Tender Summary: Provision of ICT Security Penetration and Vulnerability Assessment Services

Objectives

The primary objective is to appoint a qualified service provider to conduct comprehensive ICT security penetration testing and vulnerability assessments for merSETA, ensuring the identification and mitigation of potential cyber threats across its digital infrastructure.

Scope of Work

• Execute a total of eight (8) security assessments over a two-year contract period.
• Assessment scheduling and frequency will be determined by merSETA's operational requirements.
• Provide detailed, actionable reporting for each assessment, supported by substantiated documentation for invoicing.
• MerSETA will not compensate for unproductive time, inefficiencies, or rework resulting from staff changes or service provider errors.
• The contract may be awarded in whole or in part, and merSETA reserves the right to appoint multiple service providers if deemed advantageous.

Technical Requirements

• Full compliance with South African public procurement regulations, including submission of completed Standard Bidding Document (SBD) forms, Central Supplier Database (CSD) registration proof, and valid tax clearance documentation.
• Submission of a fully completed SBD 6.1 Preference Points Claim Form to qualify for socio-economic scoring under the applicable procurement framework.
• Proposals will undergo a three-stage evaluation: administrative compliance, technical specification compliance, and financial/preference scoring.
• All quotations must utilize the official merSETA pricing schedule, remain valid for a specified calendar period post-closing, and explicitly confirm compliance with specifications.
• MerSETA reserves the right to conduct site inspections, request additional verification documents, and reject any bid without obligation to accept the lowest offer.

Skills Requirements

• Assigned personnel must hold current, valid professional certifications in at least one of the following: CISA, CISM, or CSSP.
• Bidders must submit detailed CVs for all proposed team members, explicitly listing relevant qualifications, certifications, and experience.
• Valid reference letters demonstrating prior successful delivery of similar ICT security assessments are mandatory.
• Failure to submit certified CVs or reference letters will result in immediate disqualification from the evaluation process.

Key Terms & Definitions

• 80/20 Preference Point System: A South African public procurement scoring model where up to 80 points are awarded based on price competitiveness, and up to 20 points are allocated for specific socio-economic goals (e.g., black ownership, women ownership, youth ownership, and disability ownership).
• CISA, CISM, CSSP: Internationally recognized cybersecurity and IT governance certifications validating expertise in information systems auditing, security management, and secure software development.
• SBD Forms: Standardized bidding documents mandated by South African government entities to ensure transparency, compliance, and uniform contract terms across all procurement processes.
• CSD Registration: Mandatory enrollment in the Central Supplier Database, the official national registry required for all suppliers contracting with government organs and public entities.