Implementation and support of a network detection and response (ndr) solution – 3-Year contract (sasria)

{"closingDate":"28 September 2026","closingTime":"12h00","briefingSession":"{"date":null,"time":null,"venue":"bidder’s offices and / or at client sites if so required.","is_compulsory":false}"}

No briefing session or site visit is mentioned in the document.

Bidders must submit: Schedule 1: Executive Summary and Annexure B (duly completed and signed). Schedule 2: All documents listed in Part 6 (duly completed and signed), including CSD report, valid B-BBEE certificate or sworn affidavit, and specific goal submission requirements (consortium/JV agreement, subcontracting agreement, or individual bidder certificate). Schedule 3: Technical Proposal in line with Technical Evaluation Criteria. Schedule 4: Financial/Price Proposal. Required documents include SBD 1, SBD 4, SBD 6.1, Annexure A (Confidentiality and Non-disclosure Agreement), Annexure B (Acceptance of Bid Conditions), Annexure C (Shareholder Information), Annexure D (Bidder's Experience and Proposed Project Team). Failure to provide any required document may lead to immediate disqualification.

Bidders must be registered on the CSD (Central Supplier Database) and be tax compliant with SARS. They must submit a valid B-BBEE certificate or sworn affidavit (or specialised entity affidavit) as applicable. Failure to submit any required document (Annexures A-D, SBD 1, SBD 4, SBD 6.1, CSD report, B-BBEE proof) may lead to immediate disqualification. Bidders must not appear on National Treasury's restricted/defaulters register, must not be prohibited from doing business with the state, and must not have engaged in fraudulent, collusive, or unethical practices. The bidder must provide proof of OEM authorization or solution ownership, and the technical team must hold specified cybersecurity certifications. Bidders must also submit a partnership/subcontracting proposal if claiming specific goals points.

provision of short-

term insurance for riots, strikes, terrorism, civil commotion and public disorder to businesses,

government entities and individuals.

The Government of the Republic of South Africa, and specifically the National Treasury

through the Minister of Finance, is the sole shareholder of Sasria. As such, the company has

to comply with a nu

project management methodology with clearly

defined phases, deliverables, timelines,

milestones, risks, and responsibilities. The

service provider must align with Sasria's project

governance and reporting requirements

throughout the implementation lifecycle.

the submission format specified below:

2.4.1 Schedule 1:

Executive Summary (explaining how you understand the requirements of this RFP,

summary of your proposed solution and the summary of your experience relevant to

the requirements of this RFP)

Annexure B of this RFP document (See Part 6) (duly completed and signed)

2.4.2 Schedule 2

All documents (except Annexure B) listed on Part 6 of this RFP Document (duly

completed and signed);

a) CSD report to verify tax compliance;

b) Valid B-BBEE verification certificate or Valid Sworn Affidavit or Valid Specialised Entity

Sworn Affidavit. An Exempted Micro Enterprises (EME) with an annual turnover less

than R10 million, is only required to obtain a sworn affidavit confirming the annual total

revenue and level of black ownership. A Qualifying Small Enterprise (QSE) that has

51% or more black beneficiaries may obtain a sworn affidavit confirming the annual

total revenue and level of black ownership.

and Cybersecurity certificate suitably qualified technical

resources with experience in

cybersecurity solutions. The CV must clearly indicate the individual's

role, responsibilities, project involvement, and relevant experience

Relevant certifications may include SC-100, SC-200, AZ-500, CompTIA

Security+, CompTIA CySA+, CEH, CISSP, GIAC, Cisco Security, or

equivalent industry-recognised cybersecurity certifications.

2 The points will be allocated as follows: 30

• 8 years and more relevant experience in the implementation of

Third-Party Risk Management (TPRM) or similar GRC solutions,

supported by relevant qualifications - 30 points (100%)

• 6–7 years’ relevant experience in the implementation of TPRM or

similar GRC solutions, supported by relevant qualifications –

21 points (70%)

• 2–3 years’ relevant experience in the implementation of TPRM or

similar GRC solutions, supported by relevant qualifications - 9

points (30%)

• Less than 2 years or non-submission of a comprehensive CV and/or

no relevant qualifications and experience provided - 0 points (0%)

Bidder’s experience

Training

Other Costs (if applicable)

Rate/ Hour Number of Total Cost

Activity/ Deliverable Resource(s)

per resource hours (VAT Excl.)

Disbursements

Sub-Total (5.1) (VAT Excl.)

Note: The proposed Total Annual Fee must be inclusive of all required services as outlined in the

scope of work (Part 3) above.

5.2 Hosting Costs

Hosting Total Costs

(VAT Excl.)

Year 1

Year 2

Year 3

Sub-Total (5.2) (VAT Excl.)

5.3 Software Costs (if applicable)

Pricing Instruction: Bidders must provide pricing for the full 36-month (3-year) contract period.

Unit prices must reflect the total cost for the entire contract term, inclusive of all software licensing,

subscriptions, support, maintenance, updates, and associated services.

Total Cost (VAT

Description Licence Metric Quantity Unit price

Excl.)

