Cloud-based privilege access management (pam) solution implementation – 3-Year contract

TCTA seeks to appoint a service provider to implement a cloud-based Privileged Access Management (PAM) solution for a period of three (3) years. The solution must strengthen identity-centric security controls, reduce privileged access risks, and enhance cyber resilience in alignment with NIST CSF, ISO/IEC 27001, POPIA, and PFMA requirements. The scope includes design, implementation, configuration, integration, and support of the solution across TCTA's ICT environment.

Briefing session — non-compulsory, online via Microsoft Teams on 14 September 2026 @11h00. Preregistration required by email to [email protected]; registration deadline 11 September 2026 @16h00.

Clarifications deadline — 25 September 2026 @11h00. Queries must be directed to the named contact, stating the bid number, at least 5 business days before closing.

Gate access code request deadline — 09 October 2026 @11h00 (Annexure I to [email protected]).

Closing date and time — 12 October 2026 @11h00.

Bid validity — 120 calendar days from closing date.

Briefing session — non-compulsory, online via Microsoft Teams on 14 September 2026 @11h00. Preregistration required by email to [email protected] to receive the invite. Registration deadline: 11 September 2026 @16h00.

Enquiries — Itumeleng Matjie, email [email protected]. No phone number provided. All queries must state the bid number in the subject field and be directed only to this contact.

Submission method — deliver 1 physical original hard copy in English and 1 electronic copy on an unencrypted USB in PDF format. The USB content must be identical to the original; in any discrepancy TCTA relies on the physical original.

Address — 1st Floor, Building No. 9, Byls Bridge Office Park, 11 Byls Bridge Boulevard, Cnr Olievenhoutbosch Road and Jean Avenue, Highveld Extension 73, Centurion, 0157. Deliver during office hours 08:00–16:30.

Gate access — bidders must have a scannable valid ID, driver's licence or passport, and must allow sufficient time for vetting at the main entrance. A completed Request for Gate Access Code (Annexure I) must be sent to [email protected] by 09 October 2026 @11h00.

Packaging — the outer packaging must clearly reflect the bid description and bid number.

Late bids — TCTA will not accept bids after the closing date and time, even if the delay is beyond the bidder's control.

Returnable forms — all must be completed, signed and submitted: SBD 1 (Invitation to Bid), SBD 4 (Bidder's Disclosure), SBD 6.1 (Preference Points Claim), proof of CSD registration, valid B-BBEE certificate or sworn affidavit (Annexure F), Annexure G (Pricing Schedule), Annexure A or reference letters (company experience), Annexure B (key personnel), and organisational certifications (ISO/IEC 27001 and OEM accreditation). Missing mandatory documents lead to disqualification.

Returnable documents include: Company experience (Annexure A or reference letters), Organisational certifications (ISO/IEC 27001, OEM accreditation), PAM Technical Lead certifications, PAM Project Team Lead certification, Key Personnel Experience (Annexure B), Standard National Treasury Bidding Documents (SBD1, SBD4, SBD6.1), proof of CSD registration, valid B-BBEE certificate or sworn affidavit (Annexure F), and Annexure G Pricing Schedule. Mandatory documents must be submitted; non-mandatory linked to evaluation criteria may affect points.

Evaluation has 5 stages: Stage 1 Returnables, Stage 2 Functionality, Stage 3 Specific Goals, Stage 4 Price, Stage 5 Supplier Vetting.

Stage 1 — Returnables: mandatory documents must be submitted; failure disqualifies. Non-mandatory documents linked to evaluation criteria earn no points if missing.

Stage 2 — Functionality (max 70 points, minimum 40 required to proceed):

• Company track record (30 points): minimum 3 cloud-based enterprise PAM implementation projects in the last 7 years. Scoring: 3–4 projects = 20, 5–6 = 25, 7+ = 30.
• Key personnel experience – PAM Technical Lead (20 points): must have led at least 3 enterprise PAM implementations in the last 7 years. Scoring: 3 = 10, 4–5 = 15, 6+ = 20.
• Key personnel certification – PAM Technical Lead (20 points): at least 2 current certifications from CISSP, CISM, CIAM, Microsoft Identity and Access Administrator Associate, vendor-specific PAM. Scoring: 2 = 10, 3–4 = 15, 5+ = 20.

Stage 3 — Specific Goals (B-BBEE points out of 20): Level 1 = 20, 2 = 18, 3 = 14, 4 = 12, 5 = 8, 6 = 6, 7 = 4, 8 = 2, non-compliant = 0.

Stage 4 — Price (80 points): 80/20 preference point system per PPPFA. Price must be market-related; TCTA may not award to the highest scoring bidder if price is not market-related.

Stage 5 — Supplier Vetting: TCTA may disqualify bidders who submit fraudulent information, are on National Treasury's blacklist, pose a vetting risk, have directors/shareholders employed by an organ of state (unless authorised), or have tax affairs not in order.

