APPOINTMENT OF A SERVICE PROVIDER TO CONDUCT A RED TEAM ASSESSMENT

Overview

Appointment of a service provider to conduct a Red Team Assessment of Trans-Caledon Tunnel Authority’s ICT environment, covering external and internal networks, Active Directory, wireless, web applications, physical access and social engineering, with post-remediation retesting, over six months. The bid targets cybersecurity service providers with proven red‑team/adversary‑emulation capabilities, MITRE ATT&CK and OWASP experience, and compliance-ready governance (POPIA, PFMA) who can deliver planning, execution, reporting, and skills transfer.

Requirements

• Mandatory certifications: ISO/IEC 27001 and ISO/IEC 27035; evidence via Annexures.
• Red Team/Adversary-emulation track record: minimum three completed engagements; demonstrated testing across vectors (external/Internal networks, AD, Wi‑Fi, web apps, physical, phishing/social engineering).
• Key personnel: Red Team Lead with at least three eligible engagements; supporting Annexure B with certifications.
• Compliance: POPIA data protection; mutual NDA; chain-of-custody for evidence; non-destructive testing; emergency stop and rapid disruption reporting.
• Deliverables and timelines: six-month engagement; planning, testing across modules, executive/technical reports, post-remediation retesting within 30 working days, retest validation.
• Procurement and governance: B‑BBEE proof; SBD forms; pricing schedule; CSD and SARS Tax Compliance status (PIN) requirements.

How to Apply

• Submission deadline: 10 November 2026 at 11:00 (RFQ 129/2026/EWSS/REDTEAM/RFQ). (RFQ text)
• Briefing: 6 November 2026 at 11:00 (non-mandatory); online via Microsoft Teams; preregistration ends 5 November 2026 at 14:00.
• Submission method: Electronic submissions to tenders06@tcta.co.za (RFQ text).
• Documents to submit: Annexures A–F, SBD 1, SBD 4, SBD 6.1, Pricing Schedule, and evidence of ISO/BBEE and project references (RFQ text).
• Registrations/pre-qualifications: Tax compliance (SARS PIN or CSD number); CSD registration; NCDAs and applicable certifications; ensure validity at RFQ closing.
• Where to obtain documents: RFQ attachments (RFQ For Red Team Assesment.pdf). (see RFQ For Red Team Assesment.pdf)