Objectives

The primary objective is to establish and maintain a readily available specialist Digital Forensics and Incident Response (DFIR) capability. The appointed provider will be activated on a 24/7 basis to manage cyber incidents, conduct forensic investigations, contain threats, preserve digital evidence, provide remediation guidance, and deliver executive-level reporting throughout the twelve-month contract period.

Scope of Work

The service provider must deliver end-to-end DFIR services, accessible both remotely and onsite. Core activities include emergency activation, incident triage, containment, eradication, forensic investigation, recovery support, and post-incident reviews. Additional responsibilities encompass:

• Proactive threat hunting and dark web/breached credential monitoring
• Cybersecurity assessments, penetration testing, vulnerability assessments, and controlled adversary simulations
• Forensic data collection, timeline analysis, malware reverse engineering, and chain-of-custody maintenance
• Expert reporting suitable for internal decision-making, regulatory engagement, or legal proceedings
• Stakeholder briefings, remediation guidance, environment hardening, and safe service restoration
• Regulatory or legal liaison support and post-incident review activities

Technical Requirements

Bidders must submit a documented 24/7 DFIR activation and escalation procedure, alongside detailed forensic evidence handling methodologies covering chain of custody, secure storage of client copies, and reporting protocols. Pricing must cover a fixed retainer package inclusive of 160 hours of services, with clearly defined hourly rates for additional work. All costs must be comprehensive, covering applicable taxes, logistics, travel, and subsistence. Mandatory compliance documentation includes SARS tax clearance verification, Central Supply Database (CSD) registration, Broad-Based Black Economic Empowerment (B-BBEE) certification, completed statutory bidding forms, conflict of interest declarations, and Know Your Customer (KYC) documentation. Providers must demonstrate a robust methodology aligning with all terms of reference and pass financial, legal, and reputational due diligence checks.

Skills and Experience Requirements

The bidder must demonstrate at least ten years of DFIR experience, with proven track records supporting large banks, financial institutions, or state-owned entities. Prior engagement with regulatory or security bodies (e.g., Information Regulator, State Security Agency, Auditor-General) is required. The proposed team must include qualified analysts and team leads with verified certifications and substantial forensic analysis experience. Personnel must be capable of deploying onsite to the client’s headquarters. Evidence of experience in threat-actor engagement support, including legally authorized negotiation or simulated exercises, is mandatory. A comprehensive company profile and curriculum vitae for key personnel must be submitted.

Notes on Unusual or Complicated Terms

• Retainer Model: A fixed-fee arrangement guaranteeing priority access to specialist services up to a predetermined hour cap (160 hours), with pre-negotiated rates for overages. This eliminates per-incident procurement delays during active crises.
• 80/20 Preference Point System: A South African public procurement scoring mechanism allocating 80 points to competitive pricing and 20 points to socio-economic goals, specifically B-BBEE ownership by historically disadvantaged groups. Strict documentary proof is required to claim these points.
• Threat-Actor Engagement Support: Specialized services involving direct communication or simulated negotiations with cyber attackers to mitigate damage, strictly bound by client authorization and legal frameworks.
• Controlled Adversary Simulation: Authorized red-team exercises that mimic real-world attack techniques against the client’s infrastructure to validate defensive controls under predefined rules of engagement.