The Border Management Authority seeks a single-vendor SASE solution for 3,000 users over three years, covering procurement, installation, configuration, and managed operations. Required capabilities include ZTNA, SWG, FWaaS, TLS inspection, DNS security, sandboxing, and a South African PoP with 99.999% uptime.
The Border Management Authority (BMA) has issued a Request for Proposal for the appointment of a single-vendor Secure Access Service Edge (SASE) provider to procure, install, configure, and manage a cloud-delivered security platform for a three-year period, including professional services. The solution is intended to replace an environment where private applications are exposed over the public internet, security visibility and policy enforcement are decentralised, and network security controls such as firewalling and intrusion prevention are inadequate. The BMA operates across Ports of Entry, remote and mobile users, cloud-hosted systems, and planned on-premises infrastructure, and requires identity- and context-aware access that does not backhaul internet traffic to a central site for inspection.
The required scope includes licensing for 3,000 users with the ability to scale, and a core set of capabilities: Secure Web Gateway, Zero Trust Network Access, Firewall-as-a-Service across all ports and protocols, TLS 1.3 inspection, threat prevention and IPS, URL filtering, DNS security, inline cloud sandboxing, a Secure Enterprise Browser, and dedicated egress IP addresses. Future capabilities such as CASB and Data Loss Prevention must be supported by the platform and priced separately. Integration is required with Microsoft Entra ID, Active Directory, Microsoft MFA, and third-party SIEM platforms. Mandatory requirements include ISO/IEC 27001 certification for both the OEM and the bidder, a current SOC 2 Type II report for the OEM, an OEM letter confirming an operational South African PoP where security processing, log storage, and sandboxing occur within South Africa, and OEM certification for the Lead Security Engineer. Service levels require 99.999% uptime, 24/7 critical incident support, a co-managed operating model with a RACI matrix, and instructor-led training for three BMA ICT Security officials. Data residency must comply with POPIA and the National Data and Cloud Policy.
Evaluation proceeds in stages: administrative compliance, mandatory requirements, technical evaluation (project manager and lead engineer experience, client references for SASE/SSE implementations, a ten-area solution proposal, and independent analyst recognition) with a minimum threshold of 75 out of 100, a live demonstration using the proposed OEM platform with a minimum threshold of 75 out of 100, and finally price and specific goals scored on the 80/20 preference system. Bidders must register on the Central Supplier Database, provide a valid tax compliance PIN, and submit all forms through the eTender portal by the closing date. A non-compulsory briefing session was held on 19 November 2026, and non-South African citizens are only permitted if vetted and holding a valid work permit.
This tender suits established ICT security solution providers and managed security service providers that are authorised or accredited partners of a SASE/SSE OEM and can demonstrate prior SASE or SSE implementations for clients, particularly in South African government or large enterprise environments. Applicants must hold ISO/IEC 27001 certification, have a Lead Security Engineer with OEM certification and a qualified Project Manager, and be able to deliver a live platform demonstration. Value-added resellers and systems integrators with cloud security expertise may apply through a formal OEM-backed arrangement. Small businesses may benefit from the 80/20 preference system if they hold a valid B-BBEE certificate or affidavit, or qualify as Black-owned, women-owned, youth-owned, or military veteran-owned enterprises, but must still meet all technical and mandatory requirements. Businesses without a South African PoP partnership, without the required certifications, or without relevant implementation references are unlikely to qualify.
Starter gives you this tender's documents, requirements, location and buyer contacts, plus every new tender matched to your business, for R199/month.
Cancel anytime · No contract · Secure checkout by Paystack
See your matched tenders before you pay, then get their documents and buyer contacts straight away. Cancel anytime, no contract.
