Subscription governance, risk and compliance (grc) solution – 12‑month service provider

To appoint a competent service provider for the provision of subscription services for an

automated GRC solution for a period of twelve (12) months.

It is anticipated that only suitably qualified and reputable service providers with the necessary

expertise will respond to this RFQ, thereby enabling the MICT SETA to fulfil the stated purpose,

achieve the project objectives, and meet the minimum requirements set out in this ToR.

RFQ/MICT/92/2025 | P a g e

4. OBJECTIVES

The Objectives of the project are summarised as follows:

a) Implement an automated GRC system to streamline Audit, Risk and Legal management

processes.

b) Improve oversight, accountability, and reporting through automated workflows and

dashboards.

c) Maintain a full, tamper-proof audit trail of activities to enhance governance, oversight,

and accountability.

d) Implement alerts and escalation mechanisms to ensure timely action on risks, audit

findings, and compliance obligations.

e) Facilitate seamless integration with existing platforms (e.g., Integrated Learner

Management System (ILMS), Enterprise Resource Planning (ERP)) for consolidated

reporting and workflow efficiency.

f) Ensure the system can expand to accommodate additional modules, users, or

regulatory requirements in the future.

g) Provide a secure, reliable, and scalable hosting environment for the GRC solution, either

hosted by the Service Provider or on MICT SETA infrastructure, ensuring high availability,

compliance with data protection regulations, and disaster recovery capabilities.

5. PROJECT REQUIREMENTS

5.1. Core GRC Functionality

a) Integrated modules for Audit, Risk and Legal management.

b) Centralised dashboard for management oversight.

c) Support for multi-entry or multi-department structures.

d) Ability to integrate with existing platforms (e.g., ILMS, ERP, etc.).

e) Ability to work offline and create a replicate.

5.2. Audit Module

a) Audit planning and scheduling: Ability to create and manage comprehensive audit

plans, including resource allocation, task assignment, scheduling of recurring and ad hoc

audits, and monitoring of deadlines through dashboards.

b) Templates (working papers, reports, checklists etc): Ability to customise working papers,

reports templates to align with MICT SETA audit methodology.

c) Workflows: Ability to route tasks throughout the audit process i.e. planning, fieldwork and

reporting.

d) Notifications and escalations: Ability to notify due tasks and escalate unreviewed work or

outstanding review notes for reviewed work.

e) Action tracking: Workflow for management responses, automated reminders, and

escalation reports.

RFQ/MICT/92/2025 | P a g e

f) Outstanding actions: Ageing analysis of outstanding issues.

g) Global Internal Audit Standards: Alignment of audit process on the system to the Global

Internal Audit standards.

h) Findings: Consolidated report of all findings issued across all audits.

5.3. Legal and Compliance Module

a) Regulation / Framework Mapping: Ability to map internal controls to regulatory

frameworks, standards, or policies.

b) Policy Management: Lifecycle for policies (create, approve, publish), versioning,

distribution, and acknowledgement tracking.

c) Continuous Compliance Monitoring: Real-time or periodic control checks to see whether

controls are operating effectively.

d) Regulatory Change Management: Ability to update regulation or compliance

frameworks, track changes, and alert relevant stakeholders about compliance gap.

5.4. Risk and Compliance Management Module

5.4.1. Risk Management

a) Organisational and Process Structure: Ability to configure and maintain the organisational

hierarchy, maintain, and update process hierarchies and libraries, and fully customise risk

templates and process structures.

b) Risk Register and Controls:

• Capture and maintain risk registers across all divisions / business units

• Record and link risk number, objectives, risk descriptions, causes / contributing

factors, existing controls, control effectiveness ratings, and quarterly action plans.

• Support full moderation functionality for risk review and validation, online voting,

and control self-assessment features including rating of risk and controls, as well as

voting on risk readiness.

• Provide ability for risk owners and managers to update risks online via web access

(Lite/Open licences).

c) Key Indicators (KRIs, KPIs, KCIs):

• Create and maintain Key Risk Indicators and assign thresholds.

• Allow web-based capture of indicator values by responsible owners.

• Generate automated KRI reports and trend analysis.

