the CCT's processing of bidders' personal information for the tender and contract.
• Verbal communication from the CCT before award is not binding unless confirmed in writing by the Director: Supply Chain Management or a nominee.

• The tender is subject to the CCT's Supply Chain Management Policy; abuse of the system may lead to rejection of the bid, cancellation of the contract, restriction of the supplier, or other remedies.
• Conflicts of interest must be avoided and any actual or perceived conflict declared in the bid.
• The CCT may cancel the tender before contract formation for changed circumstances, unavailable funds, no acceptable tenders, material irregularity, or inability to negotiate market-related pricing.
• A Standby Bidder may be nominated at award.
• Registration on the CCT Supplier Database and the National Treasury CSD is required.
• Contract period: 72 months.
• Schedules A and B: one tenderer appointed per schedule; either Schedule A or Schedule B will be awarded.
• Schedules C and D: one winner plus one alternative tenderer per schedule, allocated on a winner-takes-all basis.

• A compliant offer must be submitted, complying in all respects with the Conditions of Tender, the Specifications, the pricing instructions and the Contract.
• Required declarations: Details of Tenderer; Certificate of Authority for Partnerships/Joint Ventures/Consortiums (with the agreement where applicable); Declaration of Interest – State Employees; Conflict of Interest Declaration; Declaration of Past Supply Chain Management Practices; Certificate of Independent Tender Determination; Authorisation for the Deduction of Outstanding Amounts Owed to the CCT.
• Tax affairs with SARS must be in order, evidenced by a valid Tax Compliance Status PIN.
• The bidder must not be restricted under the SCM Policy, must not be involved with the bid specification committee, and must not have contravened the Competition Act.
• Registration on the CCT Supplier Database and the National Treasury CSD is required.
• OEM/OSM authorisation or accreditation is required for Schedules A, B and C, with proof submitted in Schedule F.13A.
• A clear, irrevocable and unambiguous offer must be made, identifying the bidder and what the offer constitutes.

Functionality is scored out of 100 for each of Schedule A and Schedule B, with a minimum qualifying score of 60 for each.

Schedule A (PKI system, ADCS + AVX) criteria and maximum points

• Integration with non-domain Windows web servers: 12
• Integration with SLES 15+ and Red Hat 9+ Apache web servers: 12
• Integration with AIX 7.3 Apache web servers: 12
• Automatic discovery of all certificates, domain and non-domain, including self-signed, rogue, expired, mismatched and SHA1/SSL/TLS certificates: 12
• Integration with the AppViewX PKI system for timely renewal: 12
• Vendor roadmap for the AppViewX solution: 4
• Actual AppViewX certificate management use-case reports: 12
• Backup and restore process for AppViewX: 12
• Years of PKI delivery experience with named references: 12

Schedule B (integrated PKI replacement) criteria and maximum points

• Solution architecture for corporate and Internet Hosting DMZ environments: 4
• X.509 certificate lifecycle management across corporate network and DMZs: 4
• Migration plan from AppViewX with minimal or no downtime: 8
• Client certificate issuance to non-domain Windows and non-Windows servers: 8
• Integration with SLES 15+ and RHEL 9+ (Apache HTTP Server, Tomcat, NGINX, lighttpd): 8
• Integration with AIX 7.3: 8
• Automatic discovery of internal and external certificates: 4
• Integration with current and proposed PKI for timely renewal, with dashboard and notifications: 4
• Certificate management use-case reports: 4
• Case studies of similar implementations: 4
• Certificate revocation process: 4
• Backup and restore process for CA database, keys, registry settings and policies: 4
• CRL distribution points or techniques, with OCSP: 4
• Automated provisioning for Windows, Unix and Linux: 8
• IT service continuity, high availability and disaster recovery design: 4
• Removal of expired certificates from workstations and servers: 4
• Integration with public certificate authorities and a 47-day certificate lifecycle: 8
• Years of PKI delivery experience with named references: 8

Scoring notes

• Schedule F.13C must be completed and returned for every functionality question.
• Failure to submit all required information in the prescribed format may reduce the functionality score.
• Preference points total 20: 8 for Promotion of Micro and Small Enterprises, 6 for Enterprise Supplier Development and Socio-Economic Development, and 6 for Skills Development or an Employee Share Scheme.