Objectives

The primary objective of this tender is to procure firewall appliances with five (5) years of support and maintenance for both the Production and Disaster Recovery sites of the Electoral Commission. The solution aims to enhance security by configuring, managing, and monitoring firewalls, enabling administrators to set security policies, track events, install updates, and demonstrate compliance with standards such as NIST, OWASP, and POPIA. Additionally, the project seeks to identify and mitigate firewall vulnerabilities, security misconfigurations, redundant rules, and provide automated security gap mitigations, ensuring a secure, high-availability ICT environment supporting transparent and fair elections.

Scope

The scope encompasses the end-to-end deployment of physical firewall appliances supporting high-availability (HA) configurations across two data centers, including:

• Physical installation, cabling, and interconnectivity (heartbeat, sync)
• Migration and assessment of existing security policies, rules, VPN configurations, NAT, and objects
• Provision of all necessary hardware, software, and security subscriptions
• Integration with existing infrastructure such as switches, routers, Active Directory, SIEM (FortiSIEM), Service Desk, and time synchronization services
• Support for growth and expansion of throughput, session capacity, and security services without complete platform replacement
• Provision of documentation including design documents, configuration guides, change logs, and as-built reports
• Support and maintenance services for hardware and software over five years

Technical Requirements

The solution must meet or exceed the following minimum technical specifications:

• High-speed interfaces: 10Gbps, 25Gbps, 40Gbps, or 100Gbps connectivity
• Fiber ports: minimum of four (4) per appliance supporting copper and fiber interfaces (RJ-45, SFP+, QSFP+)
• Redundant hot-swappable power supplies (minimum of two)
• Multi-core processing architecture separating management, control, and inspection functions
• Integration with enterprise authentication systems (LDAP, Active Directory, RADIUS, Kerberos, cloud providers)
• High capacity stateful firewall throughput suitable for large enterprise/data center environments
• NGFW throughput with security services (IPS, application control, malware protection)
• Threat prevention throughput with advanced security services
• Support for high-capacity IPSec VPN (site-to-site and remote access)
• Concurrent sessions: suitable for enterprise-scale deployments
• Support for high session establishment rates and active-active/passive HA modes
• Support for SSL/TLS, MFA, static/dynamic routing, network segmentation, NAT, QoS, and access control
• Advanced threat detection: behavioral analysis, anomaly detection, machine learning techniques
• Comprehensive logging, analytics, application control, intrusion prevention, malware detection, anti-spam, DNS security, sandboxing, phishing, DDoS mitigation, web filtering, proxy, SSL inspection, and content extraction
• Centralized management with role-based access, reporting, log retention (minimum 12 months), and compliance validation
• Support for automated remediation, rule optimization, and compliance against standards such as NIST, OWASP, POPIA
• Support and maintenance including hardware replacement, firmware/software updates, OEM support, and 24/7 incident response

Skills Requirements

The bidder must demonstrate:

• Proven experience in deploying enterprise-grade NGFW solutions, preferably in high-availability configurations
• Capability to integrate with existing ICT infrastructure and security systems
• Expertise in migrating existing firewall policies, rules, and VPN configurations with validation and user acceptance testing
• Ability to provide comprehensive documentation, design, configuration guides, and as-built reports
• Strong support and maintenance capacity, including hardware replacement, firmware updates, and OEM support services
• Experience in compliance validation against standards such as NIST, OWASP, POPIA
• Technical personnel with relevant certifications and experience in network security, firewall management, and security compliance