Arc hybrid mesh firewall services – compulsory briefing, csd, tax & local content requirements, 36-Month contract

A physical compulsory information session will be held on 03 September 2026 at 11:00 AM at the ARC Auditorium, 1134 Park Street, Hatfield, Pretoria. Bidders must arrive by 10:00 AM to sign the attendance register. Late arrivals (more than 15 minutes after start) will not be permitted. Attendance is mandatory.

Tender documentation queries: Ms Fisokuhle Dlamini (PURCO SA, Procurement Officer, email: [email protected]) and Ms Elelwani Muhanelwa (ARC, Supply Chain Management, email: [email protected]). Technical enquiries must be directed via the PURCO SA website under ARC/09/08/2026.

Submission is electronic only, via the PURCO SA website (https://purcosa.co.za). No physical, email or fax submissions will be accepted. Only final submissions are evaluated; draft submissions are rejected. Late submissions are not accepted. The bid document must be purchased at a non-refundable fee of R 1,150.00 (VAT included) on the PURCO SA website, available from 21 August 2026. Bidders must log in with the username and password of the person who purchased the document, go to 'My purchased tenders' and click 'Submit bid'. The Online Tender Submissions Guide at https://purcosa.co.za/online-tender-submissions-guide provides details on preparing and uploading files. Bidders should submit early to allow time to resubmit if issues arise. The completed bid document must be submitted on official company letterhead with detailed costing. All SBD forms must be completed and signed. The master bid document must be completed, initialled and signed in full. No pages may be removed from the original tender document. Proposals must remain valid for 180 days after submission. The bid is subject to the General Conditions of Contract as prescribed by National Treasury. Misrepresentation of facts will result in disqualification and cancellation of the contract. Bidders must not be in the service of the state, nor have directors or members who are. Proof of authority to sign (e.g. company resolution) must be submitted. Returnable forms include SBD 1 (Invitation to Bid), SBD 2 (Tax Clearance Certificate Requirements), SBD 3.3 (Pricing Schedule – Firm Prices), SBD 4 (Bidder's Disclosure), SBD 5 (Declaration for Local Production and Content), SBD 6.1 (Preference Points Claim), SBD 7 (Contract Form), SBD 8 (Declaration of Bidder's Past Supply Chain Management Practices), SBD 9 (Certificate of Independent Bid Determination), and the Excel Pricing Schedule (Annexure 1). Failure to submit SBD 3.3 with the pricing schedule leads to disqualification. All SBD forms must be completed and signed.

The bidder must pay a 2% service fee to PURCO SA on the total value of each invoice, and must submit monthly sales reports to PURCO SA by the 10th working day of each month. The bidder must consent to the right of offset by the Membership for any outstanding amounts. Bidders must be in good financial and legal standing. The bid document takes precedence over other documents in case of dispute.

Bidders must submit the completed bid document with all attachments, including the pricing schedule (Annexure 1), SBD 3.3, and all other SBD forms. The bid must be submitted electronically on the PURCO SA website. No physical, email, or fax submissions will be accepted. Only final submissions will be evaluated.

The bid will be evaluated in four phases: Phase 1 Administrative Compliance, Phase 2 Mandatory Requirements, Phase 3 Functionality (including presentation and site visit), Phase 4 Price and Specific Goals. Phase 3 uses the 80/20 evaluation system with criteria: Company Experience (30 points), Team Experience and Qualifications (20 points), Solution Capability (20 points), Proposed Project Plan (10 points), Presentation (10 points), and Site Visit (10 points). Bidders scoring less than 52 points (65%) will be disqualified from presentation; less than 5 points (50%) on presentation will not proceed to site visit; only bidders scoring at least 5 points (50%) on site visit will be considered for price and B-BBEE. Phase 4 allocates 80 points to price and 20 points to B-BBEE and specific goals (ownership by HDIs, women, youth, PwD, BEE status, and rural suppliers).

The ARC requires a Managed and Hosted Hybrid Mesh Firewall cybersecurity capability to address evolving cyber threats across its hybrid (cloud and on-premise) network environments. The objective is to appoint a service provider to deliver next-generation firewall protection across all campuses, 24/7 monitoring and incident response, compliance with ICT governance and data protection requirements, and professional managed security services with defined service levels.

Scope of work: provision of managed firewall (physical/virtual) services, including deployment, configuration, security monitoring, management, maintenance, proactive threat detection and blocking, firmware and patch management, updating and optimization to protect ARC network, systems, applications and data against cybersecurity threats. Key deliverables include 24/7 monitoring and incident response, monthly reporting and SLA tracking, integration with ARC systems (e.g., Entra ID, SIEM), and training, documentation, and knowledge transfer.