RFQ/MICT/92/2025 | P a g e

• Provide ability for risk owners and managers to update risks online via web access

(Lite/Open licences).

d) Action Plans: Full action plan lifecycle support including:

• creation, assignment, due dates.

• reminders and progress tracking.

• status updates by relevant officials using web access.

e) Incident Reporting:

• Online incident capture functionality.

• Support linking incidents to related risks.

• Provide incident reporting and summaries for divisional and organisational levels.

f) Reporting and Dashboards:

• Provide risk reports including risk heatmaps, risk registers, control effectiveness

reports, and key risk indicator reports.

• Support export to Excel, PDF, or presentation-ready formats.

• Provide user-friendly dashboards for risk trends and risk status.

5.4.2. Compliance Management

Statutory Compliance Monitoring and Reporting:

a) Automated reporting on compliance status, gaps, and outstanding actions.

b) Aggregated reporting of checklist results.

c) Provide compliance dashboards for executives and committees.

d) Ability to export compliance reports to Excel, PDF, or required formats.

5.5. User Access

a) Audit, Legal and Risk should have full administration rights to their specific modules.

b) Business Units and Managers must have access for risk updates, action plan updates, KRI

/ KPI value capture, survey / checklist completion, participation in voting / assessments.

c) System should allow configuration of user permissions by role, unit, or responsibility.

5.6. Licensing Requirements

The below table is the number of licences required:

RFQ/MICT/92/2025 | P a g e

Item No.

Core Module 1

Risk Management 3

Compliance Management 2

Audit Module 4

5.7. Security

The solution must comply with the below security requirements:

a) The protection of an organisation's systems and data is important. The bidder

should comply with industry standards and regulations such as POPIA and provide a

robust security framework along with effective risk management and mitigation

strategies.

b) The service provider must ensure that sensitive data remains confidential. This involves

encrypting data both in transit and at rest.

c) Use secure protocols like HTTPS, SSL/TLS, and VPNs to protect data during transmission.

d) The service provider must conduct regular security audits and vulnerability assessments

to identify and address potential security gaps.

e) The service provider must implement continuous monitoring and logging to detect and

respond to security incidents promptly.

f) The solution should have role-based and permission-based access settings.

5.8. Training

Training must be provided for the below groups:

a) User training

b) Audit and Risk Unit

c) Legal and Compliance Unit

d) First-line ICT support team

e) Deliver training materials such as manuals, quick-reference guides, and online help.

5.9. Support and Maintenance

The solution must comply with the below support and maintenance requirements:

a) The service will be available with a guaranteed uptime of 99.9% each calendar month,

excluding scheduled maintenance. This ensures that the integrated system remains

operational and accessible for the vast majority of the service period.

RFQ/MICT/92/2025 | P a g e

b) The successful bidder will be required to sign an SLA specifying turnaround times for all

services and the resolution of support incidents.

c) The successful bidder must offer support from Monday to Friday during MICT SETA business

hours.

d) Support outside standard business hours may be required. The successful bidder must

provide reasonable turnaround times for after-hours incident resolution.

e) The successful bidder must provide details of key personnel responsible for executing this

project, including a direct or central point of contact for logging, and managing

incidents.

5.10. Hosting Requirements

The GRC solution must be hosted in a cloud environment, either provided and managed by the

Service Provider or hosted on MICT SETA’s cloud platform. The bidder must specify:

a) The cloud architecture.

b) Cloud service model.

5.11. Data Migration

The Service Provider shall be responsible for all data migration activities during system

implementation and all data handover activities at the end of the contract period. The

requirements are as follows:

a) The Service Provider shall be fully responsible for the end-to-end data migration from MICT

SETA’s existing data sources into the new GRC solution.

b) The data migration process must ensure accuracy, completeness, and integrity of all

migrated data to support a smooth transition to the automated GRC system.

c) At the end of the contract period, termination, or non-renewal of services, the service

provider shall ensure a complete, secure, and verifiable handover of all MICT SETA data

stored, processed, or generated within the GRC solution.

d) The end-of-contract handover must include all relevant information, including but not

limited to:

• Structured and unstructured data;

• Metadata;

• System logs and activity records;

• Audit trails;

RFQ/MICT/92/2025 | P a g e

• Configuration settings, templates, and system structures; and

• Any other information classified as MICT SETA intellectual property.

