1. 09 October 2017
COMPULSORY TENDER BRIEFING SESSION: OPEN TENDER : AGSA/14/2017– Appointment of a service provider to render information security managed services to the AGSA for a period of three (3) years in line with the Information Security Framework

2. Reputation promise/mission
The Auditor-General of South Africa has a constitutional mandate and, as the Supreme Audit Institution (SAI) of South Africa, exists to strengthen our country’s democracy by enabling oversight, accountability and governance in the public sector through auditing, thereby building public confidence.

3. Geographical Operations and Organisational Structure

4. CONTEXT - CORE LAYERED SECURITY SERVICES – DEFENSE IN DEPTH

5. Information Security Framework – Gap Analysis

6. Current Solutions vs Solutions Required
Status
Required Solutions
Firewall
Expiring in 2020
DLP
Secure Web Gateway
Expiring in 2018
SIEM
VPN (Virtual Private Network)
Antivirus
Expiring in 2019
VPN
Vulnerability Scan
Required
Penetration testing
Encryption – Full Disk and Media Encryption
Vulnerability manager
SSL Certificates
Ad hoc
Data Governance/File Analysis
Data Governance
 Expiring in 2018
Content Filter (Spam Filter)
Data Masking
Currently implemented

7. Managed Service
The managed service provider (on-premise) is expected to provide a comprehensive proposal covering the following:
Information security solution as per specifications
Consulting services to implement the proposed information security solutions
Where feasible, integrate the above information security solutions implemented
Support and maintenance of the solutions implemented, for the duration of the contract
Training, skills and knowledge transfer to AGSA information security and ICT teams.

8. Prequalification Criteria/Eligibility
Bidders who do not meet the following prequalification criteria will not be evaluated further:
Partner with small and medium enterprises with BBBEE level 1 or 2.
Provide proof that the company is a managed service.
Attend the briefing session.

9. Skills & Knowledge Transfer
Technical Evaluation Criteria 
Experience
Minimum of 5 years experience is required, where 5 years = 50%, 6-10 years = 80% and 10 years or more = 100%.
EVIDENCE
Solution accreditation letters from each vendor of the solution proposed.
References
List at least three contactable references for the implementation of similar security solutions/services, value of the contract, type of work and size of the company.
Reference letters signed by the customers.
Skills & Knowledge Transfer
Training, skills and knowledge transfer to AGSA ICT employees.
Training, skills and knowledge transfer plan.

10. Support Compliance Architecture Technical Evaluation Criteria
Level of support services for up to 3 years for proposed solution.
The solution is required to be available 24/7. AGSA working hours 07h30 – 16h30
EVIDENCE
SLA and escalation matrix
Compliance
Compliance with technical specifications and on-premise managed service.
Comprehensive technical responses and supporting information for each solution.
Architecture
Diagrammatic depiction of the DLP, SIEM, VPN, penetration testing, vulnerability antivirus and data governance solution.
Architectural design per solution proposed and how they integrate.

11. Partnership Project Management Threshold Technical Evaluation Criteria
Level of partnership with vendors, where silver = 50%, gold = 70%, platinum = 100%.
Equivalent of the above partner grading system is required.
EVIDENCE
Partnership certificate per solution per vendor
Project Management
Project management implementation methodology. AGSA has standardised on PRINCE2.
Full write-up on the project implementation approach and the methodology used.
Threshold
Service providers who achieve 70% or more will be considered for further evaluation.

12. Managed Services – Information Security Services
Tender Specifications
Managed Services – Information Security Services
DLP
SIEM
ANTIVIRUS
VPN
VULNERABILITY MANAGER
DATA GOVERNANCE/FILE ANALYSIS
PENETRATION TESTING

13. Pricing Schedule
Pricing Summary

14. Pricing Schedule – Detail Pricing

15. Question and Answer Session

17. Thank you Follow the AGSA on Twitter: @AuditorGen_SA www.agsa.co.za
Auditor-General of South Africa
Follow the AGSA on Twitter:
@AuditorGen_SA