Fortigate firewall upgrade & maintenance (3 years) – gauteng tender

Closing date: 14/08/2026 at 11:00 AM.

Validity period: quotations must remain valid for 30 days from the closing date.

Public viewing session: not applicable.

Enquiries: Supply Chain Management: Acquisition Management, National Heritage Council.

Email: [email protected].

Invoices: [email protected].

General enquiries: [email protected], +27 12 748-3910.

Returnable documents — all must be completed, signed and submitted with the quotation:

• Annexure A (SBD 4, Supplier's Disclosure): discloses whether any director or shareholder is employed by the state or connected to anyone at the NHC; false declarations disqualify the bid.
• Annexure B (SBD 6.1, Preference Points Claim Form): claims specific goal points.
• Annexure C (POPIA Supplier Notice and Consent Form): consents to the NHC processing the supplier's personal information.
• Annexure D (NHC's Supplier Code of Conduct): commits the supplier to the NHC's ethical, anti-corruption, confidentiality and labour standards.
• Annexure E (Supplier Evaluation Checklist): confirms the supplier's alignment with Sustainable Development Goals and SMME/HDI status.
• Proof of CSD registration, a valid SARS Tax Status PIN, a valid B-BBEE certificate or sworn affidavit, CIPC registration proof, and audited financial statements for the past two years.

Submission channel and format:

• Quotations must be submitted electronically to [email protected] before the closing date and time.
• Quotations must be on company letterhead, include contact details and the quote number, and be duly signed.
• Quotations must be submitted on the official forms and must not be retyped.

Disqualification risks:

• Quotations received after the closing date and time, or sent to the wrong email address.
• Late or incomplete submissions.
• Quotations not costed for the entire scope and period of the project.
• Failure to complete the Supplier Evaluation Checklist may render the quotation non-responsive.

Required documentation:

• Proof of registration on the Central Supplier Database (CSD).
• Annexure A (Supplier's Disclosure) completed and signed.
• Annexure B (Preference Points Claim Form) completed and signed.
• Tax Status Pin Code from SARS.
• Valid B-BBEE certificate or Sworn Affidavit.
• Annexure C (POPIA Supplier Notice and Consent Form) completed and signed.
• Annexure D (NHC's Supplier Code of Conduct) completed and signed.
• Annexure E (Supplier Evaluation Checklist) completed and signed.
• Audited financial statements for the past two years.
• CIPC registration proof.

Evaluation is conducted in two phases:

• Phase 1 (SCM compliance): verification that all required documentation is complete and correct. Suppliers must be registered on the CSD, have a valid SARS Tax Status PIN, be registered with CIPC in good standing, submit audited financial statements for the past two years, and submit all signed annexures. Suppliers listed on the Register for Tender Defaulters or the List of Restricted Suppliers are automatically disqualified.
• Phase 2 (Price and specific goals): scoring under the 80/20 preference point system. Price carries a maximum of 80 points and specific goals carry a maximum of 20 points, for a total of 100 points.

Award:

• The RFQ will be awarded to the supplier scoring the highest total points, subject to the Preferential Procurement Policy Framework Act.
• The successful supplier must sign an award letter and SBD 7.3 (Contract for Income-Generating Contracts).

Scope:

• Supply, delivery, uninstallation, reinstallation, configuration, deployment, testing, maintenance and support of a next-generation firewall, upgrading from the existing FortiGate-100E to a FortiGate 120G.

Hardware:

• Product: FortiGate 120G, model 1T-FG-120G-BDL-809-36, quantity one unit.
• Existing device serial number: FG100E4Q17021144.

Licensing and support (3 years):

• FortiCare Premium Support and FortiGuard Enterprise Protection.
• 24/7 technical support and maintenance, firmware and security updates, advanced threat protection, Intrusion Prevention System (IPS), anti-virus and anti-malware protection, web filtering and application control, and continuous threat intelligence updates.

Functional requirements:

• Network security and threat protection, intrusion detection and prevention, malware/ransomware/spyware protection, secure VPN access (remote and site-to-site), web filtering and application control, real-time threat intelligence and monitoring, centralised and user-friendly management interface, and data encryption and data loss prevention.

Compatibility:

• Must be compatible with the existing NHC network infrastructure and integrate with the current ICT environment, with support for future scalability and upgrades.

Installation and deployment:

• Provide a backup plan for the existing firewall during replacement.
• Uninstall the old FortiGate 100E hardware, install and configure the new firewall.
• Configure firewall policies, rules, security settings and access control; establish firewall zones and IP address structure; integrate into the existing network environment.
• Test and validate functionality.
• Provide administrator handover and onsite training and knowledge transfer.