6. PROJECT DURATION

a) The estimated duration for the GRC solution is twelve (12) months, commencing from the

project initiation date. The project may be divided into several key phases, each with

specific deliverables and milestones to ensure smooth progress and timely completion

according to the terms of reference of the MICT SETA, and the successful bidder’s

proposal and project plan.

b) The data being shared with the successful bidder remains the Intellectual Property (IP) of

MICT SETA. Under no circumstances, the successful bidder will be allowed to disclose off

such information without prior written permission of MICT SETA.

c) Upon termination of the contract/ services, the successful bidder will be required to return

all IP of MICT SETA and destroy any personal information obtained as part of the services

included in this ToR.

RFQ/MICT/92/2025 | P a g e

7. PRICING SCHEDULE

Name of bidder: _____________________________ RFQ number: __________________

Closing date: _______________________________

RFQ shall remain valid for acceptance for a period of 90 days counted from the closing date.

Bidders to provide further cost breakdown where necessary under each line item, and sub-total and the overall RFQ

price (Total) should be included. The below table is for illustration only:

No. Description Frequency Unit price Total price

(Once-off, (Excl. VAT)

Monthly)

1. Core Module Once-off R R

2. Risk Management Once-off R R

3. Compliance Management Once-off R R

4. Audit management Once-off R R

5. Implementation Roadmap Once-off R R

6. Training Once-off R R

7. Reporting and Close-Out Once-off R R

8. Support and Maintenance Monthly R R

Sub-Total R

VAT @ 15% R

GRAND TOTAL R

Complete below:

1. Delivery Address: MICT SETA Head office

Level 3 West wing, Gallagher House

19 Richards Drive, Halfway House

Midrand

2. Indicate Delivery period after order receipt...................

3. Is delivery period fixed? Yes/No

4. Is the price(s) fixed? Yes/No

5. Is the quote strictly to specification? Yes/No

I/We, the undersigned, agree that this bidding price shall remain binding on me/us and open for

acceptance for the period stipulated above.

Authorised Company Representative: _______________________________________________________

Capacity under which this quote is signed: __________________________________________________

Signature: __________________________________________________________________________________

Date: ______________________________________________________________________________________

RFQ/MICT/92/2025 | P a g e

8. EVALUATION CRITERIA

MICT SETA complies with the provisions of the Public Finance Management Act, Act No.

as amended; Treasury Regulations of 2005; the Preferential Procurement Policy Framework Act,

Act No. ; Preferential Procurement Regulations of 2022; and the MICT SETA Supply Chain

Management (SCM) Policy.

RFQs received will be evaluated on Mandatory Criteria, Technical/ Funactionality Criteria, and

Price & Specific Goals.

8.1. STAGE 1 (A): MANDATORY CRITERIA

(a) Compulsory Briefing Session

The virtual Briefing Session is a compulsory part of the acquisition process for all participating

Service Providers. Non-attendance of thereof will automatically disqualify any prospective

bidder.

Proof of compliance to (a)

Attendance register of the compulsory briefing session held on Microsoft Teams. Representatives

are required to sign the attendance register or to write name of the bidder, name of

representative, and contact details on Microsoft Teams chat.

(b) OEM/ OSM Accreditation

Bidders must be an OEM/ OSM or accredited by the OEM/ OSM or authorised by the distributor

of the proposed GRC solution. If the bidder is accredited through a distributor, then there must

be a letter from the OEM/ OSM that authorises the distributor to distribute the solution and

authorise resellers.

Proof of compliance to (b)

The bidder must provide proof of being an OEM / OSM or submit documentary proof of

accreditation by the OEM / OSM or letter from the OEM / OSM that authorises the distributor to

distribute the GRC solution and authorise resellers and a letter from the distributor that authorises

the reseller. Letters must be on company letterhead signed by an authorised representative.

(c) Bidders’ Resources Certification

Bidders’ key resources/ personnel must be in possession of valid certifications in implementing,

configuring, maintaining and supporting a GRC system. At a minimum the certifications must

include Technical Lead and Project Management resources with the following certifications:

RFQ/MICT/92/2025 | P a g e

Proof of compliance to (c)

o Project Manager – certified with any of the following certifications: PMP/ Prince 2/ CAPM/

IPMA/ APM PMQ. Expired certificates will not be considered.

o Technical Lead – Relevant technical certification of the proposed GRC System.

