REQUEST FOR PROPOSALS FOR THE APPOINTMENT OF A MANAGED CYBERSECURITY SERVICES PROVIDER FOR A PERIOD OF FIVE (05) YEARSClosed

Overview

The NHBRC invites bids for the appointment of a Managed Cybersecurity Services Provider (MCSSP) for five years to deliver end-to-end cybersecurity across its national offices. Bidders should have enterprise MSSP capabilities, ISO/IEC 27001:2022 certification, a South Africa–based 24/7 SOC, and relevant public-sector experience.

Requirements

• Minimum five years’ MSSP experience; demonstrated ability to service enterprise/public-sector clients in SA.
• 24/7/365 Security Operations Centre (SOC) with SA residency for analysts; dedicated resources; SOC location disclosed.
• Certifications: ISO/IEC 27001:2022 (SOC/MCSSP), ISO 9001; personnel certifications (e.g., CISSP, CISM, GCIH/GCFA, OSCP, Microsoft security certs).
• Minimum three reference letters for similar MCSSP engagements; letters must be client-issued and verifiable.
• Governance, risk, and compliance: adherence to MITRE ATT&CK, ISO 27001, NIST CSF, POPIA, PFMA; policy development and SOC governance uplift.
• Technical scope: defence-in-depth across cloud, network, server/infrastructure, application, database, identity, endpoint, and data security; SIEM/SOAR, EDR/XDR; vulnerability management; IR/forensics; TI; ASM/CTEM; cyber awareness; data/document security.
• Data sovereignty: SA-based SOC operations and analyst access; disclose subcontractors/sub-processors.
• Mandatory documents: Pricing Schedule; SBD 1/4/3.1/6.1; CSD/SA PIN; ISO 27001 and ISO 9001 certificates; Cyber Security Professional Indemnity/Cyber Liability insurance (min R10M).
• Other: transition plan, project team CVs with certifications, client references, and a migration plan (per Annexures A–E) (see documents referenced below).

How to Apply

• Submission deadline: 10 September 2026 at 11:00 via the etenders portal. See NHBRC 01/2026 RFP documents. (NHBRC RFP 01/2026 Cybersecurity_ (002).pdf)
• Briefing: non-compulsory hybrid briefing session; details and links in the RFP (NHBRC RFP 01/2026 Cybersecurity_ (002).pdf).
• Submission method: online via https://www.etenders.gov.za/ (see e-Submission User Manual for Suppliers). (14. e-Submission_User Manual For Suppliers (1).pdf)
• Documents to complete and submit:
  • Pricing Schedule – Firm prices (Pricing Schedule Managed Cybersecurity.pdf),
  • SBD 1, SBD 3.1, SBD 4, SBD 6.1 (SBD-FORMS 1 4 3.1 6.1 (002).pdf),
  • Central Supplier Database (CSD) registration or SARS Tax Compliance PIN, and related pre-qualifications,
  • ISO/IEC 27001:2022 certificate and ISO 9001 certificate (current),
  • Cyber Security Professional Indemnity/Cyber Liability Insurance (min R10M),
  • Teaming agreements, IDs for directors, and proof of authority for signing the pricing schedule.
• Registrations/pre-qualifications: CSD, SARS PIN, tax clearance; verify credentials online where required.
• Briefing details: non-mandatory session; see links in the RFP (NHBR C).
• Access to bid documents: available on etenders portal (and referenced PDFs). (Pricing Schedule Managed Cybersecurity.pdf; SBD-FORMS 1 4 3.1 6.1 (002).pdf)

Notes: The procurement uses a three-stage evaluation (Stage 1 compliance; Stage 2: Stage 2A paper-based technical (80 points) and Stage 2B live SOC demo (20 points); Stage 3 price). Minimum threshold to proceed is 80/100 (with Stage 2B at least 10). See Annexures A–C for detailed criteria and scoring. All references drawn from NHBRC RFP 01/2026 documents.