Red Team Assessment Services

The Trans-Caledon Tunnel Authority (TCTA), a state-owned entity responsible for financing and implementing bulk raw water infrastructure in South Africa, is seeking a qualified service provider to conduct an independent Red Team Assessment over a six-month contract period. The assessment goes beyond automated vulnerability scanning: it requires controlled, ethical adversarial activity to demonstrate whether identified weaknesses can be exploited, how they can be chained into attack paths, and whether TCTA's technical, physical and human security controls can prevent, detect and respond to such activity. The engagement must be conducted within agreed Rules of Engagement, be non-destructive, and align with the NIST Cybersecurity Framework, ISO/IEC 27001, POPIA and the PFMA.

The scope covers six assessment modules, each independently executed and auditable: (1) external network testing, (2) internal network testing from both unauthenticated and low-privilege domain user perspectives, including segmentation and lateral movement assessment, (3) Active Directory penetration testing for misconfigurations, privilege escalation and credential compromise, (4) wireless/Wi-Fi testing including rogue access point and guest-network segregation, (5) web application testing against the OWASP Top 10 and OWASP Testing Guide, including business logic, and (6) physical access and social engineering exercises, including approved phishing simulations. The provider must also deliver post-remediation retesting within 30 working days of the agreed remediation period, issuing a Retest Validation Report rating each finding as Fixed, Partially Fixed or Not Fixed. Deliverables include planning artefacts, phase reports, an executive summary, detailed technical reports with CVSS v3.1 scoring and MITRE ATT&CK mapping, an evidence pack and findings register, structured skills transfer to TCTA staff, and remediation consultation. Critical and High findings must be fixed or formally risk-accepted before acceptance.

Mandatory requirements include valid ISO/IEC 27001 and ISO/IEC 27035 certificates, and a nominated Technical Lead holding at least three current certifications, one of which must be OSCP, OSEP, OSWE or GIAC GPEN. Company and key personnel experience are scored on the number of comparable Red Team engagements (three or more required, with five or more scoring highest), and a minimum of 30 out of 50 functional points is needed to proceed to price evaluation. Pricing is evaluated on an 80/20 price-to-preference basis, with prices required excluding and including VAT, and disbursements itemised. Bidders should submit the RFQ pricing schedule, Annexures A to F, a valid B-BBEE certificate or sworn affidavit (QSE/EME), SBD forms, and proof of CSD registration. Briefing session attendance is non-compulsory; pre-registration by email is required.