About this opportunity
AI summaryThe National Home Builders Registration Council seeks proposals to appoint a managed cybersecurity services provider for a five-year contract. The successful vendor must deliver 24/7/365 monitoring, detection, triage, containment, and incident response, while reducing cyber risk exposure and supporting compliance with ISO/IEC 27001, POPIA, and PFMA. Scope requirements also include managing layered defenses across cloud, network, server, application, and database environments, conducting proactive threat hunts, and updating incident response plans. Only South African organizations registered on the National Treasury's Central Supplier Database with valid tax compliance may bid. Bidders must submit proposals online via https://www.etenders.gov.za/ by 11:00 on November 23, 2026. A non-compulsory virtual hybrid briefing session will take place via Microsoft Teams at 11:00 on November 6, 2026. Technical evaluations assess vendor experience, client reference letters, project team qualifications, and a practical live demo site visit. Bidders must score at least 80 out of 100 on the final technical score, including at least 10 points on the site visit, to qualify for final price and preference evaluation.
Buyer and opportunity details
- Client
- NHBRC
- Solicitation No.
- NHBRC 12/2026
Scope of work
- 24/7/365 monitoring, detection, triage, containment, response coordination, and reporting
- Layered security design across cloud, network, server, infrastructure, application, and database security
- Use-case catalogue mapped to MITRE ATT&CK with detection tuning
- Automated and analyst-driven runbooks and playbooks including rollback steps
- Proactive threat hunting including weekly baseline hunts and monthly deep hunts
- Incident response retainer with surge capacity, defined SLAs, and forensics capability
- Continuous threat exposure management, exposure prioritisation, and remediation tracking
- Annual cyber awareness programme with role-based training and quarterly phishing simulations
How proposals are evaluated
| Criterion | Weight / scoring |
|---|---|
| Stage 1: Compliance check of bid requirements | Not specified |
| Stage 2 – Part A: Paper-Based Technical Evaluation | 80 points |
| Stage 2 – Part B: Live SOC Demonstration | 20 points |
| Stage 3: Price | 80 points |
| Stage 3: Preference Points | 20 points |
Minimum qualifications
- Registration on National Treasury's Central Supplier Database (CSD)
- Tax compliant status confirmed by SARS Tax Clearance Certificate
- Minimum five (5) years proven experience delivering enterprise-grade managed cybersecurity services
- Operational capability to provide 24/7/365 SOC services from an operational SOC located within South Africa
- Valid ISO/IEC 27001 certification for Information Security Management System
- Valid ISO 9001 Certificate for Quality Management System
- Minimum three (3) contactable reference letters for similar MCSSP engagements
- Qualified key personnel including Project Manager, CISO, SOC lead, and Cyber Security Architect
Documents to include with your response
- Pricing Schedule completed and signed, with detailed cost breakdown and annual escalation
- SBD 4 – Bidders Disclosure Form completed and signed
- Valid ISO 27001 Certificate
- Valid ISO 9001 Certificate
- Valid Cyber Security Professional Indemnity and/or Cyber Liability Insurance certificate or policy schedule
- SBD 1 – Invitation to Bid completed and signed
- SBD 6.1 – Preference Claim Form completed and signed
- Minimum of three (3) contactable reference letters
- Detailed project proposal and migration plan
- Project team organogram, comprehensive CVs, and qualification/certification documents
Key dates
- Virtual non-compulsory hybrid briefing session
- 06 November 2026 11:00
- Closing Date
- 23 November 2026 11:00
How to submit
- Method
- Online via National Treasury e-Tender Publication portal
- Instructions
- Submitted online at https://www.etenders.gov.za/ and marked for Attention: Supply Chain Manager.
Contract details
- Term
- Five (05) years
- Place of performance
- Republic of South Africa
- Insurance and bonding
- Valid Cyber Security Professional Indemnity and/or Cyber Liability Insurance to a value specified by NHBRC
