SERVICE PROVIDER TO CONDUCT PENETRATION TESTING AND VULNERABILITY ASSESSMENT SERVICES FOR A ONCE-OFF ENGAGEMENT OF APPROXIMATELY THREE (3) MONTHSClosed

Overview

NMISA seeks a service provider to conduct a one-off penetration testing and vulnerability assessment engagement for approximately three months, including two remediation retest cycles over a further up to three months. The engagement covers external and internal attack surfaces, cloud/identity, networks, wireless, web applications and other critical ICT systems, with risk-based remediation guidance and knowledge transfer.

Requirements

• Valid Professional Indemnity and Cyber Liability Insurance.
• Disclosure and NMISA approval for any proposed subcontractors.
• Demonstrable penetration testing/VA experience with client references from the last five years.
• Key personnel with 8+ years (lead) and 5+ years (testers), CVs, and 2+ hands-on offensive-security certifications.
• Comprehensive methodology aligned to PTES/WSTG/NIST SP 800-115; CVSS v4.0 scoring; evidence-based reporting and remediation.
• Compliance with SBD4/SBD6.1, CSD and BBBEE documentation; bid validity and pricing governance.

How to Apply

• Submission deadline: 22 October 2026 at 15:00; submit by email to scm3@nmisa.org (RFQ document SERVICE PROVIDER TO CONDUCT PENETRATION TESTING AND VULNERABILITY ASSESSMENT SERVICES (3 Months).pdf).
• Include completed SBD4, SBD6.1, CSD and BBBEE documentation, pricing for core items (Items 1–10) and any required annexes; optional items priced separately.
• Provide inception/Rules of Engagement, testing plan, and evidence of cloud/app scope; target-count sizing information to support pricing; pricing must be in ZAR and fixed for the core engagement.
• Deliverables include Inception RoE, vulnerability/attack surface reports, cloud/identity, web, wireless, remediation and retest reports, final consolidated report and knowledge transfer.