Cybersecurity awareness solution supply, implementation & managed services – atns tender (national)

Closing: 09 October 2026, 11h00 CAT.

Compulsory briefing: 07 September 2026, 12h00 CAT, Microsoft Teams (compulsory attendance).

Clarification deadline: 25 September 2026, 17h00 CAT.

Queries addressed by: 02 October 2026.

Validity period: 120 days from submission.

Before bid closure: Zanele Mbiza, Specialist: Demand Management, [email protected], CC [email protected].

After bid closure: Pulane Kakumbi, Specialist: Acquisition Management, [email protected], CC [email protected].

Bidding procedure enquiries: Pulane Kakumbi/Ursula Mosibi, 011 607 1325.

Hard copy submission address: ATNS Company Limited, Eastgate Office Park, Block C, South Boulevard Road, Bruma, 2298, South Africa.

Submissions accepted online via National Treasury e-Submission (e-Tender) system or as hard copy.

Hard copy: one original, one copy, and one PDF on USB delivered to ATNS Company Limited, Eastgate Office Park, Block C, South Boulevard Road, Bruma, 2298, South Africa.

Closing date: 09 October 2026 at 11h00 CAT. Late bids are not accepted.

Submit in three parcels: Parcel A (administrative and mandatory), Parcel B (functionality), Parcel C (price and preference).

Required returnable forms (all must be completed and signed): SBD 1 (Invitation to Bid), SBD 3.3 (Pricing Schedule), SBD 4 (Declaration of Interest), SBD 6.1 (Preference Points Claim), Declaration of Interest, CSD registration, SARS TCS PIN, B-BBEE certificate or sworn affidavit, CIPC documents, shareholder certificates, ID copies.

Attendance of the compulsory online briefing on Microsoft Teams is mandatory.

Bids submitted via email will not be accepted.

Disqualification: missing any mandatory requirement, incomplete forms, or late submission.

Four-stage evaluation:

Stage 1 (Administrative): valid SARS TCS PIN and CSD registration. Non-compliance may be remedied within 7 days.

Stage 2 (Mandatory): compulsory briefing attendance, company experience (3 reference letters, past 5 years), ISO/IEC 27001 and NIST certification, support and maintenance manual, security requirements (encryption, RBAC, audit logging, POPIA). Failure = disqualification.

Stage 3 (Functionality): minimum 75 out of 100 points. Scoring: Integration (30 pts), Training Delivery Methods (24 pts), Reporting & Analytics (24 pts), Customization Capabilities (22 pts). Zero on any criterion = disqualification.

Stage 4 (Price and Preference): 80/20 system. Price 80 points, specific goals 20 points (10 for 51% Black Owned, 10 for 30% Black Woman Owned). Formula: Ps = 80(1 - (Pt - Pmin)/Pmin). Applicable to tenders up to R50 million.

The bidder must supply, implement, and provide support, maintenance, and managed services for a cloud-based cybersecurity awareness solution for 5 years.

The solution must include:

• Online training programme for all user levels (basic, intermediate, advanced, executives).
• Each course with testing, satisfactory score requirement, and certificate of completion with unique identifier per employee.
• Automated email functionality (start reminders, scheduled emails, manager escalation).
• Engaging, interactive, adaptive content.
• Active Directory integration for SSO (SAML 2.0, OAuth, Azure AD/Entra ID).
• Training modules that allow stop/restart while preserving progress.
• Phishing simulation campaigns, gamified learning, microlearning, multilingual support.
• Customizable content and branding.
• Reporting and analytics: real-time dashboards, user/group reports, risk scoring, export, compliance reports.

The solution must meet ISO/IEC 27001 and NIST Cybersecurity Framework standards.

All costs must be included in pricing, including travel, accommodation, and licensing.

The bidder must have a minimum of three contactable reference letters from clients for cybersecurity solutions completed within the past five years. Letters must be on official letterhead, signed by an authorized representative, and include contact details. Letters of appointment or contracts are not accepted. The bidder must also hold ISO/IEC 27001 and NIST Cybersecurity Framework certifications.

Each training course must include testing with a satisfactory score requirement and provide a certificate of completion with a unique identifier per employee. User Acceptance Testing (UAT) and go-live support are required as part of implementation.

Pricing must be submitted on SBD 3.3 (Pricing Schedule for Professional Services) in two sections: Section A (Implementation and Once-off costs) including project initiation, configuration, AD integration, admin training, cloud hosting setup, data migration, UAT and go-live support. Section B (Annual Subscription and Managed Services Support for five years) including training delivery, phishing campaigns, reporting, customization, cloud hosting, system support, content updates, security updates, managed services, SLA support. All prices in ZAR inclusive of VAT. The grand total is used for evaluation. The schedule must be 100% completed.

Pricing format: SBD 3.3 (Pricing Schedule for Professional Services).

Prices in South African Rand, inclusive of VAT and all applicable taxes.

Two sections: Section A (Implementation and Once-off costs) and Section B (Annual Subscription & Managed Services Support for years 1-5).

Grand total price used for evaluation under 80/20 system.

Bids must be fully completed; any missing items deemed included.

No additional charges accepted unless approved via formal variation.

Prices fixed for 120-day validity period.

No bond or guarantee specified.

Valid SARS Tax Compliance Status PIN (must remain valid for full validity period).

Registration on the National Treasury Central Supplier Database (CSD).

B-BBEE certificate or sworn affidavit (for EMEs/QSEs).

CIPC documents, shareholder certificates, and ID copies of shareholders (for specific goals claims).

Completed and signed: SBD 1, SBD 3.3, SBD 4, SBD 6.1, Declaration of Interest.

Mandatory certifications: ISO/IEC 27001 and NIST Cybersecurity Framework.

Support and maintenance manual demonstrating update management, SLA, training plans.

Security evidence: data encryption at rest and in transit (TLS 1.2+), RBAC, audit logging, POPIA compliance.

Bidding structure clarification form.

The successful bidder must accept the General Conditions of Contract (GCC) and standard terms. The contract includes a retention clause for non-satisfactory completion, confidentiality, intellectual property ownership with ATNS, and a requirement for professional indemnity insurance. ATNS may cancel or postpone the procurement at any stage. The contract will only be concluded when signed by both parties. Bidders must warrant they can perform to ATNS's satisfaction.

The evaluation process has four stages. Stage 1 (Administrative): valid SARS TCS PIN and CSD registration. Stage 2 (Mandatory): compulsory briefing attendance, company experience (3 reference letters, past 5 years), ISO/IEC 27001 and NIST certification, support and maintenance manual, security requirements. Stage 3 (Functionality): minimum 75/100 points, scored on Integration (30), Training Delivery Methods (24), Reporting & Analytics (24), Customization Capabilities (22). Zero on any criterion is disqualifying. Stage 4 (Price and Preference): 80/20 system, price 80 points, specific goals (51% Black Owned: 10 points, 30% Black Woman Owned: 10 points).