APPOINTMENT OF A SERVICE PROVIDER TO CONDUCT PENETRATION TESTING AND VULNERABILITY ASSESSMENT SERVICES FOR A ONCE-OFF ENGAGEMENT OF APPROXIMATELY THREE (3) MONTHSClosed

Overview

NMISA seeks a service provider to conduct penetration testing and vulnerability assessment services for a one-off engagement of approximately three months. Suitable bidders are cybersecurity service providers with proven hands-on penetration testing, vulnerability assessment capabilities, and experience across external/internal networks, cloud/identity, web apps and wireless environments (in line with PTES/WSTG/NIST guidance).

Requirements

• Valid Professional Indemnity and Cyber Liability Insurance appropriate to the engagement; coverage evidence or undertaking required.
• Compliance documents: SBD 4 and SBD 6.1 completed, signed; CSD report; valid B-BBEE certificate.
• Disclosure of proposed subcontractors with NMISA written approval required for any testing work.
• Access to licensed testing tools and specialist equipment; adherence to data protection and NMISA data-handling rules.
• Demonstrated team capabilities: project lead and testers with relevant experience; CVs and certifications (hands-on offensive-security credentials preferred).
• Detailed methodology aligned to PTES/WSTG/NIST; clear testing approach, risk rating, remediation and retesting plans.
• Ability to deliver all core deliverables and meet the service levels; acceptance by NMISA required.

How to Apply

• Submit proposals by email to scm3@nmisa.org by 2026-10-23 14:00. Include completed attached SBD forms and B-BBEE certificate. (See RFQ documents; briefing details referenced in the attached files: briefing address CSIR Campus, Building 5, Meiring Naude Road, Brummeria, Pretoria, 0182; document filenames: SERVICE PROVIDER TO CONDUCT PENETRATION TESTING AND VULNERABILITY ASSESSMENT SERVICES (3 Months) (1).docx.pdf)
• Briefing/clarification: briefing venue as above; date/time not specified in metadata.
• Pricing: provide a fixed core bid for core services (inception, external/internal/azure/identity/wireless/web app testing, remediation workshop, two remediation retest cycles, final report) plus separate optional rates; all prices in ZAR, VAT inclusive/exclusive as applicable.
• Documentation: ensure SBD 4, SBD 6.1, CSD, and valid B-BBEE certificate are attached; provide evidence of professional indemnity/cyber liability insurance and disclose any subcontractors.
• Documents to obtain from NMISA: detailed target sizing/inception information and Rules of Engagement prior to intrusive testing (to be provided after award).