Logrhythm licensing renewal and 24/7 soc support services – 12 month contract

The Community Schemes Ombud Service (CSOS) is established under the Community Schemes Ombud Services Act 2011 to regulate conduct within community schemes and ensure good governance. CSOS currently operates a LogRhythm-based SIEM platform integrated within a Managed Security Operations Centre (SOC) capability. The purpose of this RFP is to appoint a service provider to renew and manage LogRhythm licenses, provide enhanced SIEM support services aligned with SOC/MDR capabilities, ensure continuous 24/7 monitoring, detection, and response, and strengthen CSOS's overall cyber resilience and compliance posture.

Closing date: 06 October 2026 at 12:00

No briefing session or site visit is stated in the document.

Technical enquiries:

• Contact: Nonyameko Ngxeke
• Email: [email protected]
• Telephone: (010) 593 0533 / 073 764 7629

Supply Chain Management enquiries:

• Contact: Jabulile Sithole
• Email: [email protected]
• Telephone: (010) 593 0533 / 066 302 5937

Submission:

• Method: email
• Submission email: [email protected]

Submission method: email only

Submission email: [email protected]

Closing date: 06 October 2026 at 12:00

Returnable documents (all must be completed, signed and submitted):

• SBD 1 (Invitation to Bid): bidder and contact details, signed as the offer cover page.
• SBD 3.3 (Pricing Schedule – Professional Services): priced in SA Rand inclusive of VAT.
• SBD 4 (Declaration of Interest): discloses whether any director or shareholder is employed by the state or connected to the procuring institution.
• SBD 6.1 (Preference Points Claim): claims B-BBEE points under the PPPFA 80/20 system.
• Valid B-BBEE certificate (SANAS-accredited or CIPC) or sworn affidavit for EME.
• Proof of CSD registration (CSD summary report or CSD number).
• Valid tax pin number/letter.
• Proof of LogRhythm partnership/authorisation (partner certificate, authorisation letter, or official partner directory listing).
• Evidence of operational SOC capability: SOC operating procedures, organisational structure, staffing model, service levels, relevant certifications, and at least three referenceable clients.
• Reference letters or client assessment forms for LogRhythm SIEM and Managed SOC services (within last 5 years).
• CVs of key SOC personnel with relevant certifications.
• Proof of authority to sign (e.g., company resolution).

Disqualification risks:

• Late submission (after closing date and time).
• Non-compliance with mandatory requirements (LogRhythm partner/reseller status, functional SOC).
• Omissions or irregularities in the bid; counter conditions or amendments to bid conditions.
• Failure to provide any required compliance document.
• Involvement in more than one bid (directly or indirectly).
• Fronting or false declarations.

Bidders must submit the following compliance documents: valid B-BBEE certificate issued by an accredited SANAS verification agency or sworn affidavit for EME, or B-BBEE certificate from CIPC; proof of registration on the National Treasury Central Supplier Database (CSD summary report or CSD number); valid tax pin number/letter; and fully completed SBD documents (SBD 1, 3.3, 4 & 6.1).

Evaluation method: 80/20 preference point system (PPPFA 2022 Regulations).

Stage 1 – Mandatory requirements:

• Must be an authorised LogRhythm partner/reseller.
• Must demonstrate an operational SOC (24x7x365).
• Non-compliance results in disqualification.

Stage 2 – Functionality (minimum qualifying score: 65/100):

• Experience of bidder in LogRhythm SIEM and Managed SOC services (weighting 40): scored 0–5 based on number of reference letters/assessment forms (0 letters = 0 points; 5 letters = 5 points).
• Proof of LogRhythm partnership/authorisation (weighting 30): scored 1–5 based on partnership level (no proof = disqualified; basic reseller = 1; advanced Gold/Platinum or direct OEM = 5).
• Team experience and capability (weighting 30): scored 0–5 based on years of experience and certifications of key SOC personnel (no team info = 0; 6+ years with advanced certifications = 5).

Stage 3 – 80/20 preference points:

• Only bidders achieving 65% functionality are evaluated further.
• Price and specific goals scored under the 80/20 system.
• Specific goals points: EME/QSE owned 51%+ by black women, youth, persons with disabilities, or military veterans = 17 points; EME/QSE owned 51%+ by black people in rural/underdeveloped areas or townships = 1 point; EME/QSE co-operative owned 51%+ by black people = 1 point; EME/QSE owned 51%+ by black people in general (Africans, Indians, Coloureds) = 1 point.

