# SERVICE PROVIDER TO CONDUCT PENETRATION TESTING AND VULNERABILITY ASSESSMENT SERVICES FOR A ONCE-OFF ENGAGEMENT OF APPROXIMATELY THREE (3) MONTHS

> This tender closed on 2026-10-22.

- **Reference:** PR012783
- **Issuer:** [NATIONAL METROLOGY INSTITUTE OF SOUTH AFRICA](https://za.bidwunder.com/tenders/issuer/national-metrology-institute-of-south-africa.md)
- **Region:** National
- **Type:** Request for quotation
- **Published:** 2026-10-15
- **Closing date:** 2026-10-22 17:00 SAST
- **Sectors:** [IT services](https://za.bidwunder.com/tenders/sector/J62.md)

## Summary

#### Overview
**NMISA seeks a service provider to conduct a one-off penetration testing and vulnerability assessment engagement for approximately three months, including two remediation retest cycles over a further up to three months.** The engagement covers external and internal attack surfaces, cloud/identity, networks, wireless, web applications and other critical ICT systems, with risk-based remediation guidance and knowledge transfer.

#### Requirements
- Valid Professional Indemnity and Cyber Liability Insurance.
- Disclosure and NMISA approval for any proposed subcontractors.
- Demonstrable penetration testing/VA experience with client references from the last five years.
- Key personnel with 8+ years (lead) and 5+ years (testers), CVs, and 2+ hands-on offensive-security certifications.
- Comprehensive methodology aligned to PTES/WSTG/NIST SP 800-115; CVSS v4.0 scoring; evidence-based reporting and remediation.
- Compliance with SBD4/SBD6.1, CSD and BBBEE documentation; bid validity and pricing governance.

#### How to Apply
- Submission deadline: 22 October 2026 at 15:00; submit by email to scm3@nmisa.org (RFQ document SERVICE PROVIDER TO CONDUCT PENETRATION TESTING AND VULNERABILITY ASSESSMENT SERVICES (3 Months).pdf).
- Include completed SBD4, SBD6.1, CSD and BBBEE documentation, pricing for core items (Items 1–10) and any required annexes; optional items priced separately.
- Provide inception/Rules of Engagement, testing plan, and evidence of cloud/app scope; target-count sizing information to support pricing; pricing must be in ZAR and fixed for the core engagement.
- Deliverables include Inception RoE, vulnerability/attack surface reports, cloud/identity, web, wireless, remediation and retest reports, final consolidated report and knowledge transfer.

## Description

SERVICE PROVIDER TO CONDUCT PENETRATION TESTING AND VULNERABILITY ASSESSMENT SERVICES FOR A ONCE-OFF ENGAGEMENT OF APPROXIMATELY THREE (3) MONTHS

## Documents

- SERVICE PROVIDER TO CONDUCT PENETRATION TESTING AND VULNERABILITY ASSESSMENT SERVICES FOR 3 MONTHS.pdf

Documents download with a free BidWunder account.

## Published on

- [eTenders OCDS API](https://www.etenders.gov.za/Home/opportunities?id=1)

More open tenders: https://za.bidwunder.com/tenders.md

---

> Source: https://za.bidwunder.com/tenders/service-provider-to-conduct-penetration-testing-and-vulnerability-assessment-ser-1fd5b6f7