Objectives

The Western Cape Provincial Parliament aims to procure a fully managed, secure, and highly available network infrastructure solution. The primary objectives are to ensure uninterrupted connectivity for a hybrid workforce, enforce robust cybersecurity governance aligned with national standards, integrate seamlessly with existing security monitoring platforms, and maintain business continuity through redundant architecture and strict service level agreements.

Scope

• Network Connectivity: Provision and management of primary fibre and secondary wireless internet links with automatic failover.
• Managed Security Services: End-to-end administration of next-generation firewalls, intrusion detection/prevention systems (IDS/IPS), vulnerability management, and privileged access controls.
• Public DNS: Hosted primary and geographically dispersed secondary DNS services with DDoS mitigation and security extensions.
• Service & Project Management: Dedicated account and project leadership, monthly performance reporting, virtual review meetings, and structured incident escalation.
• Deployment & Transition: Phased implementation covering discovery, design, migration, parallel testing, and operational handover within fixed deadlines.

Technical Requirements

• Bandwidth & Availability: 250 Mbps primary fibre and 250 Mbps ICASA-compliant licensed wireless backup. Minimum 99.9% uptime across all services. Uncapped, synchronous 1:1 contention ratio with zero fair use restrictions.
• Redundancy & Traffic Management: Deployment of BGP and HSRP (or equivalents) for seamless link switching. Quality of Service (QoS) configuration to prioritise critical parliamentary applications.
• Firewall & IDS/IPS: Rule lifecycle management adhering to ITIL change control, quarterly security reviews, and alignment with NIST cybersecurity functions. Vulnerability remediation targets: Critical (7 days), High (14 days), Medium (30 days).
• Monitoring & Integration: Bidirectional integration with the client’s Microsoft Sentinel SIEM. 24/7/365 joint incident response with the client’s Security Operations Centre. Administrative and security logs retained for 12 months with immediate forensic access upon request.
• DNS Architecture: Secondary DNS located outside the Cape Town region to guarantee name resolution during local disasters or internet outages. Mandatory DNSSEC, DDoS protection, and a secure web portal with Multi-Factor Authentication (MFA).
• Implementation Schedule: Commencement by 30 April 2027, go-live by 15 June 2027, and final DNS cutover by 25 June 2027.

Skills Requirements

• Technical Lead: Must hold a recognised network/security certification (e.g., CCIE, CCNP, NSE, PCNSE) and demonstrate a minimum of five years’ experience managing comparable enterprise environments.
• Support Specialists: Assigned DNS expert, security/firewall analyst, and service/account management representative.
• Project Manager: Certified in PRINCE2, PMBOK, or PMP, with proven capability to execute complex infrastructure migrations using defined methodologies, schedules, and risk mitigation strategies.
• Organisational Credentials: Valid SOC 1/SOC 2 or ISO 27001 certification, alongside ISO 9001 quality management certification.
• Proven Track Record: Demonstrated experience delivering similar managed security and connectivity solutions to public sector clients, supported by verifiable reference letters.

Key Terminology & Unusual Requirements

• BGP/HSRP: Border Gateway Protocol and Hot Standby Router Protocol are routing mechanisms that automatically redirect network traffic to backup links if the primary connection or router fails.
• SSA Clearance: Personnel must obtain vetting from the State Security Agency before accessing the client’s premises, which are legally classified as critical infrastructure under South African legislation.
• NIST Functions: A cybersecurity framework mandating a structured security lifecycle comprising Identify, Protect, Detect, Respond, and Recover phases.
• 1:1 Contention Ratio: Guarantees dedicated bandwidth where the provider’s capacity is not shared with external users, ensuring consistent, predictable performance.
• SIEM Integration: Requires real-time data sharing with Microsoft Sentinel, enabling correlated security event analysis and independent client-side monitoring capabilities.