{"text_format":"3","workbook":"xlsx","n_sheets":1,"sheets":["Evaluation Criteria Security As"],"not_rendered":{"images":1,"defined_names":1},"read":"whole","date_system":"1900"}

{"sheet":"Evaluation Criteria Security As","index":0,"n_rows":12,"n_cols":5,"rows_kept":12,"merged":[[0,2,0,4],[1,2,1,4],[8,0,9,0],[8,1,9,1],[8,2,9,2],[8,3,9,3],[8,4,9,4],[11,0,12,3],[11,4,12,4]]}
[null,null,"RFP ANNEXURE A - TECHNICAL QUESTIONNAIRE RFP No: TCC/2023/03/0001/25090/RFP"]
[]
[]
[null,"Requirements","Provide Evidence /Supporting Documents and Include as an Appendix to this Annexure and indicate reference hereunder \n","Scoring Guide and Points","Maximum Points Achievable"]
[1,"Bidder's Experience (Schedule of services rendered)","Bidder demonstrated experience in Penetration Testing by completing a schedule of services rendered to illustrate their track record over the past years. The schedule is duly completed with a description of relevant services rendered across medium to large organisations. \n\nBidders completed Annexure B: Schedule of Services Rendered and submitted all supporting documents\n\n","\n1. Bidder has rendered services to 5 or more different companies. (10 points)\n1.1. Between 3 and 4 companies (6 points)\n1.2. Between 1 and 2 companies (2 points)\n1.3 No company/irrelavant information provided for each line item (0 points)\n\n2. Bidder has conducted minimum of 10 tests with client contact information (Company/Client Name, Registration No.,  Name, Surname and Phone Number, detailed description of service relevant to Penetration Testing) and all other information has been provided clearly defined in the schedule of services. (10 points)\n2.1. Between 8 and 9 tests (6 points)\n2.2. Between 5 and 7 tests (4 points)\n2.3. Less than 5/no information provided/irrelevant information (0 points)\n\n3. Bidder has been rendering the services for 10 years or more (as illiustrated in the date of appointment in the schedule of services). (10 points)\n3.1. Between 8 and 9 years (6 points)\n3.2. Between 5 and 7 years (4 points)\n3.3. Less than 5 years (0 points)\n\n4. Bidder has attached atleast 5 appointment letters/letters of award/letters of engagement from clients as evidence. (10 points)\n4.1. Between 3 and 4  appointment letters/letters of award/letters of engagement (6 points)\n4.2. Between 1 and 2  appointment letters/letters of award/letters of engagement (2 points)\n4.3. No appointment letters/letters of award/letters of engagement (0 points)\n",40]
[2,"Bidder's Experience\n(Reference Letters)","EXPERIENCE - REFERENCE LETTERS\n\nBidder provided client reference letters in the company letterhead with the following minimum verifiable information i.e. (company name, contact person, contact details and relevant description of services rendered). The type of tests delivered by the bidder may include but not limited to: Network penetration testing (External), Internal network penetration testing (Local Area Network (LAN), Wireless Local Area Network (WLAN) and Operation Technology network(s)), Web application assessment, Social engineering and physical access controls attack/exploit, Critical systems or infrastructure configuration assessment, Cloud environment security assessment and Reporting for more than 20 000 end points.\n\nBidders completed Annexure C: References and submitted all supporting documents","Five (5) relevant reference letters not older than February 2018 (i.e. 5 years) from clients on the services rendered. Each letter with the following minimum information (company letterhead, company name, contact person, contact details and relevant description of services)\n1. Relevant client Reference Letter 1 (4 points)\n2. Relevant client Reference Letter 2 (4 points)\n3. Relevant client Reference Letter 3 (4 points)\n4. Relevant client Reference Letter 4 (4 points)\n5. Relevant client Reference Letter 5 (4 points)\n\n\n6. Partial completion (i.e. missing information) on the letter may render the reference as non-responsive. Irrelevant description or insufficient information provided on description of services will render the letter as non-responsive. There are no partial points for allocation for each letter. Bidder will score points for each letter if all information is provided. Bidder will score (0) points for each letter if the minimum requirements are not met,  or if insufficient information is provided to meet minimum requirement, or if there is no information and/or most of the information provided is irrelevant to meet the minimum requirement.",20]
[3,"Bidders Capacity and Capability \n(Penetration Testing Methodology/Approach)","The bidder has submitted the penetration testing methodology used by their organization aligned to best practices, such as procedures set by the National Institute of Standards and Technology (NIST) Special Publication 800-115, Technical Guide to Information Security and Assessment or ISO.\nBidder completed Annexure D Penetration Testing Methodology and submitted all supporting documents. ","The bidder must submit the penetration testing methodology used by their organization aligned to best practices. The penetration test should include the following phases:\n1. Planning (4 points)\n2. Discovery (2 points)\n3. Attack (2 points)\n4. Reporting (2 points)\n\n5. Partial or irrelevant information not aligned to best practise may render part of the methodology non compliant and may result in 0 points for the specific phase. ",10]
[4,"Bidder's Capacity and Capability\n(Personnel that will be assigned to the Transnet projects as and when required)\n","Bidder provided a list of all Key personnel/Staff/Team that will be assigned to the Transnet projects as and when the services are required. Bidder provided a minimum of five (5) key personnel/team members each with a minimum of 5 years relevant work experience.\n\nBidder completed Annexure E: Key Personnel/Team and submitted all supporting documents. \n\n","1. Minimum of five (5) key personnel information has been provided in full and the five (5) meet the minimum requirements as per the schedule. (15 points)\n1.1. 4 key personnel has been provided in full (10 points)\n1.2. 3 key personnel has been provided in full (5 points)\n1.3. Less than 3 key personnel has been provided in full (0 points)\n\n",15]
[5,"Bidder's Capacity and Capability\n(Penetration Testers that will be assigned to the Transnet projects as and when required)\n","The bidder's key personnel that will be assigned to the Transnet project should be qualified with the relevant professional certification/licensed practitioners\n\nA resource may be certified/licensed practitioners to any of the following:\n1. Offensive Security Certified Professional (OSCP) \n2. GIAC Certified Penetration Tester\n3. GIAC Web Application Penetration Tester (GWAPT)\n4. GIAC Exploit Researcher and Advanced Penetration Tester (GXPN)\n5. EC-Council Licensed Penetration Tester — Master (LPT)\n6. CEPT – Certified Expert Penetration Tester\n7. LPT – Licensed Penetration Tester \n\nBidders completed Annexure F: Professional  Certification/Licensed practitioners. The schedule must be duly completed. ","1. Minimum of five (5) Key personnel/team members are certified and certifications have been submitted (15 points)\n\n1.1. Four Key personnel/team members are certified and certifications have been submitted (10 points)\n\n1.2. Three Key personnel/team members are certified and certifications have been submitted (5 points)\n\n1.3. Less than three Key personnel/team members are certified and certifications have been submitted (0 points)",15]
[]
["Total Maximum Points",{"$nulls":3},{"$f":"SUM(E5:E9)","v":100}]
["Minimum threshold",{"$nulls":3},70]