# APPOINTMENT OF A SUITABLY QUALIFIED SERVICE PROVIDER TO DELIVER AN ENTERPRISE CYBERSECURITY MATURITY ASSESSMENT, SECURITY ARCHITECTURE REVIEW, VAPT, CRITICAL ASSET CONFIGURATION REVIEW, IT/OT INTEGRATION TESTING, OT SITE ASSESSMENTS, CYBERSECURITY STRATEGY AND ROADMAP, AND AUTOMATED GRC PLATFORM FOR PRASA.

> This tender closed on 2026-07-14.

- **Reference:** HO/ICT/10372224/07/2026
- **Issuer:** [Passenger Rail Agency of South Africa](https://za.bidwunder.com/tenders/issuer/passenger-rail-agency-of-south-africa.md)
- **Region:** National
- **Type:** Request for quotation
- **Published:** 2026-07-06
- **Closing date:** 2026-07-14 12:00 SAST
- **Sectors:** [Administrative and support services](https://za.bidwunder.com/tenders/sector/N.md)

## Summary

#### Overview
**Appointment of a service provider to deliver an enterprise cybersecurity maturity assessment, security architecture review, VAPT, critical asset configuration review, IT/OT integration testing, OT site assessments, cybersecurity strategy and roadmap, and automated GRC platform for PRASA.** Bidders should have expertise across IT and OT cybersecurity, governance, risk and compliance, and experience delivering a live GRC platform. Scope covers nine workstreams including NIST CSF 2.0 alignment, Zero Trust, SABSA, IEC 62443, and OT risk programs (per the attached scope).

#### Requirements
- Proven delivery of enterprise cybersecurity maturity assessments using NIST CSF 2.0 for large, critical-infrastructure environments; mapped to ISO 27001/27002, COBIT, NIST 800-53, POPIA, and NCPF.  
- Ability to design and deliver a target-state security architecture (Zero Trust, IT/OT convergence) with SABSA and PERA references.  
- Capability to perform comprehensive VAPT (external, internal, web/mobile/API) per CREST/OWASP standards, with RoE and PoC evidence.  
- Experience conducting IT/OT integration testing and multi-site OT assessments (IEC 62443, Purdue PERA, CISA ZTMM).  
- Proven delivery of an automated, PRASA-owned GRC platform with real-time dashboards, evidence collection, and multi-framework compliance.  
- Compliance readiness: SARS tax PIN, TCS, CSD, VAT requirements; bid must use official forms; signatory authority; 60 working-day bid validity; strict adherence to late-delivery rules.

#### How to Apply
- Submission deadline and time: 14 July 2026 at 10:00 (RFQ FOR CISO 10372224.docx).  
- Submission method: Hand deliver to PRASA, reception, Ms Annah Hlaele, 30 Wolmarans Street, Johannesburg (UMJANTSHI BUILDING).  
- Documents to submit: Official bid response forms; Tax Compliance requirements (PIN, TCS or CSD number); proof of authority; VAT number; evidence of accreditation where applicable (as per RFQ).  
- Registrations/pre-qualifications: Tax compliance (SARS PIN or TCS), CSD number if no TCS, VAT registration; ensure compliance with PRASA conditions of purchase.  
- Briefing session: Not specified in the provided documents.  
- Where to obtain bid documents: RFQ documents and scope are attached (RFQ FOR CISO 10372224.docx; SCOPE OF WORK - CISO_ 10372224.pdf).

## Description

APPOINTMENT OF A SUITABLY QUALIFIED SERVICE PROVIDER TO DELIVER AN ENTERPRISE CYBERSECURITY MATURITY ASSESSMENT, SECURITY ARCHITECTURE REVIEW, VAPT, CRITICAL ASSET CONFIGURATION REVIEW, IT/OT INTEGRATION TESTING, OT SITE ASSESSMENTS, CYBERSECURITY STRATEGY AND ROADMAP, AND AUTOMATED GRC PLATFORM FOR PRASA.

APPOINTMENT OF A SUITABLY QUALIFIED SERVICE PROVIDER TO DELIVER AN ENTERPRISE CYBERSECURITY MATURITY ASSESSMENT, SECURITY ARCHITECTURE REVIEW, VAPT, CRITICAL ASSET CONFIGURATION REVIEW, IT/OT INTEGRATION TESTING, OT SITE ASSESSMENTS, CYBERSECURITY STRATEGY AND ROADMAP, AND AUTOMATED GRC PLATFORM FOR PRASA.

Conditions: N/A

## Documents

- RFQ FOR CISO 10372224.docx..docx
- SCOPE OF WORK - CISO\_ 10372224.pdf..pdf
- RFQ FOR CISO 10372224.docx

Documents download with a free BidWunder account.

## Published on

- [eTenders OCDS API](https://www.etenders.gov.za/Home/opportunities?id=1)
- [eTenders.gov.za](https://www.etenders.gov.za)

More open tenders: https://za.bidwunder.com/tenders.md

---

> Source: https://za.bidwunder.com/tenders/appointment-of-a-suitably-qualified-service-provider-to-deliver-an-enterprise-cy-6f1b79ce