Top ICT tenders: Home Affairs locks down authentication, access control

The successful bidder will develop and implement a multi-factor authentication system for the Department of Home Affairs. (Image source: 123RF)

---

It’s not just road traffic that has slowed down due to school holidays, it’s also activity on National Treasury’s eTenders Portal as public sector attention favoured fast-turnaround requests for quotation. This means that after weeks of attractive tender opportunities, the ICT sector will have to make the most of more targeted requests.

The Department of Home Affairs (DHA) returns to the headlines this week as the State Information Technology Agency (SITA) invites proposals for the implementation of a multi-factor authentication and non-repudiation logical access control solution, including maintenance and support.

In its tender documentation, the agency explains the department deployed a biometric access control management system (BACM) in 2005 to enhance the security of its systems, protect officials from identity abuse, and ensure authentication and no-repudiation on transactions performed on these systems. The system is currently integrated with the National Population Register (mainframe), Movement Control System (mainframe), Service Manager and other DHA systems.

“All users of the system require a smartcard, smartcard reader as well as a fingerprint scanner in order to access the department’s systems securely and to ensure only authorised officials have access to core DHA applications. This type of mechanism also ensures no user is able to access the systems using another official’s credentials, thus strengthening the security of the systems,” SITA says.

The successful bidder will be expected to develop and implement a multi-factor authentication and non-repudiation BACM system based on, but not limited to, smartcards/tokens, advanced digital signatures and biometrics.

This system will legally bind a user to a transaction at the point of committing a sensitive transaction.

The system must also have the following capabilities:

• Positively connect a physical person to a transaction with its non-reputation capabilities.
• Digitally sign and time stamp transactions.
• Detect when sensitive data or transactions are being amended using built-in intelligence.
• Record activities by capturing the user details and the details of the transaction in a way that is admissible in a court of law.
• Support open standards for authentication and authorisation.
• Support the Identity Federation.
• Support policy-based adaptive authentication that can provide a variety for options for multi-factor based step-up authentication.
• Support fingerprint biometric modalities at a minimum.
• Support forensic and business intelligence reporting and data mining.
• Have public key infrastructure (PKI) solution to support the multi-factor authentication and non-repudiation.
• Must allow the department to choose between PKI as a managed service or an on-premises PKI deployment.
• Support crypto agility.
• Support RFC 3161 time-stamping and transaction signing.
• Support identity orchestration, thereby ensuring identities and user access policies are consistent.
• Support other biometric modalities such as facial recognition, iris, etc.

The successful service provider will be expected to integrate the system with the department’s core systems such as National Population Register, Service Manager (smart ID and passport live capture system, biometric movement control system, eMCS/eVISA system), VISA adjudication system, movement control system and the automated biometric identification system and any other systems that the department identifies.

“There must be minimal configuration or customisation requirement on any of the DHA systems, such as mainframe to ensure integration happens with less impact to DHA server components,” says SITA.

On the user side, the provider will be expected to perform enrolment and onboarding of upwards of 6 000 users and provide online or offline training of all DHA IT and Learning Academy officials countrywide.

The terms of reference also state the bidder will be required to read the authentication and non-repudiation system data currently stored in the vault and produce forensic evidence within a prescribed period.

SITA will hold a non-compulsory briefing over Microsoft Teams on 20 July before submissions close on 5 August.

Other tenders that make this week’s top 10:

• The Eastern Cape Department of Transport is calling for the supply and delivery of computer equipment, accessories and consumables for Government Fleet Management Services trading entity. The tender document specifies various notebooks; handheld mobile device terminals; rugged rubber boots for the mobile terminals; multi-slot cradle battery chargers; display monitors; book cover keyboards; multiport hubs; mice; backpacks; cabling; and various installation materials.

• The City of Cape Town requires an eDiscovery solution for its ethics and forensic services department. The contract includes required training to effectively conduct forensic investigations with the assistance of eDiscovery processes which handle a variety of electronic evidence types. The solution must ultimately allow for a seamless end-to-end workflow for acquiring, analysing and reporting on digital evidence in compliance with industry best practices and legal standards, the metro says.

• The city is also inviting bids for the provision of professional services for information systems, communication and technology services. The resource and skills requirements have been split into seven categories, specifically: business applications, distributed computing, ERP support centre, geographical information systems, infrastructure and applications as well as fixed networks and monitoring services, telecommunications and cyber security.

• Mpumalanga’s Provincial Treasury wishes to appoint a service provider for the supply of internal audit software, including installation, configuration, customisation, training and software maintenance, technical and functional support. The provincial department explains support for its current audit management software ended 30 June 2026.

• The Development Bank of Southern Africa is looking for an internet service provider (ISP) that can provide the Independent Power Producer Office with enterprise-grade data lines, VOIP and Mimecast e-mail archiving services. The institution states the IPP Office ICT department must be able to retain administrative control over the services delivered under this contract.

• Department of Transport requires a service provider for the procurement of hyperconverged infrastructure and implementation services. The department says it currently uses aging blade server infrastructure and the successful service provider will be expected to configure and migrate data onto the new hyperconverged infrastructure. The department will also, where necessary, contract the services of external IT service providers to deploy a private cloud infrastructure on-premises at its head office and its data centres in Pretoria and Centurion.

• eThekwini Metropolitan Municipality wishes to appointment a service provider to provide support, maintenance and development/configuration on the JDE Enterprise One System. The metro says the current support and maintenance contract will end on 14 August and it requires support, maintenance and configuration/customisations of existing modules process on the Oracle JDE Enterprise One System, inclusive of all mSCOA functionality and processes.

• The Independent Communications Authority of South Africa is looking for a service provider for the review and updating of its IT strategy. The regulator reveals that during the approval process of its 2024/25 IT strategy, concerns were raised that it was not forward-looking and not sufficiently aligned with the ICASA strategy. The recommendation was to appoint a service provider to review the draft IT strategy, engage with the relevant role players, and update the strategy to address these concerns.

• Statistics South Africa is inviting bids for the appointment of a service provider to supply Veritas NetBackup infrastructure and support. The organisation notes that support for its existing infrastructure expired in March 2025 and is no longer supported by the original equipment manufacturer.