Network Detection and Monitored IP 1000

Response (NDR) Addresses

Subscription

Identity, Cloud and Enterprise Subscription 1

Microsoft 365 Detection

End-to-End Attack Enterprise Subscription 1

Correlation and Threat

Visibility

Threat Intelligence and Annual Subscription 1

Expert Advisory Service

Proactive Threat Annual Subscription 1

Notification Service

Physical / Virtual Sensor Appliance 1

Appliance

Once-off Costs

Sub-Total (5.3) (VAT Excl.)

Note: The price proposal must inclusive of all software related costs. The bidder must provide a

detailed breakdown of all elements which make up the cost of the proposed software e.g. software

license structure, services included in the license, number of licenses etc.

5.4 Post-Implementation Support and maintenance

Sasria requires a fixed cost on system maintenance and support. The service provider will be

required to provide support on a need basis. For comparison purposes, bidders must provide

cost for 40 hours of support per month over a period of Three (3) years, the hours will be billed

based on Time and Material:

Annual Annua Rate per Monthly Monthly Hours l Cost Hour (VAT Activity/ Deliverable Fee (VAT Hours (VAT Excl.) Excl.)

Excl.)

40 480 Year 1

Maintenance and 40 480 Year 2

Support

40 480 Year 3

Sub-Total (5.4) (VAT Excl.)

5.5 Total Bid Price

Please capture your total cost proposal beneath.

Activity/ Deliverable Amount

Sub-Total (5.1) (VAT Excl.)

Sub-Total (5.2) (VAT Excl.)

Sub-Total (5.3) (VAT Excl.)

Sub-Total (5.4) (VAT Excl.)

Total Bid Price (5.5) (VAT Excl.)

Price Declaration Form

Dear Sir,

Having read through and examined the requirements of this RFP No. 2026/12, and its associated conditions,

we hereby offer to provide, implement, and support an enterprise-grade Network Detection and Response

solution as outlined in the scope of work, for the following total amount:

R......................................................................................................................... (Excluding VAT)

In words

R........................................................................................................................ (Excluding VAT)

We confirm that this price covers all activities associated with the scope of work, as called for in the RFP

document. We confirm that Sasria will incur no additional costs whatsoever, over and above this amount in

connection with the delivery of the required services.

We undertake to hold this offer open for acceptance for a period of 150 days from the date of submission of

offers. We further undertake that upon final acceptance of our offer; we will commence the scope of work

when required to do so by the Sasria.

We understand that you are not bound to accept the lowest or any offer, and that we must bear all costs which

we have incurred in connection with preparing and submitting this bid.

We hereby undertake for the period during which this bid remains open for acceptance, not to divulge to any

persons, other than the persons to whom the bid is submitted, any information relating to the submission of

this bid or the details therein except where such is necessary for the submission of this bid.

Signed date

(Print name of signatory)

Designation

For and on behalf of: company name

Tel No

Fax No

Cell No

5. Part 5: Qualification and Evaluation Criteria

5.1 Evaluation of proposals

The purpose of the RFP is to obtain a complete set of salient information pertaining to the

bidding parties. The proposals will accordingly be used to evaluate whether, at Sasria’s

discretion, an interested party qualifies to proceed to the next stage of this procurement

process. All bidding parties will be advised in writing of Sasria’s decision, which will be final.

No correspondence will be entered into pertaining to the evaluation process, the decisions

taken and reasons thereof.

5.2 Evaluation Criteria

5.2.1 Level 1- Governance Verification

The evaluation during this stage is to review bid responses for purposes of assessing

compliance with RFP requirements, which requirements include the following:

• Proof of registration with CSD confirming tax compliance status as referenced

in Part 2 above.

• Valid B-BBEE certificate or Valid Sworn Affidavit or Valid Specialised Entity

Sworn Affidavit as referenced in Part 2 above.

• Duly completed Standard Bidding Document(s) and other requirements, in line

with Part 6 of this RFP.

• Technical Proposal in line with the Technical Evaluation Criteria in Part 5 of this

RFP document

• Financial/ Price Proposal in line with Part 4 of this RFP document

Note: Failure to comply with the requirements assessed in Level 1 (governance), may lead to

disqualification of bids.

5.2.2 Level 2- Technical Evaluation

The evaluation during this level is based on technical criteria (functionality). The technical

evaluation will be conducted in 2 phases, as follows:

Phase 1 – Mandatory requirements

Bidders are required to meet the following mandatory requirements and provide sufficient

proof as stated below to validate their compliance. failure to meet any one of the mandatory

requirements will result in disqualification from further participation in the tender process.

Mandatory requirements to Please see attached the Please confirm if you comply

be complied with following proof to show you by responding “YES” below,

will meet the mandatory or respond “NO” if you do

requirements not comply

Technical Team must have IT The bidder must provide

and Cybersecurity certificate suitably qualified technical

resources with experience in

NDR, SOC operations, threat

detection, incident response,

and Microsoft security

technologies. Resources must

hold relevant certifications

such as SC-200, SC-100, AZ-

500, CompTIA Security+,

CompTIA CySA+, CEH,

CISSP, CISM, or equivalent

industry-recognised

certifications. Proof of

certifications must be

submitted with the bid

OEM Authorization Accreditation letter from

original solution manufacture

or proof of ownership of the

solution.

