Appointment of a service provider for digital forensic investigation of malware incidents at fape and alleged data theft incidents at famm

Closing date: 25 September 2026, 10h00 CAT.

Issue date: 18 September 2026.

No briefing or site visit is mentioned.

Clarifications before bid closure: Bright Blessie (Demand Management) – [email protected] (cc: [email protected]).

Clarifications after bid closure: Lesedi Mashiloane (Acquisition Management) – [email protected] (cc: [email protected]).

Include the reference number and description in the subject line.

Fraud hotline: 0800 222 335 (24hrs), email [email protected], website www.tip-offs.com.

Bids must be submitted online via the e-Submission (e-Tender) system. No hand delivery will be considered. The bid must be split into two parcels: Parcel A (Administrative, Phase 1) containing general instructions and administrative requirements (excluding SBD 3.3 and 6.1); Parcel B (Price & Specific Goals, Phase 2) containing SBD 3.3 Pricing Schedule, SBD 6.1 Preference Points Claim Form, CSD Report, CIPC documents, shareholder certificates, ID copies of shareholders, and a valid B-BBEE certificate or sworn affidavit (for EMEs/QSEs).

Returnable forms and documents (all must be completed, signed and submitted):

• SBD 1 (Invitation to Bid, Parts A and B): signed as the offer cover page; includes bidder details and acceptance of terms.
• SBD 3.3 (Pricing Schedule for Professional Services): fully completed and signed, with all pricing elements.
• SBD 4 (Bidder's Disclosure / Declaration of Interest): discloses any director or shareholder employed by the state or connected to ATNS; false declarations disqualify.
• SBD 6.1 (Preference Points Claim Form): claims specific goal points under the 80/20 system.
• SARS Tax Compliance Status PIN (valid for 60 days from submission) or CSD number.
• Proof of CSD registration or application.
• CIPC documents, shareholder certificates, ID copies of shareholders.
• Valid B-BBEE certificate or sworn affidavit (for EMEs/QSEs).
• Two reference letters proving relevant digital forensics experience.
• Detailed datasheet of the scope of work.

Disqualification risks:

• Any required form omitted, unsigned, or incomplete.
• Bids without a price or with an incomplete price.
• Bids submitted after the closing time.
• Failure to comply with administrative requirements may lead to rejection, or a 7-day window to submit supplementary information (administrative only, not substantive).

Bidders must submit: SBD 1 (Invitation to Bid), SBD 3.3 (Pricing Schedule), SBD 4 (Bidder's Disclosure), SBD 6.1 (Preference Points Claim Form), CSD Report, CIPC documents, Shareholder Certificates, ID copies of shareholders, valid B-BBEE Certificate or Sworn Affidavit, and SARS Tax Compliance PIN. Bids must be submitted via e-Submission in two parcels: Parcel A (Administrative) and Parcel B (Price & Specific Goals).

Evaluation is in two stages:

• Stage 1: Administrative requirements (SARS PIN, CSD proof, completed SBD 1, SBD 4, etc.). Non-compliance may lead to rejection or a 7-day cure period.
• Stage 2: Mandatory requirements – at least two reference letters for relevant digital forensics experience, and a detailed datasheet of the scope of work.
• Stage 3: Price and Specific Goals using the 80/20 system (80 points price, 20 points specific goals). Applies to tenders up to R50 million (all taxes included).

Price points formula: Ps = 80(1 - (Pt - Pmin)/Pmin), where Pt = price of tender under consideration, Pmin = price of lowest acceptable tender.

Specific goals (20 points): 51% Black Owned suppliers (Section 2(1)(d)(i) of the PPPFA). Proof required: CSD Report, CIPC documents, shareholder certificates, ID copies of shareholders, and valid B-BBEE certificate or sworn affidavit (for EMEs/QSEs). Bidders must indicate how they claim points in SBD 6.1.

Scope of work – Digital Forensic Investigation:

1. FAPE and FAEL OT Malware Investigation:

• Forensic investigation of affected OT systems and associated IT infrastructure.
• Malware analysis and reverse engineering where required.
• Determine infection source and attack vector.
• Assess whether data exfiltration occurred and identify compromised information.
• Review network logs, endpoint artefacts, and security monitoring records.
• Determine timeline of events and identify affected systems.
• Assess impact on operational continuity and safety-critical services.
• Provide remediation recommendations and lessons learned.

2. FAMM Insider Threat Investigation:

• Forensic assessment of alleged unauthorised access to personal data.
• Review user activity logs and access records.
• Analyse endpoints and systems linked to identified individuals.
• Determine whether unauthorised access, copying, transmission, or exfiltration occurred.
• Identify affected data sets and individuals.
• Establish timelines, methods, and extent of compromise.
• Evaluate compliance with data protection legislation and internal policies.

3. Digital Evidence Management:

• Collect and preserve digital evidence.
• Maintain chain-of-custody records.
• Ensure evidence handling complies with accepted forensic standards.
• Preserve evidence suitable for legal, disciplinary, audit, or regulatory proceedings.

