Objectives

The primary objective of this tender is to procure comprehensive Cyber Security Monitoring and Managed Detection and Response (MDR) services for the South African Civil Aviation Authority (SACAA) over a period of three (3) years. The aim is to establish a Cyber Risk Operations Center (CROC) leveraging existing Trend Micro cybersecurity investments, to enhance national cyber resilience, operational visibility, and defensive capabilities without establishing a traditional Security Operations Centre (SOC).

Scope

The scope includes providing an always-on cyber defense capability that encompasses:

• Continuous monitoring, threat detection, investigation, and incident response support.
• Integration with SACAA’s existing Trend Micro ecosystem, including endpoint, server, network, email, identity, cloud, and SIEM functionalities within Trend Vision One platform.
• Ingestion, analysis, and correlation of security telemetry from SACAA’s on-premises and cloud environments into Trend Vision One.
• Delivery of Managed XDR (MDR) capabilities, including investigation, threat hunting, escalation, and response actions.
• Operational governance and administrative control of the Trend Vision One platform, with personnel located within South Africa.
• Support for Cyber Risk Exposure Management (CREM) and incident response processes.
• Enhancement of existing security tools rather than replacing them, with any additional SIEM solutions positioned as complementary.

Technical Requirements

The technical requirements specify that the bidder must:

• Provide a fully integrated MDR service aligned with SACAA’s existing Trend Micro environment.
• Monitor, analyze, and correlate telemetry from both cloud and on-prem environments into Trend Vision One.
• Deliver threat hunting, investigation, and response capabilities following Trend Micro MDR severity definitions.
• Maintain full administrative control and operational governance over the Trend Vision One platform, with personnel based in South Africa.
• Operationalize Cyber Risk Exposure Management (CREM).
• Support SACAA’s incident response process, including prioritization based on defined severity levels.
• Ensure that any third-party SIEM solutions are supplementary and do not replace the existing Trend Micro SIEM platform.
• Meet specified retention and operational demands for security data.

Skills Requirements

The bidder must demonstrate the capability to support the project with a team possessing the following skills and resources:

• A minimum of 10 skilled personnel, with no individual occupying more than one position.
• At least one Certified Information Security Manager (CISM) support personnel.
• At least one Certified Ethical Hacker (CEH) within the team.
• Operational expertise in managing Trend Micro’s Trend Vision One platform, including full administrative control.
• Experience in incident response, threat hunting, and escalation methodologies aligned with industry standards.
• Ability to deliver training and support for SACAA’s internal teams on cybersecurity best practices and platform usage.
• Personnel must be based within South Africa to ensure operational governance and compliance.