Reference checks will be conducted.

The Community Schemes Ombud Service (CSOS) requires a service provider for LogRhythm licensing renewal and support services for 12 months.

Scope of work:

• Renew all LogRhythm SIEM licenses for 12 months, aligned to event processing capacity (EPS) and data retention requirements.
• Provide 24/7 SOC monitoring and incident detection (real-time monitoring, event correlation, alerting, reduce MTTD/MTTR).
• Incident response and management: triage and classification (Critical, High, Medium, Low), root cause analysis, forensic support, containment, eradication, recovery, post-incident reporting.
• Threat intelligence and threat hunting: integrated feeds, intelligence-driven detection, expert-led hunting, detection across cyber kill chain.
• SIEM content engineering and use case management: maintain/optimise rules, detection scenario library, custom use cases, tune rules to reduce false positives.
• Platform maintenance and operations: health monitoring, patch/release management, backup/recovery, high availability.
• Security reporting and analytics: daily/weekly/monthly reports, incident reports, performance/health reports, threat intelligence briefings.
• Service desk and support: 24/7 availability, telephonic/email/ticket support, escalation to OEM and senior experts.
• Knowledge transfer and training: hands-on training, knowledge transfer for SIEM management, operational and administrative documentation.

ICT infrastructure and hosting:

• SOC must be externally hosted within South Africa.
• CSOS technicians require remote web-based administrative access.
• Up to four internal resources will have access to the solution.

Key deliverables:

• Valid LogRhythm license renewal.
• Fully operational SIEM support services.
• Monthly SOC performance reports.
• Incident and forensic reports.
• Threat intelligence briefings.
• System health and optimisation reports.

Deployment must be concluded within 30 days of signing the SLA.

The service provider must present a comprehensive proposal and model outlining how they intend to address CSOS's needs, including a line-item budget and a detailed project plan. The SOC must be externally hosted within South Africa, with up to four internal resources having remote web-based administrative access. The provider must ensure resources are available to complete deployment within 30 days of signing the SLA.

Bidder experience (weighting 40): must submit contactable reference letters or fully completed client assessment forms for LogRhythm SIEM deployment and Managed SOC services, implemented within the last 5 years. Reference letters must be signed by the client, confirm work completed within the last 5 years, and expressly confirm delivery by the bidder. Scoring: 0 letters = 0 points; 1 = 1 point; 2 = 2 points; 3 = 3 points; 4 = 4 points; 5 = 5 points.

Team experience and capability (weighting 30): must provide CVs or profiles of key SOC personnel (SOC analysts, engineers, incident responders). Scoring based on years of experience and certifications (e.g., LogRhythm, CISSP, CEH, GIAC, Security+): 2 years with 1 certification = 1 point; 3 years with relevant certifications = 2 points; 4 years with certified resources = 3 points; 5 years with multiple certifications = 4 points; 6+ years with advanced certifications and proven success in large-scale deployments = 5 points.

The service provider must deliver daily, weekly and monthly reports, security incident reports, platform performance and health reports, and threat intelligence briefings. Reports must include log source status, incident trends, and risk posture with recommendations. The provider must maintain SIEM platform health, patch/release management, backup/recovery, and high availability. All communication with CSOS must be in writing. Any discrepancies or ambiguities in the bid must be promptly reported to CSOS in writing.

Pricing must be in SA Rand inclusive of all applicable taxes. The pricing schedule includes: SOC 24x7 services (monthly, 12-month contract), SOC on-boarding and transitioning (once off), licensing subscription (AI-SIEM with Singularity Data Lake, 6-month data retention, 15 GIG per day, 12-month contract), managed endpoint detection and response (EDR) for workstations (240, 12-month contract), managed EDR for servers (30, 12-month contract), and Purple AI Assistant per endpoint (12-month contract). The total must include VAT at 15% if applicable.

Pricing must be in SA Rand inclusive of all applicable taxes.

Pricing schedule (SBD 3.3 – Professional Services):

• SOC 24x7 services – monthly, 12-month contract (qty 1).
• SOC on-boarding and transitioning – once off.
• Licensing subscription (AI-SIEM with Singularity Data Lake, 6-month data retention, 15 GIG per day) – 12-month contract.
• Managed Endpoint Detection and Response (EDR) – Complete Workstation – 240, 12-month contract.
• Managed EDR – Complete Server – 30, 12-month contract.
• Purple AI Assistant – per endpoint – 12-month contract.
• Subtotal, VAT @ 15% (if applicable), and total inclusive of VAT.