Experience and qualifications:

• The NHC will process personal information of the supplier's representatives, directors and employees during the procurement process, including job position, role and qualifications.
• No specific experience or key personnel qualifications are stated in the document.

Quality requirements:

• The service provider must have a backup plan for the existing firewall during replacement.
• The firewall must be configured, integrated and tested to ensure full functionality.
• Testing and validation of functionality is required.
• Administrator handover and onsite training and knowledge transfer must be provided.

Pricing schedule:

• Prices must be quoted in South African Rand, inclusive of VAT and all associated costs, for the full 3-year period.
• Quotations must be valid for 30 days from the closing date.
• This is a fixed-price RFQ; no price adjustments will be considered after closure.
• Quotations not costed for the entire scope and period will not be considered.

Pricing:

• Prices must be quoted in South African Rand, inclusive of VAT and all associated costs such as delivery, insurance and taxes, for the full 3-year period.
• Quotations not costed for the entire scope and period will not be considered.
• This is a fixed-price RFQ; no price adjustment or amendment will be considered after closure.
• Quotation prices must be valid for 30 days from the closing date.

Payment:

• The NHC will pay within 30 days after receipt of an invoice.
• Invoices must be submitted to [email protected] in the SARS-prescribed format.

Other:

• The NHC reserves the right to benchmark quoted prices and to do due diligence on quotations.
• The NHC may award to multiple suppliers if it is in the best interest of the project.

Mandatory registrations and documents:

• CSD registration: suppliers must be registered on the Central Supplier Database of National Treasury and provide the CSD registration number.
• SARS Tax Status PIN: suppliers' tax matters must be in order.
• CIPC registration: suppliers must be registered with the Companies and Intellectual Property Commission and be in good standing; proof of registration must be submitted.
• B-BBEE certificate: a valid and compliant original or certified copy of the B-BBEE certificate or sworn affidavit must be submitted for any points claimed.
• Audited financial statements for the past two years must accompany the quotation.

Returnable forms (each one line):

• Annexure A (SBD 4, Supplier's Disclosure): discloses interests and connections to the state.
• Annexure B (SBD 6.1, Preference Points Claim Form): claims specific goal points.
• Annexure C (POPIA Supplier Notice and Consent Form): consents to processing of personal information.
• Annexure D (NHC's Supplier Code of Conduct): commits to ethical conduct.
• Annexure E (Supplier Evaluation Checklist): confirms SDG alignment and SMME/HDI status.

Other:

• Suppliers must not be listed on the Register for Tender Defaulters or the List of Restricted Suppliers.
• Foreign suppliers must complete the questionnaire for foreign bidders.

Health and safety:

• Suppliers must provide a safe and healthy working environment for their employees and comply with all applicable health and safety laws and regulations.
• The NHC's Supplier Code of Conduct requires compliance with all applicable health and safety laws.

Environmental responsibility:

• Suppliers must comply with all applicable environmental laws and regulations and strive to minimise their environmental impact.

Contract terms:

• The NHC's conditions of purchase apply; the NHC may accept or reject any changes to the requirements.
• Goods or services will only be supplied upon receipt of an official NHC purchase order or signed service level agreement.
• The NHC is not bound to accept any quotation and may withdraw or amend the terms of reference, cancel the RFQ, or annul the process at any time without liability.
• The NHC may award to multiple suppliers where it is in the best interest of the project.
• Intellectual property rights in all deliverables vest in the NHC; the service provider must not reproduce or use deliverables without prior written consent.
• The service provider must provide a digitised version of the final product, all open/editable source files, and written confirmation that no third-party rights are infringed.
• The General Conditions of Contract (GCC) form part of the RFQ and may not be amended.

Special conditions:

• Quotations must be submitted electronically to [email protected] before the closing date and time.
• Late or incomplete submissions will not be considered.
• Quotations must be on company letterhead, include contact details and quote number, and be duly signed.
• Prices must be in South African Rand inclusive of VAT and associated costs, valid for 30 days from closing date.
• The NHC is not bound to accept any quotation and reserves the right to withdraw or amend the terms of reference, accept or reject any quote, annul the process, cancel the RFQ, do due diligence, benchmark prices, and award to multiple suppliers.
• Goods/services shall only be supplied upon receipt of an official purchase order.
• The NHC shall pay within 30 days after receipt of invoice; invoices must be submitted to [email protected] in SARS-prescribed format.

Evaluation is conducted in two phases:

• Phase 1: SCM compliance — verification of completeness and correctness of documentation.
• Phase 2: Price and specific goals — scoring under the 80/20 preference point system (80 points price, 20 points specific goals, total 100).
• Award goes to the supplier scoring the highest total points, subject to the Preferential Procurement Policy Framework Act.