Note: Failure to submit the above will lead to automatic disqualification.

Phase 2 –Technical Evaluation Criteria

The bidder’s proposal should respond comprehensively to the technical evaluation criteria.

Only bidders achieving a minimum score of 70 points in this phase will be evaluated further .

The technical evaluation criteria are set out below:

Item Criteria Points

Detailed user requirements

The bidder’s proposed solution must meet the user requirements

stipulated in this RFP document (See ANNEXURE E for guideline)

Bidders are required to submit a detailed and comprehensive proposal for a

Network Detection and Response, clearly demonstrating how the proposed

solution meets or exceeds each functional, technical, and operational

requirement outlined below and in Annexure E of this RFP document.

Functional and Technical Requirements

1. Network Visibility and Monitoring

The solution must provide continuous visibility across on-premises, cloud,

1 55 hybrid, and Microsoft 365 environments, including east-west and north-south

network traffic.

2. Behavioural Threat Detection

The solution must detect known and unknown threats using behavioural

analytics, machine learning, and threat detection techniques.

3. Identity, Cloud and SaaS Threat Detection

The solution must detect suspicious activity across identity services, cloud

platforms, and SaaS applications.

4. Threat Prioritisation and Risk Scoring

The solution must provide automated threat prioritisation and risk scoring

based on severity, confidence, and business impact.

5. Attack Correlation and Attack Chain Visibility

The solution must correlate related attack activities and provide end-to-end

visibility of attack paths and attack chains.

6. Threat Hunting and Investigation

The solution must support threat hunting, forensic investigation, historical

analysis, and incident investigation workflows.

7. User Access Control and Role-Based Permissions

The solution must support role-based access control (RBAC), segregation of

duties, and audit logging.

8. Alert Management and Incident Response

The solution must support alert management, incident triage, case

management, escalation workflows, and response actions.

9. Threat Intelligence Integration

The solution must support threat intelligence enrichment to improve detection,

investigation, and response activities.

10. Microsoft Sentinel and Security Platform Integration

The solution must integrate with Microsoft Sentinel, Microsoft Defender,

Microsoft Entra ID, SOAR, ITSM, ticketing systems, and other enterprise

security platforms.

11. Reporting and Executive Dashboards

The solution must provide configurable dashboards and reporting for

operational, tactical, and executive stakeholders.

12. Notifications and Alerting

The solution must provide configurable alerts and notifications through email,

APIs, and supported integration methods.

13. Data Security and Compliance

The solution must provide encryption, access controls, audit logging, and

secure handling of data in compliance with applicable regulatory requirements,

including POPIA.

14. Historical Reporting and Analytics

The solution must support historical analysis, threat trends, attack patterns,

and reporting on changes in security posture over time.

15. Technical Architecture and Scalability

The solution must support secure, scalable deployment across enterprise

environments and provide high availability and resilience.

Scoring will be allocated as follows:

• The proposed solution complies with all the technical stipulated

requirements compliance to all requirements: (55 points) 100%.

• The proposed solution only complies with majority of the stipulated

requirements (39 points) 70%

• The proposed solution only complies with half of the requirements (30

Point) 30%

• The proposed solution does not comply with any of the stipulated

requirements (0 points) 0%

Bidder’s project lead member

The bidder must submit a comprehensive CV for the proposed Project

Technical Lead, demonstrating experience in the implementation of

Network Detection and Response (NDR), Security Operations (SOC),

Threat Detection, Threat Hunting, Incident Response, or similar

cybersecurity solutions. The CV must clearly indicate the individual's

role, responsibilities, project involvement, and relevant experience

Relevant certifications may include SC-100, SC-200, AZ-500, CompTIA

Security+, CompTIA CySA+, CEH, CISSP, GIAC, Cisco Security, or

equivalent industry-recognised cybersecurity certifications.

2 The points will be allocated as follows: 30

• 8 years and more relevant experience in the implementation of

Third-Party Risk Management (TPRM) or similar GRC solutions,

supported by relevant qualifications - 30 points (100%)

• 6–7 years’ relevant experience in the implementation of TPRM or

similar GRC solutions, supported by relevant qualifications –

21 points (70%)

• 2–3 years’ relevant experience in the implementation of TPRM or

similar GRC solutions, supported by relevant qualifications - 9

points (30%)

• Less than 2 years or non-submission of a comprehensive CV and/or

no relevant qualifications and experience provided - 0 points (0%)

Bidder’s experience

The bidder must provide verifiable reference letters demonstrating

successful implementation of Network Detection and Response (NDR),

Security Operations (SOC), Threat Detection, Incident Response, or

similar cybersecurity solutions.

To substantiate this experience, the bidder must submit reference letters

from clients where the proposed solution has been successfully3 15

implemented.

Reference letters must:

• Be issued on the client's official letterhead.
• Be signed by an authorised representative.
• Include a contactable telephone number and email address.
• Describe the NDR, SOC, threat detection, or related cybersecurity

solution implemented.

