Objectives

The City of Cape Town aims to secure a 72-month contract for the supply, support, maintenance, and development of its Public Key Infrastructure (PKI), certificate management software, professional services, and cybersecurity training programmes. The initiative focuses on enhancing digital security, streamlining certificate lifecycle management, and building internal cyber resilience through accredited education.

Scope

• Schedule A: Ongoing support and maintenance of the existing AppViewX PKI environment integrated with Microsoft Active Directory Certificate Services (ADCS). Covers approximately 2,000 managed certificates across Windows, Unix, Linux, and non-domain servers. Hardware Security Modules (HSMs) are not required.
• Schedule B: Supply, installation, configuration, and integration of an alternative PKI system to replace AppViewX Cert+. Requires active-active clustering across two data centres, a six-year warranty, and full project management for seamless migration.
• Schedule C: Provision of public SSL/TLS certificates, wildcard/SAN certificates, Intel VPro AMT provisioning, and Advanced Electronic Signature (AeSign) tokens and APIs. Includes automated bulk signing of approximately 4,700 clearance certificates monthly.
• Schedule D: Delivery of accredited cybersecurity training and certification programmes (CompTIA, EC-Council, ISACA, ISC2, Microsoft, PECB) for municipal staff, graduates, and interns.

Technical Requirements

• System Integration: Solutions must seamlessly integrate with Windows Server 2019/2022+, Red Hat Linux 9+, SUSE Linux Enterprise 15+, AIX 7.3, Apache/Tomcat/NGINX/IIS web servers, SAP Single Sign-On 3.0, and Azure Key Vault/Automation.
• Certificate Lifecycle Management: Automated CSR generation, network-wide certificate discovery and inventory, bulk enrollment, auto-renewal with 30/60-day expiry alerts, real-time health dashboards, and revocation via CRL/OCSP.
• Security & Compliance: Enforcement of cryptographic standards (SHA-2, RSA ≥2048-bit, ECC ≥P-256), secure private key storage, redundant backups, role-based access control, and compliance with CA/Browser Forum Baseline Requirements. Cloud-only hosting is prohibited; issuing CAs must reside on-premise.
• Pricing Model: Mark-up based procurement. Final costs are calculated by applying the tendered mark-up percentage to verified Original Equipment Manufacturer (OEM) prices per purchase order.

Skills and Experience Requirements

• OEM/OSM Authorization: Tenderers must hold direct or indirect accreditation from Original Equipment/Software Manufacturers to sell, implement, and support all proposed solutions.
• Professional Resources: Minimum experience thresholds apply: Project Managers (7 years, PMP certified), Architects (8 years, 5 years PKI design), Subject Matter Experts (5+ years cryptographic/PKI experience), and AeSign specialists (1+ year).
• Vendor Track Record: Demonstrable history of delivering PKI solutions, supported by verifiable client references, implementation timelines, and project durations.
• Compliance & Governance: Valid tax compliance, registration on municipal and national supplier databases, POPIA adherence, occupational health and safety compliance, and minimum insurance coverage (R20 million public liability, R5 million professional indemnity).

Key Terms and Concepts

• PKI (Public Key Infrastructure): A framework for creating, managing, distributing, and revoking digital certificates that enable secure encrypted communications and authentication.
• ADCS & AppViewX: Microsoft’s native certificate authority service and a third-party certificate lifecycle management platform currently in use.
• AeSign (Advanced Electronic Signature): A legally binding electronic signature under South African law, exclusively issued by vendors accredited by the South African Accreditation Authority (SAAA).
• Standby Bidder: The second-highest ranked tenderer who may be awarded the contract if the primary agreement is terminated.