NOTE: Bidders should clearly indicate on their bids the Project Manager and the Technical Lead.

MICT SETA will not consider bids not clearly indicating the Project Manager and Technical Lead.

Certified copies must not be older than six (06) months.

NB: Failure to comply with the above Mandatory Criteria will lead to disqualification of the bidder.

8.2. STAGE 1(B): TECHNICAL/ FUNCTIONALITY EVALUATION CRITERIA

Only bidders that have complied to the requirements of the set mandatory criteria will be

considered for functionality evaluation. Bids submitted will be evaluated on technical/

functionality out of a maximum of 100 points. A threshold of 70 out of the 100 points has been

set.

Note: All bidders achieving less than the set threshold of 70 points will be declared non-

responsive. Assessment of evaluation of the technical/ functionality criteria will be based on the

table below:

Note: Bidders that do not meet the requirements of set technical/ functionality criteria will be

eliminated from further evaluation process.

FUNCTIONAL CRITERIA

NO. CATEGORY FUNCTIONAL EVALUATION CRITERIA MAX

POINTS

1. SOLUTION Bidders’ solution proposal must cover the minimum requirements 30

PROPOSAL of the proposed solution as detailed in the bid and summarised

below. The proposal must comprehensively cover the following

minimum requirements, detailing how the bidder intends to

implement the following:

o Core GRC Functionality;

o Audit Module;

o Legal Module;

RFQ/MICT/92/2025 | P a g e

o Risk Module;

o Security; and

o Support and Maintenance.

Points on solution proposal will be allocated as follows [30]:

• Proposal that meets or exceeds all six (6) components of the

minimum requirements of the proposed solution = 30 points

• Proposal that does not meet all components of the minimum

requirements of the proposed solution/ not detailed = 0 points

NB: All components of the minimum requirements must be covered in detail. Non-

compliance with the minimum requirements will be declared non-responsive.

2. EXPERIENCE Bidders must submit reference letters which indicate that they 10

AND supplied, implemented, configured, maintained, and supported a

REFERENCE GRC System in the past and they must include the number years

LETTERS the services have been provided to determine the experience. The

reference letters must be from the bidder’s clients within RSA on

the supplied, implemented, configured, maintained, and

supported a GRC System.

Reference must be on company letterhead signed by a senior

official of the bidder’s client, i.e. CEO, CFO, CIO, IT Manager, or

SCM Manager. The reference letters must include name of

company, contact person, position, contact number, e-mail

address, project description, project outcome, and dates, i.e. start

and end date of the project.

NB: Reference Letters must be fully signed on the client’s

letterhead, with contact details, project description and dated.

Award letters or purchase orders will not be accepted.

Points on reference letters indicate that they supplied,

implemented, configured, maintained, and supported a GRC

System in the past will be allocated as follows [10]:

• Five (05) or more signed reference letters from different clients,

with five (05) years’ experience or more = 10 points

RFQ/MICT/92/2025 | P a g e

• Four (04) signed reference letters from different clients, with five

(05) years’ experience or more = 08 points

• Three (03) signed reference letters from different clients, with

five (05) years’ experience or more = 06 points

• Two (02) signed reference letters from different clients, with five

(05) years’ experience or more = 04 points

• One (01) signed reference letter from a client, with five (05)

years’ experience or more = 02 points

• No signed reference letter = 0 points

NOTE: Reference lists or award letters will not be considered for point allocation.

In the event of sub-contracting, the bidder must furnish the above reference

letters of the main bidder. MICT SETA reserves the right to contact references prior

to award. Bidders with no track record of rendering similar services will be

deemed non-responsive.

3. PROJECT Bidders must provide a detailed Project Implementation Plan as 10

IMPLEMENTA per the ToR in executing the project and support services. The

TION PLAN Project Implementation Plan and Methodology should include the

following:

o Project Plan activities clearly defined with timelines.

o Resources to be allocated for the project.

o Processes for onboarding of users.

