Objectives

The primary objective is to secure and sustain the City of Cape Town’s digital infrastructure through comprehensive Public Key Infrastructure (PKI) management, software licensing, professional services, and targeted cyber security training. The contract aims to ensure robust certificate lifecycle management, seamless cross-platform integration, regulatory compliance, and workforce upskilling over a 72-month period.

Scope

The tender is structured into four distinct schedules, with Schedules A and B being mutually exclusive awards:

• Schedule A: Ongoing support and maintenance of the existing AppViewX PKI environment integrated with Active Directory Certificate Services (ADCS).
• Schedule B: Supply, implementation, migration, and long-term support of an alternative PKI system to replace AppViewX Cert+, requiring minimal downtime and active-active clustering across two data centres.
• Schedule C: Procurement and management of public certificates, including SSL/TLS, wildcard, Subject Alternative Name (SAN), Intel VPro AMT, and Advanced Electronic Signature (AeSign) certificates.
• Schedule D: Delivery of accredited cyber security development programmes and certification training across multiple recognised providers.

Technical Requirements

Bidders must demonstrate solutions that meet stringent functional, architectural, and compliance standards:

• System Integration & Compatibility: Full compatibility with Windows Server 2022, SLES 15+, RHEL 9+, AIX 7.3, Apache, Tomcat, NGINX, and IIS. Solutions must integrate seamlessly with Azure Key Vault, SAP SSO, and the existing ADCS hierarchy without replacing the root CA. (ADCS is Microsoft’s built-in certificate authority role for issuing certificates within Windows domains.)
• Certificate Lifecycle Management: Automated discovery, inventory tracking, renewal alerts (30/60 days), bulk enrollment, revocation mechanisms (CRL/OCSP), and secure key storage/backup procedures.
• Security & Compliance: Adherence to CA/Browser Forum Baseline Requirements, modern cryptographic standards (RSA ≥2048-bit, ECC ≥P-256, SHA-256+), Certificate Transparency logging, and POPIA compliance. On-premise hosting is mandatory; exclusive public cloud solutions are excluded.
• AeSign Certificates: Must be issued by a vendor accredited by the South African Accreditation Authority (SAAA) per the ECT Act, supporting bulk automated signing and quantum-resistant algorithm readiness. (AeSign refers to legally binding digital signatures under South African law that carry the same weight as handwritten signatures.)
• Pricing Model: Evaluation uses a mark-up percentage applied to verified Original Equipment Manufacturer (OEM) prices. (This means final costs are calculated by adding a supplier’s quoted profit margin to the manufacturer’s base price, rather than using fixed retail rates.) Suppliers must hold valid OEM/OSM or authorised distributor accreditation to resell and support the proposed technologies.

Skills Requirements

Professional service delivery demands proven expertise, certified personnel, and verifiable vendor authorisation:

• Project Managers: Minimum seven years’ experience with PMP certification or equivalent.
• Architects: Eight years’ experience, including five years specifically designing PKI architectures.
• Subject Matter Experts (SMEs): Five or more years in cryptographic/PKI solution environments.
• User Identity Verification Specialists: One or more years’ experience in AeSign workflows.
• Vendor Authorisation: Tenderers must provide documented proof of direct or indirect accreditation from OEMs/OSMs or authorised distributors to supply, implement, and manage escalations for all proposed software and hardware.
• Experience & References: Demonstrable track record with relevant client references, use-case reports, migration plans, disaster recovery strategies, and case studies in comparable enterprise environments.