Overall Objectives

The primary goal of this tender is to procure a robust, scalable, and future-proof Operational Technology (OT) Security Information and Event Management (SIEM) solution that enhances Eskom’s cybersecurity posture within critical OT environments. The solution aims to enable comprehensive monitoring, surveillance, alerting, triage, and reporting of suspicious activities or threats, thereby supporting ongoing incident detection, response, and system reliability. Additionally, the tender emphasizes adherence to Eskom’s SHEQ (Safety, Health, Environment, and Quality) standards, legislative requirements, and policies to ensure safe, environmentally compliant, and high-quality system deployment and operation.

Scope of Work

The scope encompasses the end-to-end lifecycle management of a turnkey OT SIEM system over five years, including design, supply, delivery, installation, commissioning, maintenance, support, and training. It involves deploying the SIEM within development environments across three critical OT systems, implementing an on-premises solution with offline update capabilities, and integrating with existing enterprise SIEM and SOAR platforms if necessary. The project also covers the development of detailed system architecture, operational documentation, and management of associated network, security, and support systems. Furthermore, it includes managing subcontractors and external providers, ensuring compliance with environmental and safety standards, and providing comprehensive technical documentation and training to ensure operational excellence and system sustainability.

Technical Requirements

The technical scope mandates compliance with specific standards and detailed design and implementation criteria, including:

• Development of comprehensive system architecture documents such as High-Level Design (HLD), Low-Level Design (LLD), and Network Implementation Plans (NIP).
• Deployment of a reliable, scalable, and secure SIEM system supporting diverse log collection methods (agent-based, agentless, API-based), with normalization, parsing, and secure retention capabilities.
• Implementation of advanced threat detection features, including real-time correlation, IOC/TTP-based rules, anomaly detection, and integration with threat intelligence feeds (e.g., STIX/TAXII).
• Provision of incident management workflows, automated alerting, reporting dashboards, and compliance reporting mechanisms.
• Ensuring high availability with disaster recovery plans supporting RTO of 0-2 hours and RPO of up to 24 hours, along with secure access controls and intrusion prevention systems.
• Compatibility with existing Eskom infrastructure, supporting various data sources and network environments, and facilitating future migration plans.
• Provision of ongoing support, updates, and lifecycle management for at least 10 years post-deployment, including hardware/software maintenance and upgrades.

Skills and Competency Requirements

The successful tenderer must demonstrate a broad range of skills and experience, including:

• Proven expertise in designing, deploying, and supporting OT SIEM solutions, with OEM accreditation and relevant case studies.
• Strong capabilities in network architecture, cybersecurity, system integration, and testing, supported by qualified engineers (e.g., registered with ECSA).
• Experience in developing comprehensive system architecture, operational manuals, and technical documentation aligned with Eskom standards.
• Ability to implement and support SHEQ (Safety, Health, Environment, and Quality) management plans, risk assessments, incident investigations, and quality systems.
• Capability to manage subcontractors and external service providers through monitoring, audits, and compliance verification.
• Skilled personnel capable of delivering formal training, knowledge transfer, and support services, including project management and risk mitigation.
• Expertise in threat detection, correlation, anomaly detection, and incident response, with familiarity with relevant standards such as ISO 14001, IEC 62443, and NIST.