The appointment of a qualified and experienced service provider to deliver comprehensive Information Security and Cybersecurity services for a period of three (3) years.Closed

Overview

The appointment of a qualified and experienced service provider to deliver comprehensive Information Security and Cybersecurity services for a period of three (3) years. Open to SA-based cybersecurity providers with banking/regulatory sector experience, capable of operating a 24/7 Security Operations Centre (SOC) and delivering end-to-end cyber defense. Required certifications include at least three of ISO 27001, PCI DSS QSA, CISSP, CEH, OSCP, with local presence, tax compliance, and data sovereignty.

Requirements

• 24/7 Security Operations Centre (SOC) with SIEM/SOAR; ransomware defense procedures; forensic capability; monthly/quarterly reporting.
• Endpoint, network, identity, data protection, cloud, and email security coverage (EDR/XDR, zero-trust, PAM, DLP, CSPM/CWPP, MS 365 protection).
• Regulatory compliance: SARB, PCI DSS, POPIA, ISO/IEC 27001, NIST CSF; governance, risk, and audit readiness.
• Local South Africa presence: SA office and ongoing local support; hosting within SA; data sovereignty; SA logs within borders.
• Experience: minimum 5 years in IT security services; demonstrated banking/financial sector delivery with 3+ reference letters.
• Certifications: provider must be certified or partnered with at least three of ISO 27001, PCI DSS QSA, CISSP, CEH, OSCP.
• Insurance: Professional Indemnity Insurance minimum R20 million.
• Specific deliverables: Postbank-specific cyber defense/ransomware strategy, cyber recovery design, migration/exit package, knowledge transfer, and ongoing capability development.
• Transition and exit: structured handover, documentation, tooling portability, and no vendor lock-in.
• Mandatory evidence: two named resources for mandatory roles (CISO and CISSP) with CVs and certifications; local SA premises proof; SARS tax compliance PIN or CSD number.

How to Apply

• Briefing: non-compulsory on 31 August 2026 at 11:00 via Microsoft Teams (join link provided in tender).
• Closing: 18 September 2026 at 11:00.
• Submission: via email to RFP@PostBank.co.za (as stated on the cover page). Also note option to deposit documents in the bid box per the cover page.
• Documents to submit: official bidding forms (SBDs), Pricing Schedule (Section 5), technical response (SOC, architecture, strategies, transition plans), CVs/proof for required staff, evidence of banking sector experience, SARS/CSD/tax compliance details, and local SA premises proof.
• Compliance: 180-day bid validity from closing date; registrations and pre-qualifications (SARS PIN, CSD) as required; proof of authority for signatory.
• Documentation source: RFB/P No. 04/06/26-27 – Cybersecurity Services (RFP pdf) (see filename in attached documents).