Scope — design, implement, configure, integrate and support a cloud-based enterprise-grade Privileged Access Management (PAM) solution with 100 licenses across TCTA's ICT environment (on-premises, cloud, hybrid).

Hosting — services to be hosted at the service provider's own premises or cloud infrastructure.

Functional requirements — user management (onboarding, discovery, lifecycle, shared/break-glass accounts), role-based access control (least privilege, segregation of duties), access request and approval workflows (JIT/JEA), password and credential management (vaulting, rotation, SSH/API keys), privileged session management (monitoring, recording, playback), audit and compliance (tamper-proof logs, ISO 27001/POPIA reporting), integration with IAM (Active Directory, Azure AD, MFA, SSO, SIEM), cloud and on-premises integration (Microsoft 365, Azure, Windows, Linux, network devices), reporting and analytics (dashboards, risk-based analytics).

Training — comprehensive administrator training and knowledge transfer to 10 designated TCTA officials, including training materials, SOPs, technical documentation and user guides.

Support — 3 years post-implementation support and maintenance, 300 support hours total (100 per year), software updates, security patches, version upgrades, and adherence to SLAs for incident response and system availability.

Deliverables — planning artifacts (implementation plan, architecture approved by TCTA Enterprise Architecture Committee, discovery report), executive summary, detailed technical implementation report, operational documentation (manuals, SOPs, incident response, UAT results), post-implementation review, and structured skills transfer.

Implementation approach — the service provider must present a solution architecture for approval by the TCTA Enterprise Architecture Committee, and adopt a pilot implementation and phased rollout approach.

Planning artifacts — kick-off meeting minutes, detailed implementation plan (scope, objectives, timelines, milestones, resource allocation, communication plan, risk management), privileged account discovery and baseline assessment report, implementation methodology and rollout strategy, risk register and change management approach.

Deliverables — executive summary (management-ready), detailed technical implementation report (configuration, RBAC model, credential vaulting, JIT, session monitoring, integrations, security hardening, remediation), operational documentation (manuals, SOPs, incident response, UAT results), post-implementation review, and structured skills transfer.

Skills transfer — structured "over-the-shoulder" knowledge transfer, hands-on training sessions, practical how-to sessions on privileged access lifecycle, monitoring, troubleshooting, backup and maintenance, and formal knowledge transfer workshops.

Company experience — minimum 3 contactable signed client references on official letterhead for cloud-based PAM implementation projects completed within the past 7 years. References must cover hybrid ICT environments, privileged identity governance, credential vaulting, session monitoring, and IAM/Security Operations integration. References must include client name, project description, technologies implemented, contract start and end dates (MMYYYY), client contact person and number/email, and signature by an authorised client representative. Alternatively, Annexure A may be completed.

PAM Technical Lead — must hold at least 2 current certifications from CISSP, CISM, CIAM, Microsoft Identity and Access Administrator Associate, or vendor-specific PAM. Must have minimum 7 years' experience in PAM implementations, proven experience leading enterprise PAM deployments, and experience integrating with Active Directory, Azure AD, cloud platforms, and enterprise systems.

Project Team Lead — must hold a recognised project management certification (PMP, PRINCE2 Practitioner, AgilePM or equivalent), minimum 7 years' experience managing enterprise PAM projects, demonstrated experience in scope, timeline, risk, dependency and budget management, knowledge of cybersecurity governance and compliance, experience coordinating cross-functional teams, and ability to report to executive management.

All certifications must be valid (current, not expired, suspended or revoked) and verifiable with the issuing accredited body.

Quality deliverables — the service provider must produce comprehensive, structured, and audit-ready deliverables aligned with TCTA's cybersecurity governance, audit, and compliance requirements.

Documentation — administrator and end-user operational manuals, SOPs for privileged access management, incident response procedures, system handover documentation, and operational support guide.

Testing — User Acceptance Testing (UAT) plan and test results, system performance and functionality validation reports.

Post-implementation — post-implementation review report, maintenance and support plan with defined SLAs, patch management and upgrade roadmap, and continuous improvement recommendations.

Compliance — compliance reporting aligned with ISO 27001 and POPIA; tamper-proof logging and secure log storage.

Annexure G (Pricing Schedule) must be submitted. Prices must be firm, unconditional, include all costs, and be reflected excluding and including VAT. The pricing schedule must clearly indicate the hourly rate and total cost for each of the three years of support (100 hours per year). Price evaluation uses the 80/20 preference point system per PPPFA.

Pricing schedule — Annexure G must be completed and submitted. Prices must be firm, unconditional, include all costs, and be reflected excluding and including VAT.

Support hours — the pricing schedule must clearly indicate the hourly rate and total cost for each of the three years (100 hours per year).

Price evaluation — 80/20 preference point system per PPPFA; price points out of 80, specific goals out of 20. The lowest acceptable tender determines the applicable system.

Market-related price — TCTA may not award to the highest scoring bidder if the price is not market-related.

