Re-advert: once-off rollout and configuration of 60 microsoft defender for business (edr) for agrément south africa

Closing date: 07 October 2026 at 12:00pm

Date of issue: 30 September 2026

No late submissions accepted.

Enquiries and submissions:

• Email: [email protected]
• All enquiries must be submitted in writing to this address.
• No other contact with ASA personnel during the RFQ process is permitted.

Submission address: [email protected] (electronic only)

Submission method: electronic only, by email to [email protected]. No hard copies or physical submissions accepted.

Use RFQ number ASA 01/10/2026 as the subject reference.

Only one electronic copy; if more than one is sent, the first submission takes precedence unless withdrawn in writing.

All documents must be clear and visible; all documentation must be in English.

Late submissions will not be evaluated.

Returnable documents (all must be completed and signed):

• SBD 4 (Declaration of Interest): discloses any director/shareholder employed by the state or connected to ASA; must be true and complete.
• SBD 6.1 (Preference Points Claim): claims preference points under the 80/20 system.
• Signed General Conditions of Contract.
• Latest CSD report (registration on CSD is a condition for contract award).
• Completed price schedule.
• At least three contactable reference letters confirming successful implementation of Microsoft Defender and/or Microsoft security services.
• Proof of being an authorised Microsoft partner or reseller.

Disqualification risks:

• Failure to submit any mandatory document (price schedule, reference letters, proof of Microsoft partner/reseller).
• Omission of material information, factual inaccuracy, or misrepresentation of fact.
• Failure to comply with any terms and conditions.
• Late submission.

Evaluation uses the 80/20 preference point system (for acquisitions ≤ R50 million).

Price: 80 points, calculated using the formula Ps = 80(1 - (Pt - Pmin)/Pmin), where Pt is the price under consideration and Pmin is the lowest acceptable price.

Specific goals: 20 points total, allocated as follows:

• SMME: 5 points — B-BBEE certificate or sworn affidavit.

• 50% Black female ownership: 5 points — CSD report, or CIPC company registration certificate showing percentage shareholding.

• 50% Black youth ownership: 5 points — CSD report, CIPC certificate, or identification documentation of all owners.

• 50% People with disabilities ownership: 5 points — CSD report, CIPC certificate, or identification documentation of all owners.

ASA may investigate the bidder's financial position, previous contracts, skills, and workload.

Award to the bidder with the highest total points, except where the law permits otherwise.

Appointment subject to agreeing mutually acceptable terms; if not, ASA may appoint an alternative supplier.

Award announced on the National Treasury website; no regret letters sent.

Scope: once-off rollout and configuration of 60 Microsoft Defender for Business licences (already purchased) and removal of Kaspersky, to establish a unified Microsoft-managed endpoint security platform.

Work includes:

• Activation of Microsoft Defender for Business.
• Configuration of security baselines and policies.
• Integration with Microsoft Intune.
• Endpoint onboarding and migration.
• Removal and decommissioning of Kaspersky.
• Security hardening of Windows endpoints.
• Knowledge transfer and documentation.
• Post-implementation support and stabilisation.

Detailed scope:

• Assessment and planning: review existing endpoint security architecture, assess current Kaspersky deployment, confirm licensing readiness, produce migration and rollback plans, define implementation waves.
• Microsoft Defender activation: enable Defender for Business, configure Security Portal, device onboarding policies, EDR, automated investigation and remediation, vulnerability management.
• Security hardening: configure Defender Antivirus policies, Attack Surface Reduction (ASR) rules, Web Content Filtering, Tamper Protection, Controlled Folder Access, Device Control policies, cloud-delivered protection, security recommendations and remediation baselines.
• Intune integration: configure security baselines, compliance policies, configuration profiles, deploy policies to all managed devices, establish device groups.
• Kaspersky removal: phased decommissioning, remove agents, verify Defender activation, validate protection status, retire management console, identify licences for reclaim.
• Testing and validation: validate policy deployment, threat detection, EDR alerting, reporting, compliance reporting, endpoint health.
• Documentation and knowledge transfer: as-built documentation, security architecture diagrams, administrative procedures, standard operating procedures, incident response guidance, administrator workshops.

Technical requirements:

• Endpoint protection: real-time antivirus, behavioural analysis, cloud-assisted threat intelligence, EDR, automated remediation, vulnerability assessment.
• Security management: centralised dashboard, incident visibility, threat investigation, reporting and analytics, device inventory, vulnerability reporting.
• Compliance and governance: Microsoft security best practices, POPIA, NIST Cybersecurity Framework alignment, ISO 27001-aligned controls, audit logging and reporting.
• Deployment: phased approach, rollback procedures, minimal business disruption, endpoint health validation, user communication support.

