Objectives

The primary objective of this tender is to procure independent penetration testing and vulnerability assessment services for the SABC internet websites, internal network, and core systems over a period of three years. The aim is to ensure compliance with industry IT security standards, mitigate risks, and enhance the security posture of the SABC’s digital assets through regular assessments, simulated attacks, and security awareness initiatives.

Scope

The scope encompasses:

• Annual vulnerability assessments and penetration tests for all scoped systems, including websites, internal networks, core systems (such as the TV License system), and cloud configurations.
• Phishing simulations, social engineering, zero-day threat alerts, and security trend analysis.
• Adhoc support hours for incident response and crisis management.
• Security presentations and training for key staff.
• Assessment of cloud configurations and security patches.
• Testing of network segmentation, access management solutions, and internal website vulnerabilities.
• Simulated Red, Blue, and Purple Team exercises, including tabletop simulations.

The services should be performed using an alternative solution to Rapid7 and Nessus, with the preferred vendor providing the tools and methodologies for comprehensive security testing.

Technical Requirements

• Provision of penetration testing and vulnerability assessments annually over three years.
• Utilization of non-open-source tools for phishing simulations and security testing.
• Capability to conduct external and internal penetration tests, including testing of web and mobile applications, cloud environments, and network devices.
• Assessment of security controls such as identity and access management, operating systems (Windows, Linux, Mac OS), and legacy systems.
• Testing of network devices (switches, routers, firewalls, printers) and verification of network segmentation.
• Provision of detailed risk assessment reports with remediation recommendations, emergency service proposals, and periodic cybersecurity presentations.
• Adherence to SABC’s information security policies and national security requirements.
• Experience of project leads (minimum 5 years) and security analysts (minimum 3 years).

Skills Requirements

• Minimum of one project lead with at least 5 years’ experience leading ethical hacking projects, with comprehensive CVs demonstrating relevant expertise.
• At least two IT security analysts or engineers, each with a minimum of 3 years’ experience, and CVs supporting their qualifications.
• Proven experience in conducting external and internal penetration tests, social engineering, phishing simulations, and red/blue team exercises.
• Certifications such as ISACA’s CISA and CISM for key personnel.
• Ability to develop and present detailed technical and executive reports, including remediation strategies and security awareness training.
• Capability to support incident response and crisis management with flexible support options, including on-site testing and remote assistance.