Threat detection and response services – road accident fund tender (gauteng)

{"closingDate":"09 OCTOBER 2026","closingTime":"11:00 AM","briefingSession":"{"date":"22 SEPTEMBER 2026","time":"11:00 AM","venue":"E AND TIME: 22 SEPTEMBER 2026","is_compulsory":true}"}

NON-COMPULSORY BRIEFING SESSION DATE AND TIME: 22 SEPTEMBER 2026 @ 11:00 AM. A NON-COMPULSORY BRIEFING SESSION WILL BE HELD ON TEAMS: https://teams.microsoft.com/meet/351818207347668?p=8tu6wsXapZXCYCYNSL

{"name":"Mr Elias","email":"[email protected]","phone":null,"department":"of Trade and Industry (dti) is","address":"All enquiries regarding this bid must be directed to the Supply Chain Management Office"}

Returnable Documents: SBD 1: Completed, attached and signed, SBD 4: Completed, attached and signed, SBD 6.1: Completed, attached and signed, Proof of Construction Industry Development Board (CIDB), Provide Tax TCS Pin to verify Tax Status: Attached, involved, each party must submit a separate Tax TCS Pin.), Registered on the Central Supplier Database of National, https://secure.csd.gov.za/),

• That the bidder/s is/ are registered on the National Treasury Central Supplier, Database (CSD)

Bidders must be registered on the National Treasury Central Supplier Database (CSD). Bidders must be tax compliant with SARS; if non-compliant, they will be allowed seven working days to rectify before disqualification. Bidders must submit a SARS Tax Compliance Status (TCS) PIN or CSD number. Bidders must complete and sign all required Standard Bidding Documents (SBD forms): SBD 1 (Invitation to Bid), SBD 3.1/3.2/3.3 (Pricing Schedule), SBD 4 (Declaration of Interest), SBD 5 (National Industrial Participation Programme), SBD 6.1 (Preference Points Claim Form). Bidders must provide proof of authority to sign (e.g., company resolution). Bidders must not be persons in the service of the state, nor have directors who are. Bidders listed on the National Treasury register of Restricted Suppliers or Tender Defaulters will be automatically disqualified. Bidders must have a business continuity management plan available for inspection. Bidders must have Professional Indemnity cover including privacy breach and cyber liability extensions. Bidders must not transfer, store, or process RAF information outside South Africa without prior written approval. Bidders must permit RAF audits of information processing. Bidders must implement Privacy by Design and Privacy by Default principles. Bidders must protect electronically stored information with encryption, authentication, logging, and monitoring. Bidders must submit a joint venture agreement if applicable. Bidders must provide a Tax TCS Pin for each party in a consortium/joint venture/sub-contractor arrangement.

Procurement of a threat detection and response services for the raf for a period of

Five (5) years.

The service must provide: full management of the SIEM architecture (excluding licensing costs); onboarding of new data sources (Syslog, API, Cloud logs, Agents); health monitoring of data connectors and log ingestion pipelines to ensure no visibility gaps; continuous optimisation and tuning of detection rules to reduce alert fatigue; mapping of all detection use cases to the MITRE ATT&CK Framework; custom rule creation based on emerging threats specific to the South African government and insurance sectors; execution of Incident Response (IR) playbooks for containment and eradication; implementation and management of SOAR (Security Orchestration, Automation, and Response) to automate repetitive tasks (blocking IPs, isolating compromised endpoints); deep-dive forensic analysis for high-criticality incidents; incident triage and analysis to build capability; incident containment and remediation; active response & lockdown with pre-approved actions; root cause analysis (RCA) post-incident; integration of global threat intelligence feeds; threat hunting using advanced security technologies and techniques; threat response design of manual, semi-automated and automated responses; service migration with a structured 30-to-60-day transition plan, knowledge transfer, migration of custom workbooks/dashboards, validation of alerting logic; enterprise integration for seamless data sharing, workflows, single sign-on, and centralised management; and comprehensive reporting with metrics such as MTTD and MTTR and dashboards.

all foreigners who may have had accidents within the borders of the country. The RAF head

office is located in Centurion, Pretoria; with Customer Experience Centres situated in each

province around the country.

2.1. The bidder/s must be an eligible, registered service provider/s in terms of the applicable laws

of the country.

2.2. The bidder/s must have a business continuity management plan, which must be available for

inspection by the RAF during the subsistence of rendering services to the RAF.

2.3. The Evaluation Criteria that are published with this Request for Proposal/ Bids will be used to

assess bidders’ responses and no amendment shall be made after the closing date of a bid.

include:

• Project initiation and planning, including a detailed implementation plan and project

schedule.

• Configuration and optimisation of the solution in alignment with RAF’s threat

landscape and threat management requirements.