4. Reporting:

• Interim reports: initial findings and progress updates.
• Final comprehensive forensic reports covering: executive summary, scope and methodology, findings and evidence, root cause analysis, impact assessment, timeline of events, attribution analysis where possible, risk assessment, and recommendations for remediation and future prevention.
• Reports must be suitable for executive, legal, disciplinary, regulatory, and audit purposes.

Mandatory: Bidders must submit a minimum of two reference letters proving previous relevant experience in Digital Forensics or related services. A detailed datasheet of the scope of work to be conducted is also required.

Pricing must be submitted on SBD 3.3 (Pricing Schedule for Professional Services). The schedule requires a total price for professional fees covering the complete scope of work, including investigation planning, evidence collection and preservation, malware analysis, forensic investigations, reporting, and presentation of findings. The schedule includes subtotal (VAT excl.), VAT 15%, and grand total. Bids must be valid for 60 days from closing date. Any budget amount is a guide only; all costs must be included. A pricing schedule omitting any specified element may be considered non-responsive.

Pricing must be submitted on SBD 3.3 (Pricing Schedule for Professional Services). The schedule requires a total price for professional fees covering the complete scope of work, including investigation planning, evidence collection and preservation, malware analysis, forensic investigations, reporting, and presentation of findings. The schedule includes subtotal (VAT excl.), VAT 15%, and grand total.

Bids must remain valid for 60 days from the closing date.

Any budget amount indicated is a guide only; bidders must submit a fair and reasonable costing. All costs must be included in the pricing schedule. A pricing schedule omitting any specified element (fees or reimbursable costs) may be considered non-responsive. Bids without a price or with an incomplete price are non-responsive.

CSD registration: Mandatory. Bidders must be registered on the National Treasury Central Supplier Database (CSD) before submitting, and must submit proof of registration or application. No award will be made to an unregistered bidder.

SARS Tax Compliance: Submit a valid Tax Compliance Status PIN (valid for 60 days from submission) or a printed TCS certificate. Where no TCS is available, a CSD number must be provided. Each party in a consortium/JV/sub-contracting arrangement must submit separate proof.

B-BBEE: A valid B-BBEE certificate or sworn affidavit (for EMEs/QSEs) is required to claim preference points for specific goals.

CIPC: Companies and Intellectual Property Commission documents, shareholder certificates, and ID copies of shareholders are required for specific goal claims.

Professional registration: Proof of registration with professional bodies is required; bids without proof are non-responsive.

Declaration of Interest (SBD 4): Must be completed and signed by each party; bids without it are non-responsive.

Invitation to Bid (SBD 1): Must be completed and signed; bids without it are non-responsive.

Bidders must not be persons in the service of the state, nor have directors who are. Bids from those on the Register for Tender Defaulters or List of Restricted Suppliers will be disqualified.

Preference points are allocated for the specific goal of 51% Black Owned suppliers, which confers both voting rights and economic interest to black people. Proof required includes CSD Report, CIPC documents, Shareholder Certificates, ID copies of shareholders, and valid B-BBEE Certificate or Sworn Affidavit (for EMEs/QSEs).

Contract terms:

• ATNS accepts no liability for the accuracy of the brief; bidders rely on their own judgment.
• The successful tenderer must accept standard terms including a retention clause for non-satisfactory completion, breach of contract, confidentiality, and a requirement for adequate professional indemnity insurance.
• ATNS may vary the scope and terms, with written notice.
• ATNS may cancel or postpone the procurement at any stage before contract conclusion.
• ATNS may negotiate with one or more bidders, but negotiation does not constitute an award.
• A contract is only concluded when reduced to writing and signed by both parties.
• ATNS may reject a bid if the bidder or its directors have abused the SCM system, committed fraud, or failed to perform on a previous contract.
• The General Conditions of Contract (GCC) must be accepted.
• Additional information may be requested in writing; replies must be submitted within 7 working days.
• All documentation is confidential; copyright of deliverables belongs to ATNS.
• On termination, the bidder must hand over all documentation and deliverables without right of retention.
• The bidder warrants it can conclude the agreement to ATNS's satisfaction.

Special conditions include: Bids must be submitted online via e-Submission; no hand delivery. The bid is subject to the Preferential Procurement Policy Framework Act and Regulations. Bidders must be registered on the Central Supplier Database (CSD). Failure to comply with administrative requirements may lead to rejection or a 7-day window to submit supplementary information.

The bid will be evaluated using the 80/20-point system: Price (80 points) and Specific Goals (20 points). The 80/20 system applies to tenders up to R50 million. Price points are calculated using the formula Ps = 80(1 - (Pt - Pmin)/Pmin). Specific goals are based on 51% Black Owned suppliers, requiring CSD Report, CIPC documents, Shareholder Certificates, ID copies of shareholders, and valid B-BBEE Certificate or Sworn Affidavit.