Objectives

The primary objective of this tender is to procure comprehensive cyber security monitoring and managed detection and response (MDR) services for the South African Civil Aviation Authority (SACAA) over a period of three (3) years. The aim is to establish a robust, always-on cyber defense capability that leverages SACAA’s existing Trend Micro cybersecurity ecosystem, including endpoint, server, network, email, identity, cloud, and SIEM capabilities, to enhance national cyber resilience, operational visibility, and defensive posture.

Scope

The scope of the tender includes:

• Provision of continuous, 24/7/365 cyber security monitoring, threat detection, investigation, and incident response support.
• Implementation of a Cyber Risk Operations Center (CROC) model utilizing SACAA’s existing Trend Micro technologies, specifically Trend Vision One, to replace traditional Security Operations Centre (SOC) functions.
• Monitoring and analysis of security telemetry from SACAA’s Azure, cloud, and on-premises environments.
• Delivery of Trend Micro Managed XDR (MDR) capabilities, including alert correlation, threat hunting, guided response, automation, and operational reporting.
• Operational governance and administration of the Trend Vision One platform, ensuring no third-party SIEM is proposed or integrated.
• Support for Cyber Risk Exposure Management (CREM) and incident response processes.
• Provision of training and support to SACAA staff for effective platform and process management.

Technical Requirements

The technical requirements include:

• Delivery of a fully integrated MDR service based on SACAA’s existing Trend Micro security stack, with Trend Vision One as the sole SIEM, analytics, investigation, and response platform.
• Monitoring, ingestion, analysis, and correlation of security telemetry from SACAA’s Azure, cloud, and on-prem environments into Trend Vision One.
• Provision of full administrative control and operational governance of Trend Vision One, with all platform administrators located within South Africa.
• Implementation of alert correlation, threat hunting, investigation, and guided response functionalities within the Trend Vision One platform.
• Response actions including incident escalation, containment, and remediation, aligned with Trend Micro MDR severity definitions.
• Support for Cyber Risk Exposure Management (CREM) and automation playbook development.
• Data retention and operational reporting capabilities to meet SACAA’s requirements.

Skills Requirements

The skills and personnel requirements include:

• At least 10 skilled cybersecurity professionals supporting the MDR services, with specific expertise in incident response, threat hunting, and automation.
• Personnel must include roles such as Cybersecurity Incident Responders, Threat Hunters, and Platform Administrators, all located within South Africa.
• Support for SACAA’s Information Security Manager (CISM), Certified Ethical Hacker (CEH), and other cybersecurity certifications as specified.
• Provision of training to SACAA staff on Trend Vision One platform administration and incident response processes.
• Demonstrated industry knowledge and a comprehensive methodology for incident response, threat hunting, and escalation procedures.
• Ability to operationalize Cyber Risk Exposure Management (CREM) and deliver continuous operational governance.