Technical requirements for the managed and hosted hybrid mesh firewall include: Layer 3-7 firewalling, IPS/IDS and threat prevention, application control and URL filtering, DNS security, VPN (IPsec/SSL) with MFA, Zero Trust and segmentation, SSL/TLS inspection, SIEM integration, and anti-malware protection. Performance minimums: Internet throughput 36 Gbps, WAN throughput 10 Gbps, VPN users 2000, IPS throughput 5.7 Gbps, concurrent sessions 8 million, new connections/sec 300,000. Interfaces: minimum 8x1GbE + 2x10GbE ports, VLAN support (802.1Q), LACP, link aggregation, IPv4/IPv6 dual-stack, static + OSPF/BGP routing. Platform support: physical appliances, virtual appliances (VMware/Hyper-V), central management platform (cloud or on-prem). Security hardening: RBAC with granular roles, MFA for admin access, audit trails, secure admin protocols, backup/restore and configuration versioning. Interoperability: AD/Entra ID integration, SIEM via Syslog/API, certificate integration for TLS inspection.

Expected outcomes: current-state assessment and due diligence report, detailed solution design/architecture documentation, project implementation and configuration plan (project charter), migration and cut-over plan, security policies and baselines, SOPs and runbooks, training and skills transfer, monthly SLA reports, monthly security incident reports, quarterly security posture review report, final project closure report, hosting in a secure data centre, centralised management and unified logging, high availability and failover configuration, policy configuration and lifecycle management.

The bidder must provide a comprehensive proposal describing the methodology for the breakdown of the complete specification with associated costs, and must complete and sign all SBD forms. The proposal should include a project implementation plan with milestones, timelines, risks, mitigations, solution design, and value-added services.

The bidder must demonstrate experience in delivering managed firewall services, with a minimum of five years' experience. The bidder must provide reference letters from clients for similar services within the last seven years, and CVs of key staff (3-5 firewall/network security engineers) with relevant qualifications and certifications (e.g., FCP, PCNSA, CCSA, CCNA, FCSS, PCNSE, CCSE, CCNP).

The service provider must be ISO/IEC 27001 certified and provide valid proof. The bidder must demonstrate quality management through defined service levels, monthly SLA reports, and adherence to security policies and baselines.

Bidders must complete the Excel Pricing Schedule (Annexure 1) and submit it with SBD 3.3. Prices must be in South African Rand and include VAT and all other costs. The tenderer must provide a detailed breakdown of the tender price, reflect service discounts, and indicate the basis of charges. No price changes will be considered after submission. The bid price must cover the entire contract duration including escalations. The bidder must pay a 2% service fee to PURCO SA on the total value of each invoice, payable within 30 days of the statement date. Interest of 2% per month applies on overdue accounts exceeding 30 days. Bidders must be in good financial standing with no negative credit listings.

Phase 1 Administrative Compliance: valid current SARS Tax PIN; current Central Supplier Database (CSD) report showing tax compliant status; completed and signed SBD forms; master bid document completed, initialled and signed in full; valid B-BBEE certificate or sworn affidavit.

Phase 2 Mandatory Requirements: bidder must be an authorised partner/reseller of the proposed firewall solution with valid OEM accreditation; minimum of three reference letters from clients for similar services within the last seven years; minimum of three CVs of security engineers with relevant experience and valid certifications; ISO/IEC 27001 certification; attendance at the compulsory briefing session. Failure to meet any of these disqualifies the bidder.

Additional requirements: minimum five years' experience delivering managed firewall services; firewall security professionals with at least five years' experience. Bidders must not be listed on the Register for Tender Defaulters or the List of Restricted Suppliers. Bidders must not be persons in the service of the state, or companies with directors who are. Bidders must be in good legal standing with no current or pending legal actions or disputes involving PURCO SA or any of its Members. Sub-contracting is limited to 25% of contract value to an enterprise with equal or higher B-BBEE status, unless the sub-contractor is an EME with the capability to execute.

The contract will be valid for 36 months from the date of award. The successful bidder must not take more than three months from award to commence, unless otherwise agreed. The service provider must maintain confidentiality of all data and information, accept professional liability for services rendered, and obtain written permission before replacing proposed individuals. The ARC retains the right to negotiate partial execution, enter into non-exclusive agreements, and require permission for personnel changes. The bidder must comply with the General Conditions of Contract and any special conditions. The ARC reserves the right to cancel the bid at any time if the service provider fails to meet requirements. The bidder must pay a 2% service fee to PURCO SA on the total value of each invoice, and must submit monthly sales reports to PURCO SA by the 10th working day of each month. The bidder must consent to the right of offset by the Membership for any outstanding amounts. Bidders must be in good financial and legal standing. The bid document takes precedence over other documents in case of dispute.

Mandatory requirements include: bidder must be an authorised partner/reseller of the proposed firewall solution with valid OEM accreditation; minimum of three reference letters from clients for similar services within the last seven years; minimum of three CVs of security engineers with relevant experience and valid certifications; ISO/IEC 27001 certification; and attendance at the compulsory briefing session. Additional requirements include minimum five years' experience delivering managed firewall services, and firewall security professionals with at least five years' experience. Administrative requirements include valid SARS Tax PIN, CSD report showing tax compliance, completed and signed SBD forms, and valid B-BBEE certificate or sworn affidavit.