Cyber Security Monitoring and Managed Detection & Response NEW

The South African Civil Aviation Authority (SACAA), a Schedule 3A public entity under the Department of Transport, is seeking a service provider to deliver cyber security monitoring and Managed Detection and Response (MDR) services for a period of three years. Rather than procuring a traditional Security Operations Centre, the SACAA intends to establish a Cyber Risk Operations Centre (CROC) that operates on its existing Trend Micro technology estate, including endpoint, server, network, email, identity, cloud and SIEM capabilities. Trend Vision One will act as the SIEM, data lake, correlation engine, investigation platform, response orchestration system and SOAR automation layer. Bidders are expected to integrate with and optimise this investment rather than introduce duplicate toolsets. Any third-party SIEM proposal must be positioned as complementary to the existing Trend Micro Agentic SIEM.

The scope covers 24x7 monitoring, detection, investigation, threat hunting and guided response across the monitored environment, which includes Azure-based workloads such as virtual machines, storage accounts, key vaults, SQL virtual machines, virtual networks and network security groups. The estimated environment comprises 750 endpoints, 100 servers, 150 network devices and approximately 30GB of ingested data per day, with additional ingestion and retention credits required to support a six-month retention requirement. The provider must also deliver Trend Vision One platform administration, including daily health checks, policy tuning, ingestion troubleshooting, weekly to on-demand reporting, up to 10 automated SOAR playbooks per year and quarterly posture reviews. Further services include Cyber Risk Exposure Management with weekly remediation guidance, incident response coordination aligned to the SACAA Priority Matrix, and security awareness training for 750 users, including monthly phishing simulations and quarterly training modules. All platform administrative personnel must be located within South Africa.

Bidders must submit a three-envelope bid, with mandatory administrative documents (CSD registration, SBD forms and B-BBEE proof) in Envelope 1, the technical proposal in Envelope 2 and pricing in Envelope 3. Bids are scored 65 points for functionality (company references, methodology, and staffing, with a minimum of six staff including a CISM, a CEH, two ISC2 Certified in Cybersecurity professionals and two Trend Micro Platform Advanced professionals) and 80/20 for price and B-BBEE specific goals, with a minimum threshold of 65 out of 100 on functionality. Failure to provide the mandatory ISC2 and Trend Micro Advanced resources results in automatic disqualification. The closing date is 1 December 2026 at 11:00, with bids valid for 180 days. There is no briefing session, and clarification queries must be sent in writing to tenders@caa.co.za by 20 November 2026. Bidders must arrange building access in advance with the SACAA contacts listed in the bid document. The Terms of Reference state a data retention figure of 45,599 that appears inconsistent with the six-month retention requirement, so bidders should seek clarification on this point.