• Integration with RAF ICT systems, including but not limited to:

▪ Microsoft Entra ID (Azure AD)

▪ RAF Security Logging data sources

▪ Identity and Access Management (IAM) and Privileged Access Management

(PAM) systems

▪ Configuration of TDR data sources, data collection rules and data retention

policies

▪ Implementation of TDR use cases and automated response workflows

▪ Testing, including User Acceptance Testing (UAT).

▪ Go-live support and hyper-care support for a defined stabilisation period

(minimum period to be proposed by bidder).

• The bidder must clearly define:

▪ Implementation duration

▪ Key deliverables

▪ Resource allocation

▪ Project governance structure

4.15.2.2 Post Implementation professional services

The bidder is expected to provide 24/7/365 managed TDR services; these professional

services may include:

• Advanced configuration changes.
• Threat management detection, response and containment workflow enhancements.
• Integration enhancements.
• Performance tuning to ensure acceptable system responsiveness under normal

operational load.

• Cost optimisation
• Technical troubleshooting beyond standard Software as a Service (SaaS) support.
• Threat management and related Advisory workshops.
• Platform optimisation sessions.
• Security configuration adjustments.
• Reporting configuration.

4.15.3 Training and Onboarding

https://teams.microsoft.com/meet/351818207347668?p=8tu6wsXapZXCYCYNSL

Closing date: 09 october 2026 @ 11h00 AM

Note: Faxed and/or Emailed Proposals/ bids will not be accepted, only hand delivered and

couriered Proposals/ bids must be deposited in the tender box on or before the closing date and

time.

Table of contents for bid RAF/2026/00059

1. Part a: invitation to bid

2. Part b: terms and conditions for bidding

3. Sbd 3.3: Pricing schedule (professional services)

4. Sbd 4: declaration of interest

5. Sbd 5: national industrial participation programme

6. Sbd 6.1: Preference points claim form

The service of the state.”

Nb: failure to provide / or comply with any of the above particulars may render the bid invalid.

Signature of bidder:...................................................

Capacity under which this bid is signed:...................................................

(Proof of authority must be submitted e.g. company resolution)

Sbd 3.1

Pricing schedule – firm prices

(Purchases)

Note: only firm prices will be accepted. Non-firm prices (including prices subject

To rates of exchange variations) will not be considered

Bid Bond: performance guarantee to the dti;

d. The contractor will submit a business concept for consideration and approval by

the dti;

e. Upon approval of the business concept by the dti, the contractor will submit

detailed business plans outlining the business concepts;

f. The contractor will implement the business plans;

Cybersecurity

• Continuous monitoring of all security alerts Monitoring and Triage generated by the in-house (RAF-Owned) Microsoft Sentinel SIEM.

Initial triage to filter false positives and escalate "True Positive" incidents.

Contextualised alerting based on RAF’s business risk and asset criticality.

Real-time monitoring and threat detection of the RAF’s on-premises and cloud-based systems, applications, and infrastructure. All incidents must be promptly identified, escalated, and addressed.

Monitoring the RAF’s environment, including cloud services (AWS, Azure, and Oracle cloud) and on-premises for potential security incidents and unauthorized activity.

Log Management: the SOC should be able to collect and retain logs from multiple systems and generate reports that can be used to provide a holistic view of the environment.

Threat Intelligence Integration: integrate global threat intelligence feeds to detect and respond Category Description Indicate the section of the proposal that addresses this to emerging threats proactively. The service must provide

Full management of the SIEM architecture (excluding licensing costs). SIEM Engineering &

Onboarding of new data sources (Syslog, API, Data Onboarding Cloud logs, Agents).

Health monitoring of data connectors and log ingestion pipelines to ensure no visibility gaps. Detection Engineering & The service must provide: Tuning

• Continuous optimisation and tuning of detection rules to reduce "alert fatigue."

Mapping of all detection use cases to the MITRE ATT&CK Framework.

Custom rule creation based on emerging threats specific to the South African government and insurance sectors.

Leveraging open-source detection use cases such as Sigma. The service must provide

Execution of Incident Response (IR) playbooks for containment and eradication. Incident Response &

Implementation and management of SOAR SOAR Automation (Security Orchestration, Automation, and Response) to automate repetitive tasks (e.g., blocking IPs, isolating compromised endpoints).

Deep-dive forensic analysis for high-criticality incidents.

Incident Triage and Analysis: prompt triage and analyse security incidents in the environment to Category Description Indicate the section of the proposal that addresses this determine severity, scope, and impact.

Incident Containment and Remediation: contain and remediate security incidents in the environment to minimise their impact and duration, including the execution of Incident Response (IR) playbooks for containment and eradication.

Communication and Coordination: communicate and coordinate with internal and external stakeholders to resolve security incidents and address security risks.

Active Response & Lockdown: In the event of a confirmed breach (like the current stolen access information), the service provider should have the authority to isolate infected machines or lock compromised accounts immediately, through pre-approved TDR actions and operating models.

