Managed Cybersecurity Services

The National Home Builders Registration Council (NHBRC), a regulator under the Housing Consumers Protection Measures Act, 1998, is inviting proposals for the appointment of a Managed Cybersecurity Services Provider (MCSSP) for a five-year period. The NHBRC, with approximately 620 staff across its head office, nine provincial offices and twelve satellite offices, is on a digital transformation journey and relies on Microsoft 365 (E3/E5), Microsoft Azure, FortiGate perimeter security, OpenVPN, and roughly 650 workstations and 300 tablets. The appointed provider will complement internal ICT and information security capabilities across people, process and technology, covering a defence-in-depth model spanning cloud, network, server, application, database, identity, endpoint and data security.

Core scope includes a 24/7/365 Security Operations Centre with SIEM/SOAR and EDR/XDR capabilities, a baseline catalogue of 14 MITRE ATT&CK-mapped use cases (such as ransomware indicators, business email compromise, impossible travel and insider data exfiltration), and an incident response retainer with forensics and POPIA-aligned breach communication support. Further services include authenticated vulnerability scanning, penetration testing (annually for internal and external environments and semi-annually for web, application and API), threat intelligence, attack surface and continuous exposure management, document security controls, quarterly phishing simulations and an annual cyber awareness programme. The provider must also develop or update policies including the Cyber Incident Response Plan, Third-Party Access Policy and SOC Engagement Plan. Mandatory requirements include ISO/IEC 27001:2022 and ISO 9001 certification, R10 million in cyber liability or professional indemnity insurance, OEM authorisation for security technologies, at least five years' experience and three reference letters. SOC operations and analyst access to NHBRC data must be performed from within South Africa.

Evaluation is staged: compliance checks, then functional evaluation (80 points on paper and 20 points on a mandatory live SOC demonstration, with a minimum qualifying score of 80), then price and preference scoring under the 80/20 system. Pricing must be VAT-inclusive, with prices held firm for the first 12 months and a single CPI-based adjustment thereafter. The benefit to the NHBRC is stronger protection of consumer and organisational data, improved detection and response times, and a measurable improvement in cybersecurity maturity under transparent, co-managed governance.