• Confirm the scope of work, project duration, and successful

completion of the implementation.

• Not be older than five (5) years from the RFP closing date.

Scoring will be allocated as follows:

• 3 reference letters (15 points) 100%
• 2 reference letters (10 points) 70%
• 1 reference letters (5 point) 30%
• No reference letters (0 point) 0%

Total 100

Note: Bidders must achieve a minimum score of (70%) points in Phase 2 of the technical

criteria, to be considered for the next level (Phase 3- Solution Demonstration) of the

evaluation process.

Phase 3 – Solution demonstration Evaluation Criteria

Bidders that are eligible for evaluation in this stage will be given notification of 5 days in

advance to prepare for demo.

Item Criteria Points

Adherence to requirements

The service provider must clearly demonstrate the proposed solution and the

compliance to the deliverables and scope of the RFP as described in 3.3 and

detailed requirements in ANNEXURE E. The Service provider must

present a Demo on the actual solution so to illustrate the solution’s

functionality.

A 100.00

Scoring will be allocated as follows:

• 90-100% of the Requirements (100 points) 100%
• 80-89% of Requirement met (80 points) 80%
• 70-79% of Requirement met (70 points) 70%
• Below 70% of Requirement met (0 points) 0%

Total 100

Note: Bidders that achieved 70 points and above for solution demonstration will be considered

for the next level of the evaluation process i.e., Price and Specific goals.

5.2.3 Level 3- Preference Point System

The following preference points system will be used for this tender:

Criteria points

Price 80

Specific goals 20

TOTAL 100 points

Criteria for Specific Goals

Specific Goal to be Points Points Proof required to allocate points

measured allocated out allocated of a

of a maximum maximum

20.00 points 10.00 points

1. The tenderer is: 15.00 7.5 Valid Sworn Affidavit or Valid

Specialized Entity Sworn Affidavit a) An

Exempted

Micro

Enterprise

(EME) or

15.00 7.5 Valid B-BBEE certificate or Sworn b) A Qualifying

Affidavit for QSE that are at least Small

51% black owned Enterprise

(QSE) or

10.00 5.00 Valid B-BBEE certificate c) A Generic

enterprise

15.00 7.5 1. Valid B-BBEE certificate and d) A Generic

2. A signed subcontracting enterprise

agreement (between the Prime (Prime

Contractor and Subcontracting Contractor)

parties) subcontracti

3. Sworn Affidavit for EME or QSE ng at least

that are at least 51% black owned 20% of the

contract to

either a EME

or QSE.

2. Additional points if 5.00 2.5 Valid B-BBEE certificate or Valid

the tenderer is at least Sworn Affidavit

51% black Owned

(a Prime contractors B-

BBEE certificate or

Affidavit will be used in

the case of

subcontracting

arrangements)

Below is the specific goal(s) allocated for this RFP. Bidders are required to provide valid and

sufficient proof as indicated in the table below to claim the preference points indicated.

Please note the following:

Failure on the part of a tenderer to submit proof or documentation required in terms of

this RFP to claim points for specific goals, may result to preference points for specific

goals are not claimed or allocated.

• Sasria reserves the right to require of a tenderer, either before the RFP is adjudicated

or at any time subsequently, to substantiate any claim regarding preferences points,

in any manner required by Sasria.

6 Part 6 – Required Documents

Standard bidding documents

In addition to the Annexures listed below, the following documents must be completed, signed

and submitted together with the bid response:

• Invitation to Bid (SBD 1)

Disclosure and Declarations Form (SBD 4)

• Preferential Points Claim Form (SBD 6.1);

Note: Failure to submit these documents may lead to disqualification of the bid or preference

points not being awarded to the tenderer.

Annexure a: confidentiality and non-disclosure

Agreement

Memorandum of agreement

Entered into between:

Sasria SOC Ltd

A company duly incorporated under the laws of Republic of South Africa, having its main

place of business at 36 Fricker Road, Illovo, Sandton Johannesburg, with registration

number: 1979/000287/30

(Hereinafter referred to as “the Discloser”)

And

..........................................................

A company duly incorporated under the laws of Republic of South Africa, having its main

place of business

at................................................................................................, with

registration number:.......................................................................

(Hereinafter referred to as “the Recipient”)

Preamble

Whereas the Discloser will disclose certain confidential information to the Recipient, for

purposes

of________________________________________________________________________

____;

And whereas the Recipient wishes to receive confidential information on the condition that

the Recipient will not disclose the same to any third party or make use thereof in any manner

except as set out below.

