Objectives

The primary objective of this tender is to procure a Vulnerability Assessment Tool that enables the Department of Public Works to quickly identify and address security vulnerabilities across various systems. The tool aims to facilitate efficient scanning of networks, detection of software flaws, missing patches, malware, and misconfigurations, thereby enhancing the department's cybersecurity posture.

Scope

The scope of the tender includes:

• Supply and delivery of a Vulnerability Assessment Tool suitable for diverse operating systems, devices, and applications.
• Provision of options for network-based scanning solutions capable of identifying assets and fingerprinting their operating systems and vulnerabilities.
• Coverage of security standards including Open Web Application Security Project (OWASP) and Common Weakness Enumeration (CWE).
• Implementation of unauthenticated checks with 24/7 coverage backed by global security research.
• Integration with Endpoint Security Consoles for automated asset data import and tagging.
• Support for scanning at least 1000 IP addresses, scalable up to 3000 IP addresses.
• Secure storage of credentials for authenticated scans on systems such as Windows, UNIX, and network devices.
• Installation, skill transfer, and quarterly support over a 24-month period by the service partner.

Technical Requirements

The technical specifications and requirements for the proposed Vulnerability Assessment Tool include:

• Ability to quickly identify vulnerabilities including software flaws, missing patches, malware, and misconfigurations.
• Network scanning solution capable of efficiently scanning and fingerprinting assets to determine vulnerabilities.
• Compliance with OWASP and CWE standards.
• Always connected to the internet to perform scans.
• Support for unauthenticated checks and 24/7 security coverage.
• Endpoint Security Consoles for automated import of endpoint asset data and tagging.
• Capacity to scan a minimum of 1000 IP addresses, with scalability to 3000 IP addresses.
• Secure credential management for authenticated scans on various infrastructure hosts.
• Installation and quarterly support, including skills transfer, over a two-year period.
• Provision of training programs for skill transfer to the department’s staff.
• Proof of address from Gauteng Province for supplier evaluation.