Managed Security Operations Centre (SOC) Services

Land and Agricultural Development Bank of South Africa (Land Bank) has issued a Request for Proposal for the provision of Security Operations Centre (SOC) services over a five-year contract period. The requirement is for a comprehensive, fully managed SOC providing continuous 24x7x365 security monitoring, detection, investigation, containment support, reporting and continuous improvement across the Bank's technology environment. The service must complement and integrate with Land Bank's existing SIEM, Managed Detection and Response (MDR) and security technologies rather than replace them. The successful provider must correlate security events across the environment, ingest, process, analyse and retain at least 70 GB of security log and event data per day, and scale to accommodate reasonable growth in log volumes and data sources. The current environment includes on-premises Active Directory integrated with Microsoft Entra ID, approximately 600 Windows endpoints, around 100 servers (mostly Windows with some Linux), firewalls, a web application firewall, network infrastructure, Microsoft 365 and Azure cloud services, and a range of security platforms including EDR, VPN, PAM, IAM, data loss prevention, email security and antivirus.

The Bank sets minimum incident response times by severity (critical incidents within one hour, high within two hours, medium within four hours and low within eight hours) and requires monthly reporting on metrics including mean time to detect, acknowledge, respond and resolve, false positive and false negative rates, incident volumes, escalation and closure rates. Evaluation is staged: mandatory pre-qualification (including a compulsory virtual briefing, a minimum 70 GB/day ingestion capability, a South African support capability, a banking-sector reference, POPIA compliance, disclosure of processing locations, and audited financial statements for the last two years), followed by technical evaluation scored out of 100 covering SOC experience, architecture and integration, detection and playbooks (including ransomware, credential compromise and data exfiltration), operating model and personnel, onboarding plan, reporting and governance, and verified client performance references. A minimum technical threshold of 70 points applies. Final award is based on price and specific goals under the 80/20 or 90/10 preference point system. Subcontracting of the entire service is not permitted.

For the successful provider, the contract offers a substantial, multi-year relationship with a state-owned financial institution and an opportunity to demonstrate SOC capability in a regulated banking and public-sector environment. Bidders should note the strict submission requirements: bids must be hand-delivered to the Land Bank tender box in Centurion by the closing date, pricing must be provided on the prescribed schedule excluding VAT and valid for 180 days, and all supporting evidence must be referenced to specific bid sections. Prospective bidders must register their interest with the Supply Chain Department, and clarification questions must be submitted in writing by the stated deadline.