The Discloser and the Recipient hereby agree to the following:

1. Definitions

Unless the contrary is clearly indicated, the following words and/or phrases, when used

in this Agreement, shall have the following meaning:

1.1 “Agreement” shall mean this written document together with all written

appendices, annexures, exhibits or amendments attached to it from time to

time;

1.2 “Commencement Date” shall mean the date of last signature of this

agreement;

1.3 “Confidential Information” shall mean all information which:

1.3.1 pertains to the Disclosing Purpose, disclosed, revealed or exchanged

by the Discloser to the Recipient, and which pertains to, but is not

limited to all intellectual property rights, all trade secrets, all agreements

(whether in writing or not) which exist at the time of revealing the content

thereof to the Recipient, the content of all possible future agreements

which the Discloser intends to enter into with any other party, all

knowledge obtained by way of research and development, irrespective

of whether the aforementioned information that is revealed is applicable

to technical, business or financial aspects of the Discloser; and/or

1.3.2 any information of whatever nature, which has been or may be

submitted by the Discloser to the Recipient, whether in writing or in

electronic form or pursuant to discussions between the Parties, or which

can be obtained by

examination, testing, visual inspection or analysis, including, without

limitation, business or financial data, know-how, formulae, processes,

specifications, sample reports, models, customer lists, computer

software, inventions or ideas; and/or

1.3.3 Any dispute between the Parties resulting from this Agreement; and/or

1.3.4 Any fault or defect in any aspect of the business of the Discloser,

irrespective of whether the Discloser knows about such a fault or defect;

1.4 “Notice” shall mean a written document;

1.5 “Parties” shall mean both the Discloser (Sasria SOC Ltd) and the Recipient.

1.6 “Board” shall mean Board of Directors of the Discloser.

1.7 “Tender for Income-Generating Contracts” means a written offer in the form

determined by an organ of state in response to an invitation for the origination

of income-generating contracts through any method envisaged in legislation

that will result in a legal agreement between the organ of state and a third

party that produces revenue for the organ of state, and includes, but is not

limited to, leasing and disposal of assets and concession contracts, excluding

direct sales and disposal of assets through public auctions;

1.8 “Specific Goals” means specific goals as contemplated in section 2(1)(d) of

the Act which may include contracting with persons, or categories of persons,

historically disadvantaged by unfair discrimination on the basis of race, gender

and disability including the implementation of programmes of the Reconstruction

and Development Programme as published in Government Gazette No. 16085

dated 23 November 1994;

2. Obligations of the Recipient

The Recipient shall:

2.1 use the confidential information disclosed to it solely for the purposes of

......................................................................................................

......................................................................................................

................................................................................and for no other

purpose whatsoever (“Disclosing Purpose”);

2.2 treat and safeguard the Confidential Information as private and confidential;

2.3 ensure proper and secure storage of all Confidential Information;

2.4 not at any time without the prior written consent of the Discloser or another

employee of the disclosure from which he received the information,

2.4.1 disclose or reveal to any person or party either the fact that discussions

or negotiations are taking, or have taken place between the Board,

employee and another employee or the content of any such discussions

or other facts relating to the Disclosing Purpose, except where required

by law or any governmental, or regulatory body;

2.5 not create the impression with or lead any third party to interpret or construe

any

e) condition contained in this Agreement, that this Agreement is an Agency

Agreement and/or Partnership Agreement and/or a Joint Venture and/or any other

similar arrangement;

2.6 not allege that this Agreement grants it, either directly, or by implication, or by

estoppel or otherwise a license under any patent or patent application, or that

it is entitled to utilize the Confidential Information in any way contrary to the

stipulations contained in this Agreement;

2.7 on termination of this Agreement act with the Confidential Information in

accordance with a Notice delivered to it by the Discloser and if no such Notice

was delivered, the Recipient shall destroy the Confidential Information in a

similar manner to which it would destroy information that it would consider to

be its own Confidential Information.

3. Obligations of the Discloser

Subject to clause 2, the Discloser shall:

3.1 disclose to the Recipient, in writing any relevant information in their possession

or under their care; and

3.2 furnish the Recipient at least 7 (seven) calendar days prior to this Agreement

being terminated, for whatever reason, with a Notice instructing the Recipient

about what it should do with the Confidential Information once the Agreement

has been terminated.

4. Exclusions

The provisions of Clause 3 above will not apply to any Confidential Information which:

4.1 is at the time of disclosure to the Recipient, within the public domain and could

be obtained by any person with no more than reasonable diligence;

4.2 come into the public domain and could be obtained after such disclosure,

otherwise than by reason of a breach of any of the undertakings contained in

this Agreement;

4.3 is subsequently provided to the Recipient by a person who has not obtained

such

information from the Discloser, provided that, in any such case, such

information was not obtained illegally or disclosed by any person in breach of

any undertaking or duty as to confidentiality whether expressed or implied;

4.4 is disclosed with the written approval of the Discloser;

4.5 is or becomes available to a third party from the Discloser on an unrestricted

basis;

4.6 is obliged to be reproduced under an order of court or government agency of

competent jurisdiction.

5. Commencement

This Agreement shall commence on the Commencement Date.

6. Cancellation

6.1 The Agreement shall not terminate automatically. Either party must be able to

terminate on written notice to the other party once the Disclosing Purpose is

completed. The obligations of confidentiality under this Agreement shall

continue to apply after assignment or termination of this Agreement.

6.2 The Parties further agree that either Party shall have the right at any time to

give notice in writing to terminate this Agreement forthwith in the event of a

material breach of any of the terms and conditions of the Agreement. If the

breach in question is one which can effectively be remedied, the Parties shall

endeavour to jointly try to remedy such breach, failing which, the Agreement

shall be terminated.

