Objectives

The primary objective is to supply, deliver, install, configure, commission, and maintain a complete network infrastructure solution at the Nelson Mandela Prison House. The project aims to establish reliable wired and wireless connectivity, deploy a next-generation firewall with secure SD-WAN capabilities, and fully integrate all new components into Iziko’s existing Huawei-managed network architecture and Sophos security ecosystem. The solution must enable centralized monitoring, fault detection, performance reporting, and troubleshooting from the main Cape Town site while ensuring long-term operational compatibility and security.

Scope

• Procurement and installation of enterprise-grade managed PoE+ switches and Wi-Fi 7 access points (indoor and outdoor).
• Deployment of a next-generation firewall appliance appropriately sized for site bandwidth, user capacity, and security services.
• Design, configuration, and commissioning of a secure SD-WAN overlay connecting the prison house to the main site.
• Structured cabling works involving Cat6 copper cabling, 4-core multimode fibre backbone, patch panels, HDPE conduits, rack-mounted cabinets, UPS units, and PDUs.
• Comprehensive testing, certification, documentation, and technical handover to Iziko ICT.
• Provision of a three-year support and maintenance Service Level Agreement (SLA) covering hardware, software, and firmware updates.
• An optional fibre internet service (minimum 100 Mbps) priced separately and explicitly excluded from the mandatory evaluation total.

Technical Requirements

• Switching: Enterprise-grade managed PoE+ switches supporting IEEE 802.3at, VLANs (802.1Q), link aggregation (802.3ad), rapid/multiple spanning tree (802.1w/802.1s), 802.1X authentication, QoS, SNMPv3, syslog, and secure remote management (SSH/HTTPS).
• Wireless: Access points compliant with IEEE 802.11be (Wi-Fi 7), supporting WPA3, multiple SSIDs mapped to VLANs, fast roaming (802.11r/k/v), PoE power, and weatherproofing for outdoor units.
• Centralized Management: Mandatory onboarding of all switches and access points into Huawei iMaster NCE, including provision of minimum three-year licences and subscription support.
• Firewall & Security: Next-generation firewall registering on Iziko’s existing Sophos Central, supporting IPsec encryption, policy-based path selection, failover, NAT, VLAN interfaces, static/dynamic routing, logging, and advanced threat protection.
• SD-WAN: Documented overlay architecture identifying WAN underlay, tunnel method, routing approach, encryption, traffic policies, and automatic failover behaviour.
• Cabling: Cat6 LAN points, 4-core multimode fibre backbone, proper termination, labelling, splice testing, and certification.
• Deliverables: As-built diagrams, IP/VLAN schedules, port/cable schedules, device serials, licence details, configuration backups, and test results.
• Scalability & Support: Solution must accommodate future growth and include manufacturer technical support and licences for a minimum of 36 months.

Skills Requirements

• Valid manufacturer accreditation or authorised partner/reseller status for both the proposed switching/wireless solutions and the Sophos/SD-WAN firewall platform.
• Proven experience integrating enterprise networking equipment with Huawei iMaster NCE and successfully deploying SD-WAN architectures.
• Competence in structured cabling design, installation, fibre splicing, and certification processes.
• Ability to develop resilient SD-WAN topologies, configure security policies, implement routing/NAT, and ensure seamless integration with existing Sophos Central management.
• Strong project management capabilities, including clear delivery timelines, installation scheduling, and comprehensive documentation practices.
• Willingness to adhere to a defined three-year SLA featuring business-hours support and four-hour onsite response times for critical issues.
• Submission of at least five relevant project reference letters and line-by-line compliance statements against all specifications.

Key Technical Terms Explained

• Huawei iMaster NCE: A centralized network management platform used to monitor, configure, troubleshoot, and report on network devices across distributed sites.
• Sophos Central: A cloud-based security management console that provides unified control, monitoring, and policy enforcement for Sophos firewall and endpoint security appliances.
• SD-WAN (Software-Defined Wide Area Network): A technology that abstracts WAN connectivity, enabling intelligent traffic routing, encrypted site-to-site tunnels, policy-based path selection, and automatic failover across multiple internet links.
• 80/20 Preference Point System: A South African public procurement scoring methodology allocating 80 points to price competitiveness and 20 points to socio-economic goals, primarily Black Economic Empowerment (B-BBEE) ownership levels.
• PoE+ (Power over Ethernet Plus): IEEE 802.3at standard allowing network switches to deliver electrical power alongside data to connected devices such as wireless access points and VoIP phones.
• Wi-Fi 7 (IEEE 802.11be): The latest wireless networking standard offering significantly higher throughput, reduced latency, improved multi-user efficiency, and enhanced security compared to previous generations.