09 October 2017 COMPULSORY TENDER BRIEFING SESSION: OPEN TENDER : AGSA/14/2017– Appointment of a service provider to render information security managed services to the AGSA for a period of three (3) years in line with the Information Security Framework

Reputation promise/mission The Auditor-General of South Africa has a constitutional mandate and, as the Supreme Audit Institution (SAI) of South Africa, exists to strengthen our country’s democracy by enabling oversight, accountability and governance in the public sector through auditing, thereby building public confidence.

Geographical Operations and Organisational Structure

CONTEXT - CORE LAYERED SECURITY SERVICES – DEFENSE IN DEPTH

Information Security Framework – Gap Analysis

Current Solutions vs Solutions Required Status Required Solutions Firewall Expiring in 2020 DLP Secure Web Gateway Expiring in 2018 SIEM VPN (Virtual Private Network) Antivirus Expiring in 2019 VPN Vulnerability Scan Required Penetration testing Encryption – Full Disk and Media Encryption Vulnerability manager SSL Certificates Ad hoc Data Governance/File Analysis Data Governance  Expiring in 2018   Email Content Filter (Spam Filter) Data Masking Currently implemented

Managed Service The managed service provider (on-premise) is expected to provide a comprehensive proposal covering the following: Information security solution as per specifications Consulting services to implement the proposed information security solutions Where feasible, integrate the above information security solutions implemented Support and maintenance of the solutions implemented, for the duration of the contract Training, skills and knowledge transfer to AGSA information security and ICT teams.

Prequalification Criteria/Eligibility Bidders who do not meet the following prequalification criteria will not be evaluated further: Partner with small and medium enterprises with BBBEE level 1 or 2. Provide proof that the company is a managed service. Attend the briefing session.

Skills & Knowledge Transfer Technical Evaluation Criteria  Experience Minimum of 5 years experience is required, where 5 years = 50%, 6-10 years = 80% and 10 years or more = 100%. EVIDENCE Solution accreditation letters from each vendor of the solution proposed. References List at least three contactable references for the implementation of similar security solutions/services, value of the contract, type of work and size of the company. Reference letters signed by the customers. Skills & Knowledge Transfer Training, skills and knowledge transfer to AGSA ICT employees. Training, skills and knowledge transfer plan.

Support Compliance Architecture Technical Evaluation Criteria Level of support services for up to 3 years for proposed solution. The solution is required to be available 24/7. AGSA working hours 07h30 – 16h30 EVIDENCE SLA and escalation matrix Compliance Compliance with technical specifications and on-premise managed service. Comprehensive technical responses and supporting information for each solution. Architecture Diagrammatic depiction of the DLP, SIEM, VPN, penetration testing, vulnerability antivirus and data governance solution. Architectural design per solution proposed and how they integrate.

Partnership Project Management Threshold Technical Evaluation Criteria Level of partnership with vendors, where silver = 50%, gold = 70%, platinum = 100%. Equivalent of the above partner grading system is required. EVIDENCE Partnership certificate per solution per vendor Project Management Project management implementation methodology. AGSA has standardised on PRINCE2. Full write-up on the project implementation approach and the methodology used. Threshold Service providers who achieve 70% or more will be considered for further evaluation.

Managed Services – Information Security Services Tender Specifications Managed Services – Information Security Services DLP SIEM ANTIVIRUS VPN VULNERABILITY MANAGER DATA GOVERNANCE/FILE ANALYSIS PENETRATION TESTING

Pricing Schedule Pricing Summary

Pricing Schedule – Detail Pricing

Question and Answer Session

Thank you Follow the AGSA on Twitter: @AuditorGen_SA www.agsa.co.za Auditor-General of South Africa Follow the AGSA on Twitter: @AuditorGen_SA