7. Interpretation

7.1 The clause headings in this Agreement have been inserted for convenience

only and will not be taken into consideration in the interpretation of this

Agreement;

7.2 Any reference in this Agreement to the singular includes the plural and vice

versa;

configuration, integration, testing, training, knowledge transfer, and comprehensive

documentation. The service provider must also provide ongoing technical support,

maintenance, software updates, optimisation services, and access to suitably qualified

technical resources for the duration of the contract.

The duration of the contract will be three (3) years, inclusive of implementation, support,

maintenance, and ongoing operational services.

3.3 Scope of Work

environments. A detailed implementation plan

must be provided, including design, deployment,

configuration, testing, integration, go-live, and

transition activities.

performance testing, integration testing, threat

simulation testing, and user acceptance testing

prior to production deployment.

5.1 Implementation Costs

Rate/ Hour Number of Total Cost

Activity/ Deliverable Resource(s)

per resource hours (VAT Excl.)

Implementation

Rate/ Hour Number of Total Cost

Activity/ Deliverable Resource(s)

per resource hours (VAT Excl.)

Customisation / development / configuration / Integration

5 pricing model

5.1 Implementation Costs

(VAT Excl.)

Year 1

Year 2

Year 3

Sub-Total (5.2) (VAT Excl.)

5.3 Software Costs (if applicable)

Pricing Instruction: Bidders must provide pricing for the full 36-month (3-year) contract period.

Minimum functionality/qualifying score: 70

minimum score of 70

tax compliance

tax compliance status as referenced

CSD report to verify tax compliance

Joint Venture agreement

proof of ownership of the

B-BBEE Minimum Level: 1

Points Allocation: 00 points

B-BBEE Details: hedules)

Bidders are required to submit a comprehensively detailed bid responses in accordance with

the submission format specified below:

2.4.1 Schedule 1:

Executive Summary (explaining how you understand the requirements of this RFP,

summary of your proposed solution and the summary of your experience relevant to

the requirements of this RFP)

Annexure B of this RFP document (See Part 6) (duly completed and signed)

2.4.2 Schedule 2

All documents (except Annexure B) listed on Part 6 of this RFP Document (duly

completed and signed);

a) CSD report to verify tax compliance;

b) Valid B-BBEE verification certificate or Valid Sworn Affidavit or Valid Specialised Entity

Sworn Affidavit. An Exempted Micro Enterprises (EME) with an annual turnover less

than R10 million, is only required to obtain a sworn affidavit confirming the annual total

revenue and level of black ownership. A Qualifying Small Enterprise (QSE) that has

51% or more black beneficiaries may obtain a sworn affidavit confirming the annual

total revenue and level of black ownership.

Submission Requirements to Claim Points Related to Specific Goals:

1. Consortium or Joint Venture – to submit a valid consolidated B-BBEE certificate

or Affidavit and a signed Consortium or Joint Venture agreement.

2. Prime Contractor with Subcontractor(s)- Prime Contractor and Subcontractor(s)

B-BBEE certificates or Valid Sworn Affidavits are required and a signed

subcontracting agreement

3. Individual bidder – must submit a valid B-BBEE certificate or Sworn Affidavit

2.4.3 Schedule 3:

a) Technical Proposal in line with the Technical Evaluation Criteria in Part 5 of this RFP

document.

2.4.4 Schedule 4:

a) Financial/ Price Proposal in line with Part 4 of this RFP document.

2.5 Submission of Bids

The c

Sasria promotes transformation in the financial services and other sectors of the South African economy. Bidders are encouraged to partner with majority black owned entities (51% black owned and controlled) and businesses that are small to medium sized. Partnerships may include joint ventures or subcontracting agreements. Bidders must submit a partnership/subcontracting proposal detailing the portion of work to be outsourced, level of involvement of the black owned partner, and where relevant, a consolidated B-BBEE scorecard. Preference points for specific goals: 20 points total. Criteria include: being an EME or QSE (15 points), being a generic enterprise (10 points), being a prime contractor subcontracting at least 20% to EME or QSE (15 points), and additional points if the tenderer is at least 51% black owned (5 points). Proof required includes valid B-BBEE certificates or sworn affidavits.

following reasons, and such disqualification may occur without prior notice to the offending

bidder:

failed to provide proof that they are tax compliant with SARS;

submitted incomplete information and documentation according to the requirements of this

RFP document; submitted information which contains fraudulent, factually untrue or

inaccurate information; received information not available to other potential bidders

through fraudulent means;

ailed to comply with mandatory requirements if stipulated in the RFP document;

misrepresented or altered material information in whatever way or manner;

• promised, offered or made gifts, benefits to any Sasria employee;
• canvassed, colluded or lobbied in order to gain unfair advantage;
• committed fraudulent acts;
• will cause perceived or actual reputational, financial or operational risk to

Sasria;

• appears in National Treasury’s list of restricted / defaulters register;
• prohibited to do business with state organs;
• the bidder is prohibited to do business with the State; and
• acted dishonestly and/or in bad faith etc.

2.8 Ethical Dealings

No environmental requirements are specified in the document.

