Objectives

The primary objective of this tender is to appoint a service provider responsible for licensing, implementing, maintaining, and supporting an Enterprise Vulnerability Scanning Management Solution over a period of 5 years. The solution aims to enhance network security by providing continuous vulnerability assessment, reporting, and remediation guidance tailored to the modern, dynamic network environment of the South African Broadcasting Corporation (SABC).

Scope

The scope encompasses the provision of a comprehensive vulnerability management solution with capabilities including:

• Licensing and subscription management for the vulnerability scanning software.
• Implementation of the solution across the SABC’s network, cloud, and virtual environments.
• Ongoing maintenance, support, and updates for 5 years.
• Regular full and partial scans (scheduled or continuous, non-intrusive) of network assets, applications, cloud environments, and mobile applications, especially the "SABC+" app.
• Generation of detailed reports, dashboards, and graphs to monitor vulnerabilities, configurations, and compliance status.
• Integration with existing IT tools and workflows, including patch management and SIEM systems.
• Prioritization and assessment of vulnerabilities to facilitate focused remediation efforts.
• Provision of training and upskilling for SABC technical staff.

Technical Requirements

The solution must meet the following minimum technical capabilities:

• Support for full/partial, scheduled or continuous, non-intrusive scans across diverse environments.
• Comprehensive reporting features with customizable reports, dashboards, and vulnerability summaries.
• Ability to assess network devices, servers, applications, cloud, and virtual environments.
• Support for mobile applications, especially the "SABC+" app.
• Vulnerability detection including web application security issues like XSS and broken authentication.
• Asset discovery, risk prioritization, and exposure assessment with minimal false positives.
• Integration with third-party tools such as patch management (e.g., Microsoft SCCM) and SIEM solutions.
• Support for various credentials and device configurations to ensure thorough assessments.
• Ability to produce detailed vulnerability heatmaps, asset inventories, and remediation reports.
• Flexible deployment options: on-premises, cloud, or hybrid.
• Licensing model based on per device, with options for subscription or perpetual licenses.
• Support for virtualized environments, cloud platforms (Azure, AWS), and remote/low-bandwidth environments.
• Compliance with relevant standards such as ISO 27001, ISO 9001, NIST, and CIS.

Skills Requirements

The successful bidder must demonstrate:

• Proven experience in deploying enterprise vulnerability management solutions across multi-platform environments, including mainframes, servers, cloud, and virtualized systems.
• Capability to provide technical staff with at least one project lead with a minimum of 5 years’ experience and two technical personnel with at least 3 years’ experience, certified in the proposed solution.
• Ability to deliver comprehensive training and continuous upskilling for SABC staff at no additional cost.
• Expertise in integrating vulnerability management tools with existing IT infrastructure, patch management, and SIEM systems.
• Demonstrated ability to produce detailed reports, dashboards, and vulnerability heatmaps.
• Experience in managing security assessments in complex, multi-platform, and cloud environments.
• Strong project management skills, including the submission of detailed project plans (e.g., GANTT charts) and references from previous similar implementations.
• Knowledge of relevant security standards (ISO 27001, NIST, CIS) and compliance requirements.