SIEM/SOAR Solution Provision and 36-Month Support

The Inkomati-Usuthu Catchment Management Agency (IUCMA), a National Public Entity listed under Schedule 3A of the PFMA, is seeking a qualified service provider to deliver a Security Information and Event Management (SIEM) solution integrated with Security Orchestration, Automation and Response (SOAR). The contract runs for 36 months and covers the provision, implementation, configuration, integration, licensing, maintenance and support of the platform. The solution is intended to strengthen IUCMA's cybersecurity posture through centralised, real-time security monitoring, log management, threat detection and hunting, threat intelligence, automated incident response, and security reporting across the agency's ICT environment.

The platform must integrate with IUCMA's current environment, which includes a four-node VxRail virtualisation environment hosting 18 virtual machines, two Sophos firewalls, 118 endpoint devices with EDR telemetry, two physical servers, a backup server, a satellite office, Microsoft 365 and SharePoint Online. The solution must also accommodate reasonable growth during the contract period. Minimum requirements include 26 core deliverables such as log collection, normalisation and archiving; rule-based and behavioural threat detection; configurable SOAR playbooks; IDS/IPS capability or integration; incident lifecycle management; role-based access control; a full audit trail; configurable dashboards and compliance reporting; and standard API or connector-based integration. The service provider must deliver 24/7 monitoring capability and support Security Operations Centre functions. Supply and delivery must be completed within 45 days of appointment, and a Service Level Agreement must be signed within 30 days of award. The pricing schedule separates once-off implementation and training costs for five ICT team members from annual licence renewal and three-year remote end-user licence support, all inclusive of VAT.

Bidders must attend a compulsory online briefing on 04 November 2026 at 10:00 via Microsoft Teams and register their company name on the attendance register. Mandatory requirements include proof of CSD registration, tax compliance, and OEM authorisation as an authorised reseller of the SIEM solution or proof of ownership. Bids are scored on administrative compliance, mandatory criteria, technical functionality and price/specific goals. The technical stage is scored out of 100 points with a minimum qualifying score of 70. It awards up to 50 points for at least four positive, contactable client references (not older than five years) for SIEM/SOAR implementations, supported by appointment letters. It awards up to 15 points for the lead project manager's SIEM/SOAR experience and up to 35 points for technical staff holding recognised certifications such as CompTIA Security+ or CySA+, GIAC GCIH, GCIA, CISSP, CISM, ISO/IEC 27001 Lead Implementer or vendor-specific SIEM/SOAR certification. Price is weighted at 80 points and specific goals at 20 points under the 80/20 preference system. Sealed bids must be deposited in the bid box at IUCMA Offices, 2nd Floor, ABSA Square Building, 20 Paul Kruger Street, Mbombela, by 11:00 on 19 November 2026, and bids remain valid for 120 days. The value of this contract lies in building a centralised, automated security operations capability for a public entity, with long-term licensing and support that reduces the agency's cyber risk exposure.