1. Part 1 - Letter of Invitation .............................................................................................. 3

2. Part 2 - Instructions ........................................................................................................ 4

2.1 Sasria ..................................................................................................................... 4

2.2 Contractual commitment ......................................................................................... 4

2.3 Confidentiality ......................................................................................................... 4

2.4 Submission Format (Returnable Schedules) ........................................................... 4

2.4.1 Schedule 1: ............................................................................................................. 5

2.4.2 Schedule 2 .............................................................................................................. 5

2.4.3 Schedule 3: ............................................................................................................. 5

2.4.4 Schedule 4: ............................................................................................................. 5

2.5 Submission of Bids ................................................................................................. 5

2.6 Queries and clarifications ........................................................................................ 6

2.7 Reasons for Disqualification or Non- Award ............................................................ 6

2.8 Sasria’s Rights ........................................................................................................ 6

2.8 Ethical Dealings.......................................................................................8

2.9 Proposal costs ........................................................................................................ 7

2.10 Validity period ......................................................................................................... 7

2.11 Important dates ....................................................................................................... 7

2.12 Transformation ........................................................................................................ 7

3. Part 3 - RFP Requirements ............................................................................................ 9

3.1 Special Instructions ................................................................................................. 9

3.2 Background Information .......................................................................................... 9

3.3 Scope of Work ...................................................................................................... 10

3.4 Contract Duration .................................................................................................. 12

4. Part 4 - Financial Proposal ........................................................................................... 12

5. Part 5: Qualification and Evaluation Criteria ................................................................. 19

5.1 Evaluation of proposals ......................................................................................... 19

5.2 Evaluation Criteria................................................................................................. 19

5.2.1 Level 1- Governance Verification ................................................................... 19

5.2.2 Level 2- Technical Evaluation ........................................................................ 19

5.2.3 Level 3 – Preference Point System ................................................................ 20

6 Part 6 – Required Documents ...................................................................................... 25

Annexure a: confidentiality and non disclosure agreement ................... 26

Annexure b: acceptance of bid conditions and bidder’s details ............. 38

Annexure c: shareholder information .............................................................. 41

Annexure d: bidder’s experience and proposed project team ................... 0

1. Part 1 - Letter of Invitation

• Part 1 – Letter of Invitation
• Part 2 – Instructions
• Part 3 – RFP Requirements
• Part 4 – Financial Proposal
• Part 5 – Pre-Qualification and Evaluation Criteria
• Part 6 - Required Documents

o Annexure A: Confidentiality and Non-disclosure Agreement;

o Annexure B: Acceptance of Bid Conditions;

o Annexure C: Shareholder Information

o Annexure D: Bidder’s Experience and proposed project team

o Invitation to Bid (SBD 1): SBD1 is the entire RFP document filled and signed.

o Disclosure and Declaration (SBD 4);

o Specific Goal Declaration Form (SBD 6.1)

Note: Failure to provide any one of the documents required may lead to an immediate

disqualification of the service provider from the tender process.

contained therein, as contemplated in the Protection of Personal Information Act, No. and Regulations promulgated thereunder (“POPI Act”). Further, you declare that you

have obtained all consents required by the POPI Act or any other law applicable. Thus,

you hereby indemnify Sasria against any civil or criminal action, administrative fine or

other penalty or loss that may arise as a result of the processing of any personal

information that you submit.

2. Part 2 - Instructions

2.1 Sasria

Sasria SOC Ltd (Sasria) is the only short-term insurer that provides special risk cover to all

individuals and businesses that own assets in South Africa, as well as government entities.

terrorism, making South Africa one of the few countries in the world that provide this insurance,

particularly at affordable premiums.

operations and a broader strategic mandate to make a positive contribution to transformation

within the Insurance industry in South Africa. Sasria’s core business is the provision of short-

term insurance for riots, strikes, terrorism, civil commotion and public disorder to businesses,

government entities and individuals.

postpone, discontinue or terminate the transaction/procurement process without incurring any

liability whatsoever to any other party.

bidder, as it needs to align its procurement practices to governance practices that are in line

with its own growth path. These may include but are not limited to: driving socio-economic

development objectives that are enshrined in various government policies. Sasria is under no

obligation to award the tender in full and may decide to award it in part to one or various

tenderers.

2.3 Confidentiality

and submitted together with the bid response:

• Invitation to Bid (SBD 1)

Disclosure and Declarations Form (SBD 4)

• Preferential Points Claim Form (SBD 6.1);

Note: Failure to submit these documents may lead to disqualification of the bid or preference

points not being awarded to the tenderer.

