APPOINTMENT OF A SUITABLY QUALIFIED SERVICE PROVIDER TO DELIVER AN ENTERPRISE CYBERSECURITY MATURITY ASSESSMENT, SECURITY ARCHITECTURE REVIEW, VAPT, CRITICAL ASSET CONFIGURATION REVIEW, IT/OT INTEGRATION TESTING, OT SITE ASSESSMENTS, CYBERSECURITY STRATEGY AND ROADMAP, AND AUTOMATED GRC PLATFORM FOR PRASA.Closed

Overview

Appointment of a service provider to deliver an enterprise cybersecurity maturity assessment, security architecture review, VAPT, critical asset configuration review, IT/OT integration testing, OT site assessments, cybersecurity strategy and roadmap, and automated GRC platform for PRASA. Bidders should have expertise across IT and OT cybersecurity, governance, risk and compliance, and experience delivering a live GRC platform. Scope covers nine workstreams including NIST CSF 2.0 alignment, Zero Trust, SABSA, IEC 62443, and OT risk programs (per the attached scope).

Requirements

• Proven delivery of enterprise cybersecurity maturity assessments using NIST CSF 2.0 for large, critical-infrastructure environments; mapped to ISO 27001/27002, COBIT, NIST 800-53, POPIA, and NCPF.
• Ability to design and deliver a target-state security architecture (Zero Trust, IT/OT convergence) with SABSA and PERA references.
• Capability to perform comprehensive VAPT (external, internal, web/mobile/API) per CREST/OWASP standards, with RoE and PoC evidence.
• Experience conducting IT/OT integration testing and multi-site OT assessments (IEC 62443, Purdue PERA, CISA ZTMM).
• Proven delivery of an automated, PRASA-owned GRC platform with real-time dashboards, evidence collection, and multi-framework compliance.
• Compliance readiness: SARS tax PIN, TCS, CSD, VAT requirements; bid must use official forms; signatory authority; 60 working-day bid validity; strict adherence to late-delivery rules.

How to Apply

• Submission deadline and time: 14 July 2026 at 10:00 (RFQ FOR CISO 10372224.docx).
• Submission method: Hand deliver to PRASA, reception, Ms Annah Hlaele, 30 Wolmarans Street, Johannesburg (UMJANTSHI BUILDING).
• Documents to submit: Official bid response forms; Tax Compliance requirements (PIN, TCS or CSD number); proof of authority; VAT number; evidence of accreditation where applicable (as per RFQ).
• Registrations/pre-qualifications: Tax compliance (SARS PIN or TCS), CSD number if no TCS, VAT registration; ensure compliance with PRASA conditions of purchase.
• Briefing session: Not specified in the provided documents.
• Where to obtain bid documents: RFQ documents and scope are attached (RFQ FOR CISO 10372224.docx; SCOPE OF WORK - CISO_ 10372224.pdf).