Ctf challenges for sanren cyber security challenge 2026/27

This RFP is for the procurement of Capture the Flag (CTF) challenges for the SANReN Cyber Security Challenge 2026/27. The service includes all requirements in Annexure B. The National Integrated Cyber Infrastructure System (NICIS) hosts the CHPC National Conference annually. SANReN hosts its Cyber Security Challenge (CSC) for tertiary students as a parallel event. The competition has two rounds: an online Qualification Round (March to September) and an in-person Final Round at the CHPC National Conference (end November/start December).

Closing date: Friday, 04 September 2026 at 16:30 (South African standard time).

Non-compulsory briefing: Friday, 28 August 2026, 11:00 – 12:30, via MS Teams.

Last date for enquiries/clarifications: Wednesday, 02 September 2026 at 16:30.

All submissions and enquiries: [email protected].

Procurement Unit.

Use RFP number and description as subject reference.

CSIR business hours: 08:00 – 16:30, Monday to Friday.

No other contact with CSIR personnel is permitted during the RFP process.

Submit proposals electronically to [email protected]. Use the RFP number and description as the email subject. Send Technical Proposal and Pricing Proposal in two separate emails. Do not use cloud solutions (WeTransfer, Google Drive, Dropbox). Late proposals or those sent to the wrong address will not be considered. Proposals must be signed by an authorised person.

Returnable forms (all must be completed and signed):

• SBD 1 (Invitation to Bid): bidder contact details and declaration.
• SBD 4 (Declaration of Interest): discloses connections to the state.
• Annexure E (Proposal Form and List of Returnable Documents): mandatory returnable documents table.
• Annexure F (Certificate of Acquaintance with RFP): confirms bidder has read and understood the RFP.
• Annexure G (Preference Points Award Form): claims B-BBEE points.
• Annexure H (SBD 4 Form): duplicate declaration.
• Annexure I (RFP Declaration and Breach of Law Form).
• Annexure J (Mutual Non-Disclosure Agreement).
• Annexure K (Mutual NDA Form).
• Annexure C1 (Technical Evaluation Matrix): completed separately in PDF/Excel.
• Sample challenges with solutions (2 hard, 2 medium, 2 easy) submitted separately.
• If sub-contracting/joint venture/consortium: signed agreement specifying roles, technical support responsibility, error correction, and risk mitigation or joint liability.
• Company profile and portfolio of evidence with signed reference letters.
• Completed Pricing Schedule (Annexure D) on letterhead.
• CSD registration report (RSA suppliers only).

Disqualification risks: any missing or unsigned mandatory returnable document, late submission, submission to incorrect email, counter conditions, or failure to comply with any term.

Mandatory returnable documents as per Annexure E. Technical Proposal must include: company profile, portfolio of evidence confirming past experience developing and providing CTF challenges (including signed reference letters for at least one event, three or more preferred), technical proposal with details supporting compliance with evaluation criteria, completed Technical Evaluation Matrix (Annexure C1) in PDF and/or Excel, six sample challenges with solutions (2 hard, 2 medium, 2 easy) submitted separately, and if applicable, a legally valid and signed sub-contracting/joint venture/consortium agreement specifying required items (identification, scope of work, roles, technical support responsibility, error correction responsibility, risk mitigation or joint liability). Financial Proposal must include completed Pricing Schedule (Annexure D) on letterhead and CSD registration report (RSA suppliers only).

Three-phase evaluation:

• Phase 1 (Elimination): late bids, incorrect location, NT restricted/defaulters, missing mandatory documents.
• Phase 2 (Technical/Functional): 17 criteria totalling 100%, minimum 80% overall and 50% per criterion.
• Phase 3 (Price and Preference): 80 points price, 20 points preference.

CSIR may award to a non-highest scorer per PPPFA Section 2(1)(f) if no fraud/illegal conduct charges.

Scope: supply of Capture the Flag (CTF) challenges for the SANReN Cyber Security Challenge 2026/27, hosted on a CTFd platform.

Total challenges required: 64 (24 for the 2026 Final, 40 for the 2027 Qualification round).

Challenge categories: must cover at least 6 of: Web Exploitation, Cryptography, Forensics, Reverse Engineering, OSINT, Network Analysis, Binary Exploitation, Mobile Security, Steganography, Vulnerability Assessment.