Annexure a: confidentiality and non-disclosure

in this Agreement, shall have the following meaning:

1.1 “Agreement” shall mean this written document together with all written

appendices, annexures, exhibits or amendments attached to it from time to

time;

1.2 “Commencement Date” shall mean the date of last signature of this

agreement;

1.3 “Confidential Information” shall mean all information which:

1.3.1 pertains to the Disclosing Purpose, disclosed, revealed or exchanged

by the Discloser to the Recipient, and which pertains to, but is not

limited to all intellectual property rights, all trade secrets, all agreements

(whether in writing or not) which exist at the time of revealing the content

thereof to the Recipient, the content of all possible future agreements

which the Discloser intends to enter into with any other party, all

knowledge obtained by way of research and development, irrespective

of whether the aforementioned information that is revealed is applicable

to technical, business or financial aspects of the Discloser; and/or

1.3.2 any information of whatever nature, which has been or may be

submitted by the Discloser to the Recipient, whether in writing or in

electronic form or pursuant to discussions between the Parties, or which

can be obtained by

examination, testing, visual inspection or analysis, including, without

limitation, business or financial data, know-how, formulae, processes,

specifications, sample reports, models, customer lists, computer

software, inventions or ideas; and/or

1.3.3 Any dispute between the Parties resulting from this Agreement; and/or

1.3.4 Any fault or defect in any aspect of the business of the Discloser,

irrespective of whether the Discloser knows about such a fault or defect;

1.4 “Notice” shall mean a written document;

1.5 “Parties” shall mean both the Discloser (Sasria SOC Ltd) and the Recipient.

1.6 “Board” shall mean Board of Directors of the Discloser.

1.7 “Tender for Income-Generating Contracts” means a written offer in the form

determined by an organ of state in response to an invitation for the origination

of income-generating contracts through any method envisaged in legislation

that will result in a legal agreement between the organ of state and a third

party that produces revenue for the organ of state, and includes, but is not

limited to, leasing and disposal of assets and concession contracts, excluding

direct sales and disposal of assets through public auctions;

1.8 “Specific Goals” means specific goals as contemplated in section 2(1)(d) of

the Act which may include contracting with persons, or categories of persons,

historically disadvantaged by unfair discrimination on the basis of race, gender

and disability including the implementation of programmes of the Reconstruction

and Development Programme as published in Government Gazette No. 16085

dated 23 November 1994;

similar arrangement;

2.6 not allege that this Agreement grants it, either directly, or by implication, or by

estoppel or otherwise a license under any patent or patent application, or that

it is entitled to utilize the Confidential Information in any way contrary to the

stipulations contained in this Agreement;

2.7 on termination of this Agreement act with the Confidential Information in

accordance with a Notice delivered to it by the Discloser and if no such Notice

was delivered, the Recipient shall destroy the Confidential Information in a

similar manner to which it would destroy information that it would consider to

be its own Confidential Information.

The provisions of Clause 3 above will not apply to any Confidential Information which:

4.1 is at the time of disclosure to the Recipient, within the public domain and could

be obtained by any person with no more than reasonable diligence;

4.2 come into the public domain and could be obtained after such disclosure,

otherwise than by reason of a breach of any of the undertakings contained in

this Agreement;

4.3 is subsequently provided to the Recipient by a person who has not obtained

such

information from the Discloser, provided that, in any such case, such

information was not obtained illegally or disclosed by any person in breach of

any undertaking or duty as to confidentiality whether expressed or implied;

4.4 is disclosed with the written approval of the Discloser;

4.5 is or becomes available to a third party from the Discloser on an unrestricted

basis;

4.6 is obliged to be reproduced under an order of court or government agency of

competent jurisdiction.

6.1 The Agreement shall not terminate automatically. Either party must be able to

terminate on written notice to the other party once the Disclosing Purpose is

completed. The obligations of confidentiality under this Agreement shall

continue to apply after assignment or termination of this Agreement.

6.2 The Parties further agree that either Party shall have the right at any time to

give notice in writing to terminate this Agreement forthwith in the event of a

material breach of any of the terms and conditions of the Agreement. If the

breach in question is one which can effectively be remedied, the Parties shall

endeavour to jointly try to remedy such breach, failing which, the Agreement

shall be terminated.

Special instructions: Bidders must notify Sasria Procurement within five days after publication if they believe the functional requirements are not open/fair or written for a particular service provider. Contract duration: implementation period preferably 1-2 months, solution fully operational from month 3, total contract period 3 years subject to periodic performance and service reviews. Bidders are encouraged to partner with majority black owned entities (51% black owned and controlled) and small to medium sized businesses, including joint ventures or subcontracting agreements, and must submit a partnership/subcontracting proposal detailing the portion of work to be outsourced.

Bidders must provide a proposal detailing the portion of work to be outsourced, if applicable. Partnerships may include joint ventures or subcontracting agreements where a portion of the work is undertaken by black-owned entities. Reference letters must be on the client's official letterhead, signed by an authorised representative, include contact details, describe the solution implemented, confirm scope, duration, and successful completion, and not be older than five years from the RFP closing date. The bidder must indicate compliance with mandatory requirements by responding 'YES' or 'NO'.

Additional evaluation criteria include: the bidder must clearly demonstrate the proposed solution and compliance with deliverables during a demo, which will be scheduled with 5 days' notice. Scoring will be allocated based on adherence to requirements. Reference letters must substantiate experience in NDR, SOC, threat detection, or related cybersecurity solutions. Sasria promotes transformation in the financial services and other sectors of the South African economy, and preference points are awarded for specific goals including being an EME/QSE, being 51% black owned, and subcontracting to EME/QSE.