Deployment approach: phased deployment with rollback procedures, minimal business disruption, endpoint health validation, and user communication support.

Supplier responsibilities: project planning and management, migration execution, endpoint onboarding, Kaspersky removal, security policy configuration, functional and security testing, documentation, training and knowledge transfer.

Scope includes assessment and planning, Microsoft Defender activation, security hardening, Intune integration, Kaspersky removal, testing and validation, documentation and knowledge transfer.

Supplier responsible for functional and security testing, documentation, and training/knowledge transfer. No specific quality management system or certification required beyond the technical requirements.

Price schedule items: Assessment and Planning; Microsoft Defender Deployment; Microsoft Intune Configuration; Security Hardening and Policy Configuration; Kaspersky Removal and Decommissioning; Testing and Validation; Hypercare and Project Closure.

Total amount excl VAT, 15% VAT, total all-inclusive once-off.

Prices must cover all work/items specified; mistakes at bidder's own risk.

Pricing format: once-off total price per item, excluding VAT, plus 15% VAT, and total all-inclusive once-off amount.

Price schedule items:

• Assessment and Planning
• Microsoft Defender Deployment
• Microsoft Intune Configuration
• Security Hardening and Policy Configuration
• Kaspersky Removal and Decommissioning
• Testing and Validation
• Hypercare and Project Closure

Prices and rates must cover all work/items specified; mistakes in prices or calculations are at the bidder's own risk.

No bid security, bonds, guarantees, or retention mentioned.

Proposal validity: minimum 90 days from closing date.

CSD registration: mandatory; no contract will be entered into with a provider not registered on the Central Supplier Database.

B-BBEE: preference points claimed via SBD 6.1; supporting evidence (B-BBEE certificate or sworn affidavit) required for SMME goal.

Microsoft partner/reseller: proof of being an authorised Microsoft partner or reseller is mandatory.

Reference letters: at least three contactable reference letters confirming successful implementation of Microsoft Defender and/or Microsoft security services.

POPIA: bidders agree ASA may collect and process personal information for evaluation purposes.

No CIDB grading, tax clearance, or CIPC registration requirements stated beyond the CSD report.

Service Level Agreement: successful bidder must enter into an SLA with ASA before award; SLA forms the contractual basis for delivery and performance measurement. Contract extensions at ASA's sole discretion.

Copyright and IP: service provider assigns to ASA any copyright arising from works produced during the contract; provider may not use, reproduce, or disseminate without prior consent.

ASA reserves the right not to accept the lowest bid, to reject any or all proposals, and not to appoint any service provider.

Appointment subject to agreeing mutually acceptable terms; if not, ASA may appoint an alternative supplier.

Award announced on National Treasury website; no regret letters sent.

Validity period: proposals valid for 90 days from closing date.

Disclaimer: RFQ is not an offer; submission does not imply contract.

POPIA: bidders agree ASA may collect and process personal information for evaluation purposes.

Mandatory requirements: completed price schedule; at least three contactable reference letters confirming successful implementation of Microsoft Defender and/or Microsoft security services; proof of authorized Microsoft partner or reseller. Failure to submit any mandatory document leads to disqualification.

Submission requirements: latest CSD report, completed and signed SBD 4 and SBD 6.1 forms, signed General Conditions of Contract.

Additional terms: bidders must not assume prior information is available; include copies of affiliations/memberships/accreditations; omission of material information may lead to disqualification; failure to comply with terms invalidates proposal. ASA reserves the right to extend closing date, verify information, request documentary proof, appoint one or more service providers, award in whole or part, cancel or withdraw the RFQ. Medium of communication: all documentation in English. Cost of proposal: bidders bear all costs. Correctness of responses: bidders confirm correctness and validity; mistakes at their own risk. Verification of documents: check page numbers; only one electronic copy; first submission takes precedence if multiple.

Evaluation uses the 80/20 preference point system (for acquisitions ≤ R50 million). 80 points for price, calculated using the formula Ps = 80(1 - (Pt - Pmin)/Pmin). 20 points for specific goals: SMMEs (5 points, B-BBEE certificate/sworn affidavit), >50% Black female ownership (5 points, CSD report or CIPC registration), >50% Black youth ownership (5 points, CSD report or CIPC registration or ID docs), >50% People with disabilities ownership (5 points, CSD report or CIPC registration or ID docs). ASA may investigate bidder's financial position, previous contracts, skills, workload. Award to highest total points.