Tender Summary

Objectives

The primary objective is to strengthen the organisation's cybersecurity posture by deploying an enterprise-grade, cloud-based Privileged Access Management (PAM) solution. The initiative aims to centralise governance, monitoring, and auditing of all privileged identities across on-premises, cloud, and hybrid environments. By enforcing least-privilege and Zero Trust principles, the solution will mitigate risks associated with credential compromise, insider threats, and lateral movement. The project also seeks to ensure alignment with NIST Cybersecurity Framework 2.0, ISO/IEC 27001, POPIA, and PFMA compliance standards while enhancing audit readiness, operational continuity, and proactive risk mitigation.

Scope of Work

The appointed service provider will deliver end-to-end design, implementation, configuration, integration, and three-year support for a cloud-based PAM solution comprising 100 licenses. The scope covers privileged access management for internal administrators, executives, and third-party vendors across Windows/Linux servers, databases, network infrastructure, and cloud workloads. Key responsibilities include:

• Architecture design and approval by the Enterprise Architecture Committee
• System deployment, configuration, and integration with existing Identity and Access Management (IAM) and Security Operations platforms
• Comprehensive knowledge transfer and training for ten designated officials
• Provision of standard operating procedures (SOPs), technical documentation, and user guides
• Post-implementation support, maintenance, and allocation of annual support hours

Deliverables include project planning artifacts, executive summaries, detailed technical implementation reports, operational manuals, and structured skills transfer sessions.

Technical Requirements

The solution must be hosted on the vendor's secure cloud or premises infrastructure and adhere to identity-centric security and Zero Trust architectures. Mandatory technical capabilities include:

• Centralised credential vaulting and privileged account discovery
• Just-in-Time (JIT) and least-privilege access enforcement
• Real-time session monitoring, recording, and break-glass emergency access
• Automated approval workflows, role-based access control (RBAC), and password rotation
• Comprehensive audit logging and reporting aligned with regulatory frameworks
• Seamless integration with existing IAM, security operations, and ICT infrastructure

All implementations must satisfy governance and compliance requirements under NIST CSF, ISO/IEC 27001, POPIA, and PFMA.

Skills & Personnel Requirements

• Company Experience: Minimum of three successfully completed cloud-based PAM implementations within the past seven years, demonstrating expertise in hybrid environments, credential vaulting, session monitoring, and IAM integration. Valid, contactable client references are mandatory.
• PAM Technical Lead: Must have directed at least three enterprise PAM deployments in the last seven years. Required to hold two current, verifiable certifications from approved bodies (e.g., CISSP, CISM, CIAM, Microsoft Identity & Access Administrator, or vendor-specific PAM certifications). Must possess deep expertise in PAM architecture, deployment, access governance, and enterprise system integration.
• Project Manager: Must hold one recognised project management certification (e.g., PMP, PRINCE2 Practitioner, AgilePM) and demonstrate proven experience managing complex IT/security projects, including budget oversight, risk management, stakeholder coordination, and progress reporting.
• Training Capability: Demonstrated ability to conduct administrator and end-user training, delivering comprehensive SOPs, technical documentation, and hands-on knowledge transfer.

Key Terminology

• Privileged Access Management (PAM): A security discipline that enables enterprises to securely store, monitor, and control elevated access credentials used by administrators, executives, and third parties to critical systems.
• Just-in-Time (JIT) Access: A security mechanism that grants temporary, time-bound elevated privileges only when explicitly requested and approved, eliminating standing administrative rights to reduce attack surfaces.
• Zero Trust: A security model that mandates continuous verification of all users, devices, and network traffic, operating on the principle that no entity should be trusted by default, regardless of location.
• B-BBEE & PPPFA 80/20 System: South African preferential procurement frameworks where bid evaluation weights 80% toward price and 20% toward specific socio-economic goals, primarily Broad-Based Black Economic Empowerment status levels.