Difficulty levels: Easy, Medium, Hard. Distribution: Qualification – 24 Easy, 8 Medium, 8 Hard; Final – 12 Easy, 6 Medium, 6 Hard.

Bespoke challenges: 4 of the 6 Medium and 2 of the 6 Hard challenges for the Final must be new (not previously used).

Bidder must resolve any errors in delivered challenges at no further cost.

No licensing of CTF challenges from third parties is allowed.

Supply of problem statements for hackathons will not be considered.

Proposals must be structured as two parts: Technical Proposal and Pricing Proposal, submitted in separate emails. Technical Proposal must include company profile, portfolio of evidence, technical proposal, completed Technical Evaluation Matrix (Annexure C1), sample challenges, and any required agreements. Pricing Proposal must include completed Pricing Schedule (Annexure D) on letterhead and CSD registration report.

Bidders must submit a portfolio of evidence showing past experience provisioning CTF challenges for events, including dates, number and categories of challenges. Signed reference letters from event organisers are required for at least one event (three or more preferred). For sub-contracting/JV/consortium, reference letters confirming past collaboration between parties are required. Supply of problem statements for hackathons will not be considered.

CSIR may conduct inspections or audits of the bidder's compliance with POPI Act safeguards. No other quality management or QA/QC requirements stated.

Pricing must be submitted on Annexure D (Pricing Schedule/Bill of Quantities) on official company letterhead. Pricing must be in South African Rand including all taxes and unconditional discounts. Prices subject to escalation or exchange rate fluctuations must be clearly indicated. Price must include travel, freight, insurance, duty where applicable. Payment according to CSIR Payment Terms and Conditions.

Pricing in South African Rand, including all taxes and unconditional discounts.

Prices subject to escalation or exchange rate fluctuations must be clearly indicated with currency and rate.

Price must include travel, freight, insurance, duty where applicable.

Payment according to CSIR Payment Terms and Conditions.

Pricing must be submitted on Annexure D (Pricing Schedule/Bill of Quantities) on official company letterhead.

No bond or guarantee percentage stated.

CSD registration: mandatory for RSA suppliers; provide CSD registration number. Foreign suppliers with no local entity need not register.

Tax compliance: bidders must be tax compliant. Provide SARS Tax Compliance Status PIN or TCS certificate. Non-compliant bidders have 7 working days to provide proof of compliance or arrangement.

B-BBEE: preference points claimed via Annexure G. Joint ventures must submit a consolidated B-BBEE scorecard.

No tender will be awarded to bidders on the NT Register of Tender Defaulters or List of Restricted Suppliers.

Joint ventures/consortia: must submit signed agreement, valid B-BBEE certificate, TCS/CSD report for each partner, proof of ownership, and company registration certificates.

No specific CIDB grade, CIPC registration, or professional-body registration required.

Contract will be a Service Level Agreement (SLA) concluded after award. Bidders must comment on draft Service Level Indicators using track changes. CSIR may accept or reject amendments. Misrepresentation may lead to termination and damages. CSIR may terminate if funds are unavailable, paying for services delivered up to cancellation. South African law governs the contract. Bidders must comply with POPI Act for personal information. No goods/services delivered without a CSIR purchase order.

CSIR reserves the right to: extend closing date, correct mistakes, verify submissions, request documentary proof, carry out site inspections/product evaluations, award to a bidder not scoring highest per PPPFA Section 2(1)(f), request audited financial statements, award in whole or part, award to multiple bidders, cancel/terminate the process at any stage, post-tender negotiate, and not award to a bidder associated with a security breach or whose directors are charged with fraud/illegal conduct.

Bidders must self-register on National Treasury's Central Supplier Database (CSD) and provide the CSD registration number. Bidders must not be listed on the NT database of restricted suppliers or the NT Register of Tender Defaulters. Bidders must be tax compliant. Joint ventures/consortia must submit signed agreements, B-BBEE certificates, TCS/CSD reports, proof of ownership, and company registration certificates.

All submissions and enquiries: [email protected]. Procurement Unit. Use RFP number and description as subject reference. Last date for enquiries/clarifications: Wednesday, 02 September 2026 at 16:30. CSIR business hours: 08:00 – 16:30.