Root Cause Analysis (RCA): Post-incident investigations to determine how the breach occurred and how to harden the system against future occurrences.

Crisis Management Support: Access to a dedicated Incident Response team for large- scale events. Threat Hunting The service must

Use advanced security technologies and techniques to conduct ongoing threat hunting activities to identify and mitigate potential security threats in the environment. Category Description Indicate the section of the proposal that addresses this

Provide ongoing threat intelligence and analysis to inform the RAF’s security posture and decision-making processes.

Manage Threats: Integrate the RAF’s cybersecurity solutions to automate responses to identified threats that pose risks to the RAF environment. Threat Response The service must

Provide design of implementation of manual, semi-automated and automated responses and recovery actions to detected threats and cyberattacks.

Activate incident response plans in the event of cybersecurity incidents. Service Migration The service must include

A structured 30-to-60-day transition plan from the current service provider.

Knowledge transfer, migration of existing custom workbooks/dashboards, and validation of current alerting logic. Enterprise Integration The service must

Cater for threat intelligence integration, to allow for seamless and automated data sharing between the existing security tools and the TDR platform, thus eliminating manual processes and reducing the risk of human error.

Points Allocation: 3 points

B-BBEE Details: Postal address

..........................................................................................

....................................................................................

Signature.....................................Name (in print)...................................

Date..................................................

Sbd 6.1

Preference points claim form in terms of the preferential procurement

Regulations 2022

This preference form must form part of all tenders invited. It contains general information and serves

as a claim form for preference points for specific goals.

Nb: before completing this form, tenderers must study the general

Conditions, definitions and directives applicable in respect of the

Tender and preferential procurement regulations, 2022

1. General conditions

1.1 The following preference point systems are applicable to invitations to tender:

• the 80/20 system for requirements with a Rand value of up to R50 000 000 (all

applicable taxes included); and

• the 90/10 system for requirements with a Rand value above R50 000 000 (all

applicable taxes included).

1.2 To be completed by the organ of state

(delete whichever is not applicable for this tender).

a) The applicable preference point system for this tender is the 80/20 or 90/10 preference

point system.

1.3 Points for this tender (even in the case of a tender for income-generating contracts) shall be

awarded for:

(a) Price; and

(b) Specific Goals.

1.4 To be completed by the organ of state:

The maximum points for this tender are allocated as follows:

Points points

Price 80 90

Specific goals 20 10

Total points for Price and SPECIFIC GOALS 100 100

1.5 Failure on the part of a tenderer to submit proof or documentation required in

The SOC command centre premises must meet the following requirements: Access Controlled - minimum: Fingerprint or Token/Card Access control; Power Failure Backup - backup power restored within a minute; Business Continuity Plan; Fire Detection System - certificate of compliance and certificate of service not older than 1 year from the date of the site visit.

The service provider/s agrees to indemnify and hold the Fund harmless from and against any claims, losses, damages, or expenses incurred as a result of any breach arising out of or attributable to the service provider’s negligent acts or omissions.

The bidder/s must be an eligible, registered service provider/s in terms of the applicable laws of the country. The bidder/s must have a business continuity management plan, which must be available for inspection by the RAF during the subsistence of rendering services to the RAF. Companies or Directors included on the National Treasury register of Restricted Suppliers and/or Tender Defaulters will be automatically disqualified from the bidding process. As prescribed all Standard Bidding Documents (SBD Forms – Returnable Documents) must be fully completed and duly signed. All Returnable Documents must be submitted with the proposal on the closing date of the bid. The RAF will confirm the following prior to any award being made: that the bidder/s is/are registered on the National Treasury Central Supplier Database (CSD); the bidder’s tax status is compliant with the South African Revenue Service (SARS), in cases where the recommended bidder/s is/are non-compliant with SARS, the bidder/s will be allowed seven (7) working days to rectify their tax matters, if the bidder/s fails to rectify their tax matters, they will be disqualified once the 7th working day period lapses. The bidder/s shall have Professional Indemnity cover, which must be available prior to the award, which shall extend to include Privacy breach and cyber liability (extension/endorsement). The Bidder/s must implement or consider the principles of Privacy by Design and Privacy by Default when reviewing, redesigning and recommending business processes. The Bidder/s must ensure that all information stored electronically is protected through appropriate encryption, authentication, logging and monitoring controls where applicable. The Bidder/s must not transfer, store or process RAF information outside the Republic of South Africa without the RAF's prior written approval and compliance with applicable legal requirements. The Bidder/s must permit the RAF, or its authorised representatives, to conduct privacy, information security and compliance assessments or audits relating to the processing of RAF information.

The document includes a cross-referencing matrix that maps proposal sections to requirements, but it is noted that this matrix does not form part of the evaluation and will not be scored independently. The evaluation will consider the completeness and signing of all required SBD forms. The preference point system (80/20 or 90/10) may apply, but the specific system is not stated in the document.