Points on the implementation plan will be allocated as follows [10]:

• Detailed implementation plan that meets all three (03)

requirements = 10 points

• Detailed implementation plan that meets only two (02)

requirements = 05 points

• Detailed implementation plan that meets only one (01)

requirement = 03 points

• No implementation plan submitted/ implementation plan that

is not detailed = 0 points

NB: All elements of the project scope must be covered in detail.

4. TRAINING Bidders must provide a detailed Training Plan for the following 05

PLAN audiences:

o User training;

RFQ/MICT/92/2025 | P a g e

o Audit Unit;

o Risk and Compliance Unit;

o Legal and Compliance Unit; and

o First-line ICT support team.

Bidders must also deliver training materials such as manuals, quick-

reference guides, and online help.

Points on training plan will be allocated as follows [05]:

• Training Plan that includes all five (05) elements = 05 points

• Training Plan that includes four (04) elements = 04 points

• Training Plan that includes three (03) elements = 03 points

• Training Plan that includes two (02) elements = 02 points

• Training Plan that includes one (01) element = 01 point

• No Training Plan submitted = 0 points

NB: All elements of the Training Plan must be covered in detail (not a

brief/summary).

5. EXPERIENCE Bidders must submit profile/ CV of the Project Manager reflecting 05

OF THE the experience in managing the GRC system implementation,

PROJECT support, and maintenance or similar services/ projects. CV/ profile

MANAGER should clearly indicate the projects, project duration, and names

of clients.

Points on submission of profile/ CV of the PM will be allocated as

follows [05]:

• More than 05 years’ project management experience in

managing the GRC system implementation, support, and

maintenance or similar services/ projects = 05 points

• 04 to 05 years’ project management experience in managing

GRC system implementation, support, and maintenance, or

similar services/ projects = 03 points

• 02 to 03 years’ project management experience in managing

GRC system implementation, support, and maintenance, or

similar services/ projects = 01 point

RFQ/MICT/92/2025 | P a g e

• Less than 02 years’ project management experience in

managing the GRC system implementation, support, and

maintenance, or similar services/ projects = 0 points

Bidders must clearly indicate its proposed Project Manager, profiles/ CVs not

indicating the details of the Project Manager will not be evaluated.

6. EXPERIENCE Bidders must submit profile/ CV of the Technical Lead reflecting the 05

OF THE experience in leading the implementation of the GRC system or

TECHNICAL ICT systems. CV/ profile should clearly indicate the projects, project

LEAD duration, and names of clients.

Points on profile/ CV of the Technical Lead will be allocated as

follows [05]:

• More than 05 years’ experience in leading the implementation

of the GRC system or ICT systems = 05 points

• 04 to 05 years’ experience in leading the implementation of the

GRC system or ICT systems = 03 points

• 02 to 03 years’ experience in leading the implementation of the

GRC system or ICT systems = 01 point

• Less than 02 years’ experience in leading the implementation

of the GRC system or ICT systems = 0 points

Bidders must clearly indicate its proposed Technical Lead, profiles/ CVs not

indicating the details of the Technical Lead will not be evaluated.

7. INTEGRATIO Bidders must submit a detailed integration plan for the integration 25

N PLAN of the proposed GRC System into ILMS and ERP. The plan should

cater for the following at a minimum:

• Integration Architecture and Design

o Proposed architecture diagram (system interactions, data

flow).

o Middleware, APIs, and connectors to be used.

o Data mapping (what data is shared, field mapping between

systems).

o Authentication and user identity management approach

(e.g., SSO, Active Directory).

• Data Management

o Data formats and standards.

RFQ/MICT/92/2025 | P a g e

o Frequency of data exchange (real-time, batch,

scheduled).

o Data validation rules.

o Error handling and reconciliation processes.

• Security and Compliance

o Data protection measures (encryption in transit and at

rest).

o Access controls and user permissions.

o Compliance with POPIA, ISO standards, and government

IT security policies.

o Audit trail and logging requirements.

• Testing and Validation

o Unit testing (individual components).

o System integration testing (end-to-end process).

o User Acceptance Testing (UAT) by MICT SETA stakeholders.

o Performance and stress testing.

Points on submission of detailed integration plan will be allocated

as follows [25]:

• A detailed integration plan which covers all four (04) elements

= 25 points

• A detailed integration plan which covers only three (03)

elements = 18 points

• A detailed integration plan which covers only two (02)

elements = 12 points

• A detailed integration plan which covers only one (01)

elements = 06 points.