Validity — bid must remain valid for 120 calendar days from closing. If validity is extended, price adjustments must align with CPI or a recognised industry pricing guide.

CSD registration — proof of registration on the National Treasury Central Supplier Database (CSD) is mandatory.

B-BBEE — valid B-BBEE certificate issued by a SANAS-accredited agency. EMEs/QSEs may submit a validly commissioned sworn affidavit meeting Annexure F requirements; QSEs not meeting level 1 or 51% black ownership thresholds must obtain a SANAS-accredited certificate. Joint ventures must submit a consolidated B-BBEE certificate.

Organisational certifications — ISO/IEC 27001 (Information Security Management) and a letter of accreditation from the OEM, reseller, or evidence of accreditation as a partner of the solution (or evidence of solution ownership if OEM).

Key personnel certifications — PAM Technical Lead must hold at least 2 current certifications from CISSP, CISM, CIAM, Microsoft Identity and Access Administrator Associate, or vendor-specific PAM. Project Team Lead must hold PMP, PRINCE2 Practitioner, or AgilePM (or equivalent). All certifications must be valid and verifiable.

Tax status — tax affairs must be in order at the time of award; non-compliance with SARS must be resolved within the prescribed period.

Supplier vetting — bidders must not be on National Treasury's blacklist, must not submit fraudulent information, and must not have directors/shareholders employed by an organ of state unless authorised by a letter from the executive authority.

Returnable forms — SBD 1, SBD 4, SBD 6.1, Annexure A (company experience), Annexure B (key personnel), Annexure F (sworn affidavit requirements), Annexure G (pricing schedule), Annexure I (tender receiving form).

Specific goals — B-BBEE status level points: Level 1 = 20, 2 = 18, 3 = 14, 4 = 12, 5 = 8, 6 = 6, 7 = 4, 8 = 2, non-compliant = 0. Joint ventures or consortia must submit a consolidated B-BBEE certificate to earn points. All B-BBEE certificates must be from SANAS-accredited agencies unless the bidder is an EME or QSE, in which case a validly commissioned affidavit per Annexure F is accepted. QSEs not meeting level 1 or 51% black ownership thresholds must obtain a SANAS-accredited certificate.

Compliance — suppliers must comply with all applicable environmental laws and regulations regarding hazardous materials, air emissions, waste and wastewater discharges, including manufacture, transportation, storage, disposal and release to the environment.

Contract duration — three (3) years.

Costs of bidding — bidders bear all costs of preparing and submitting bids; TCTA is not liable for any costs incurred.

Clarifications — all queries must be directed to the named contact, stating the bid number, at least 5 business days before closing. TCTA may request completion of annexures within 5 working days; failure may lead to disqualification.

Amendments — TCTA may amend terms or add requirements, published on its website at least 10 business days before closing.

Bid withdrawal/modification — allowed before closing; after closing no changes permitted. Amendments must be marked "Amendment to Bid" on the envelope.

Validity — bids must remain valid for 120 calendar days; extension requests are deemed accepted if no response; rejection of extension is treated as withdrawal.

POPI — by participating, bidders consent to TCTA processing and potentially disclosing personal information as described in the disclaimer.

Conflicts of interest — bidders must avoid conflicts with prior or current obligations; TCTA may disqualify bidders with conflicting assignments.

Joint ventures/consortia — encouraged; must have a written agreement covering contributions, percentage participation, management, dispute resolution, and must submit a consolidated B-BBEE certificate annually.

Award — a preliminary contract is deemed concluded upon Letter of Award; terms of the attached agreement are non-negotiable. TCTA may cancel the award if consensus on final terms is not reached.

Subcontracting — requires prior written approval; subcontracting to third parties limited to less than 25% of the contract value, and subcontractors must have B-BBEE status equal to or higher than the bidder.

Prohibited practices — bribery, corrupt practices, and fronting are prohibited; TCTA may conduct probity investigations.

Supplier code of conduct — suppliers must comply with antitrust and fair competition laws, environmental laws, and record-keeping requirements.

Special conditions — bidders must submit 1 physical original copy and 1 electronic copy on an unencrypted USB in PDF format. Bids must be delivered to the specified address before the closing date and time. Late submissions are not accepted. Bidders must allow time for the gate vetting process and must have a valid ID, driver's licence or passport for scanning at the entrance. A completed Request for Gate Access Code (Annexure I) must be sent to [email protected] by 09 October 2026 @11h00.

Evaluation has 5 stages: Stage 1 Returnables, Stage 2 Functionality (max 70 points, minimum 40 required), Stage 3 Specific Goals (B-BBEE points out of 20), Stage 4 Price (80/20 preference point system), Stage 5 Supplier Vetting. Functional criteria: company track record (30 points), key personnel experience (20 points), key personnel certification (20 points). Price evaluation uses PPPFA formula, with 80 points for price and 20 for specific goals.