Offer validity: 90 days from closing date.

Rates must be firm for the full period; if not, provide basis for adjustments (e.g., CPI).

No bid security, bonds, guarantees, or retention are stated.

Mandatory eligibility:

• Must be an authorised LogRhythm partner/reseller (proof: partner certificate, authorisation letter, or official partner directory listing).
• Must demonstrate an operational SOC capable of 24x7x365 monitoring and incident response (evidence: SOC operating procedures, organisational structure, staffing model, service levels, relevant certifications, and at least three referenceable clients).

Compliance documents:

• Valid B-BBEE certificate (SANAS-accredited) or sworn affidavit for EME, or B-BBEE certificate from CIPC.
• Proof of CSD registration (CSD summary report or CSD number).
• Valid tax pin number/letter (SARS TCS PIN or printed TCS certificate).
• Fully completed SBD documents (SBD 1, 3.3, 4 & 6.1).

Other requirements:

• Must be registered on the National Treasury Central Supplier Database (CSD) and remain registered for the contract duration.
• Must be tax compliant at submission and for the contract duration.
• No bids from persons in the service of the state, or companies/close corporations with directors/members who are state employees.
• Consortia/JVs/sub-contractors: each party must submit a separate TCS certificate/PIN/CSD number.
• B-BBEE specific goals points are claimable under the 80/20 system (see evaluation criteria).

Specific goals points under the 80/20 system: EME or QSE owned by 51% or more black person woman, youth, person living with disability, or military veteran – 17 points; EME or QSE owned by 51% or more black people living in rural or underdeveloped areas or townships – 1 point; EME or QSE co-operative owned by 51% or more black people – 1 point; EME or QSE owned by 51% or more black people in general (with focus on Africans, Indians, Coloureds) – 1 point.

The bid constitutes a binding offer irrevocable for 90 days from submission. The CSOS reserves the right to amend, modify, withdraw or terminate the RFP at any time without liability. Bidders must be registered on the Central Supplier Database (CSD) and remain tax compliant. The CSOS may conduct site inspections or call for supporting documentation. No entity may be involved in more than one bid. Material changes in bidder control must be reported. The CSOS may waive non-responsiveness at its discretion. Bids become the property of CSOS and will be kept confidential. The CSOS may require a formal presentation. The CSOS is not obliged to accept the lowest price. The contract duration is 12 months, with deployment to be concluded within 30 days of signing the SLA. The service provider must sign a Service Level Agreement ensuring confidentiality of CSOS information and intellectual property, and abide by CSOS policies and Code of Conduct. The CSOS reserves the right to conduct supplier due diligence. Counter conditions will invalidate the bid. Fronting may lead to disqualification and restriction from doing business with the public sector.

The bidder must be an authorised LogRhythm partner/reseller and have a functional SOC capability. The SOC must be externally hosted within South Africa. The service provider must present a comprehensive proposal and model outlining how they intend to address CSOS's needs, including a line-item budget and detailed project plan. The bidder must ensure they have resources to complete deployment within 30 days from signing the SLA.

Mandatory requirements: The bidder must be an authorised LogRhythm partner/reseller, with proof in the form of a valid partner certificate, letter of authorisation from LogRhythm, or evidence of listing on LogRhythm's official partner directory. The bidder must demonstrate an operational Security Operations Centre (SOC) capable of providing 24x7x365 security monitoring and incident response services, with evidence including SOC operating procedures, organisational structure, staffing model, service levels, relevant certifications, and at least three referenceable clients receiving SOC services.

Proposals will be evaluated using the 80/20 preference method. Only bidders achieving a minimum qualifying score of 65% in functionality will be evaluated further on the 80/20 preference point system. Functionality is weighted as follows: Experience of bidder in LogRhythm SIEM and Managed SOC services (40 points) – scored based on number of reference letters/assessment forms (0–5 points); Proof of LogRhythm partnership/authorisation (30 points) – scored based on level of partnership (disqualified to advanced partner); Team experience and capability (30 points) – scored based on years of experience and certifications of key SOC personnel. The total functionality score is out of 100, with a minimum threshold of 65%.