Tender for 5-Year IT/OT Cybersecurity SOC as a Service at Rand Water

of Previous Experience:** Bidders must demonstrate experience with a minimum of three (3) projects over at least three (3) years in providing IT and OT cybersecurity/security operational centre services, supported by contactable client reference letters.

Resource Capacity:** The project team must include a Team Leader (Certified Information Security Manager, Certified Information Systems Auditor, and Certified in the Governance of Enterprise IT, with at least five years' relevant experience and three years in management), a Technical/Risk Lead (certified as an Ethical hacker / Certified Advanced Security Professional / CISSP / CISM, with a minimum of five years’ experience in information and operational technology security solution design, build and maintenance), and a minimum of four (4) Cyber/Security Engineers/Specialists with experience and certifications in cloud and server security, network security, Senior Security Architecture, and operational technology cybersecurity (Scada, PLC, HMI, etc.). CVs for these roles are required.

Resource Capacity:** Bidders must detail their equipment resource capacity, including SOC and relevant SIEM Tools, office space, resource utilisation, vehicles, and working tools.

Project Programme:** A project programme in Gantt chart format is required, aligned with an implementation period of 6 months per site. It must indicate project start/end dates, duration, milestones, a draft Service Level Agreement (SLA) with availability/uptime, response times, resolution time, accuracy, first resolution, and activities with assigned resources. It should also cover support and maintenance details (dedicated contact, turn-around time, call logging, escalation process, specific method statement, and alignment with contractual requirements).

Statement:** A specific method statement detailing all deliverables in accordance with the scope of work and aligned with contractual requirements is mandatory. This includes a fully completed and signed ANNEXURE A. Evaluation of Annexure A will also be conducted via a presentation during a site visit.

Due Diligence:** Bidders will be required to demonstrate the proposed solution at their office to verify it matches the requirements outlined in ANNEXURE A – Table 3.2.

compliance requirements include:

Status:** Bidders must provide a SANAS accredited B-BBEE certificate or a sworn affidavit for Qualifying Small Enterprises (QSEs) or Exempted Micro Enterprises (EMEs), or a dtic B-BBEE certificate. Points will be awarded based on the B-BBEE status level of contribution, with non-compliant contributors scoring zero.

Compliance:** Bidders are required to provide their 'SUPPLIER TAX CENTRAL SUPPLIER COMPLIANCE STATUS SYSTEM PIN', indicating that tax compliance will be verified.

Supplier Database (CSD) Registration:** Bidders must provide their 'CENTRAL SUPPLIER DATABASE No: MAAA......................', indicating CSD registration is mandatory.

Equipment Manufacturer (OEM) Partnership:** A letter of partnership or certificate indicating that the bidder has a partnership with a registered OEM is required, and it must be on an OEM letterhead.

Hosting Affidavit:** A fully completed, signed, and commissioned Security Operation Centre Data Hosting Affidavit (Annexure B) confirming that data collected will be hosted within the borders of South Africa is mandatory.

Compliance:** The Form of Offer must be fully completed and signed. No correction fluid is permitted on the bid document.

tender document mentions 'PART C2: PRICING DATA' which includes 'C2.1. PRICING ASSUMPTIONS' and 'C2.2. PRICING SCHEDULES / BILLS OF QUANTITIES (BoQ)', indicating that pricing details will be required. For alternative bid offers, 'Pricing Data must reflect all assumptions in the development of the pricing proposal' and 'The pricing of the alternative bid offer may not exceed the pricing of the main bid offer'. The evaluation includes an 80/20 preference point system where 80 points are allocated for price. No specific financial capacity, solvency requirements, invoice/payment schedules, or financial guarantees/bonds are detailed in this extract.