Objectives

The primary objective of this tender is to procure an enterprise-grade DDoS mitigation, web application firewall (WAF), content delivery network (CDN), and API protection solution for the Electoral Commission’s public-facing infrastructure. The solution aims to safeguard against cyber threats, ensure website availability during peak periods such as elections, and support API and web service security. It also seeks to provide ongoing technical support, support flexible domain management, and ensure compliance with industry standards over a contract period of up to 48 months.

Scope

The scope includes the provision of:

• Upstream DDoS protection and mitigation for at least one primary domain (elections.org.za) and approximately 30 related sub-domains, with the ability to add/remove domains without extra cost.
• Caching (CDN) services for the same domains/sub-domains, supporting unlimited bandwidth and cached data volumes, with flexible management.
• Web Application Firewall (WAF) to protect against vulnerabilities, OWASP Top 10 threats, with custom rule creation and vulnerability management.
• API Protection services for at least five sub-domains, safeguarding approximately 40 web services, with rate limiting and bot management capabilities.
• Support services including onboarding, 24/7/365 operational support, urgent issue response within one hour, and ongoing performance optimization.
• Reporting, log management, and integration with the Electoral Commission’s SIEM system.
• High availability across multiple data centers, including at least two in South Africa and ten across Africa, with a service uptime target of 99.9% outside election periods and 100% during heightened election periods.

Technical Requirements

The solution must meet the following minimum technical specifications:

• Domain Coverage: Protect at least one domain (elections.org.za) and 30 sub-domains, with dynamic domain management at no extra cost.
• DDoS Mitigation: Unmetered mitigation capacity, protection against all bots, anomaly detection, and custom CAPTCHA & threat response.
• CDN: Enterprise-level caching covering unlimited data volumes, with purge-by-tag and purge-by-host capabilities, TTL not exceeding 10 seconds during election periods.
• WAF: Automatic vulnerability protection, custom rule creation, OWASP Top 10 handling, and support for web services/web applications.
• API Protection: Safeguarding at least five sub-domains with 40 web services, rate limiting, and bot management.
• Support & Support Tools: Onboarding, operational support, real-time logs, audit logs, log forwarding to SIEM, analytics dashboards, role-based access control, and self-service portal.
• Performance & Availability: 99.9% uptime outside election periods, 100% during election peaks, distributed across 100+ data centers, with rapid response times (<10 seconds TTL during election periods).
• Compliance: PCI DSS Level 4 or higher, ISO 27001, NIST Cybersecurity Framework, or SOC 2.

Skills Requirements

The bidder must demonstrate:

• At least five (5) years of experience in providing DDoS mitigation, WAF, CDN, and API protection services.
• Proven capability to support enterprise-scale solutions with unlimited domain/subdomain management and high-volume data processing.
• Experience in deploying and managing solutions that comply with international security standards (ISO 27001, NIST, SOC 2).
• Ability to provide dedicated support resources, including technical experts for onboarding, configuration, and ongoing support.
• Capability to deliver proactive performance tuning, security assessments, and regular health checks.
• Demonstrated success in supporting government or large enterprise clients during election cycles or peak operational periods.