A detailed integration plan which covers none of the six (0)

elements = 0 points.

A detailed integration plan for the integration of the proposed GRC System into

ILMS and ERP must cover all the four (04) elements and all its components in

detail. Non-compliance with the minimum requirements will be declared non-

responsive.

RFQ/MICT/92/2025 | P a g e

8. DATA Bidders must submit a data migration plan that will detail all data 10

MIGRATION migration activities during system implementation and all data

PLAN handover activities at the end of the contract period. The following

items must be covered:

o Data Migration Methodology and Approach;

o Data Quality Management and Validation;

o Risk Management and Business Continuity;

o Security, Privacy and Compliance; and

o Testing Strategy and Acceptance Management.

Points allocation of the data migration plan will be allocated as

follows [10]:

• A data migration plan which covers all five (05) of the elements

= 10 points

• A data migration plan which covers only four (04) of the

elements = 08 points

• A data migration plan which covers only three (03) of the

elements = 06 points

• A data migration plan which covers only two (02) of the

elements = 04 points

• A data migration plan which covers only one (01) of the

elements = 02 points.

• A data migration plan which covers none of the (0) elements =

0 points.

NB: All elements of Data Migration Plan must be covered in detail (not a

brief/summary).

TOTAL 100

MINIMUM THRESHOLD 70

Note: Bidders that do not meet the requirements of set technical/ functionality criteria will be

eliminated from further evaluation process.

RFQ/MICT/92/2025 | P a g e

8.3. STAGE 2: PRICE AND SPECIFIC GOALS

Only bidders or bid proposals received that have met the requirements of set technical/

functionality evaluation criteria will qualify for further evaluation on Price and Specific Goals

according to the 80/20 preference point system in terms of the Preferential Procurement

Regulations 2022, where 80 points will be for Price and 20 points will be for Specific Goals. Bid will

be awarded to the bidder scoring the highest points.

Specific Goal to be evaluated out of 20 Points:

Criteria Points

Enterprise which is at least 51% owned by historically disadvantaged 10

persons.

Enterprise which is at least 51% owned by historically disadvantaged 05

women.

Enterprise which is at least 51% owned by historically disadvantaged youth. 05

Total 20

** Enterprises that are not owned by historically disadvantaged persons will be allocated 0 points.

Bidder must submit the following documents:

• Certified ID copies of the company’s directors as per the CIPC documents. (Certified copies

must not be older than six (06) months).

• CIPC Documents and/or share certificate (for companies with more than one (01) Director).

Failure on the part of a service provider to submit proof or documentation required in terms of this Bid to

claim points for specific goals, will be interpreted to mean that preference points for specific goals are not

claimed

RFQ/MICT/92/2025 | P a g e

SBD 4

BIDDER’S DISCLOSURE

1. PURPOSE OF THE FORM

Any person (natural or juristic) may make an offer or offers in terms of this invitation to bid. In

line with the principles of transparency, accountability, impartiality, and ethics as enshrined

in the Constitution of the Republic of South Africa and further expressed in various pieces of

legislation, it is required for the bidder to make this declaration in respect of the details

required hereunder.

Where a person/s are listed in the Register for Tender Defaulters and / or the List of Restricted

Suppliers, that person will automatically be disqualified from the bid process.

2. Bidder’s declaration

2.1 Is the bidder, or any of its directors / trustees / shareholders / members / partners or any

person having a controlling interest1 in the enterprise,

employed by the state? YES/NO

2.1.1 If so, furnish particulars of the names, individual identity numbers, and, if applicable, state

employee numbers of sole proprietor/ directors / trustees / shareholders / members/

partners or any person having a controlling interest in the enterprise, in table below.

Full Name Identity Number Name of State institution

2.1.2. Do you, or any person connected with the bidder, have a relationship with any person

who is employed by the procuring institution? YES/NO

2.2.1 If so, furnish particulars:

................................................................................................

................................................................................................

1 the power, by one person or a group of persons holding the majority of the equity of an enterprise,

alternatively, the person/s having the deciding vote or power to influence or to direct the course and

decisions of the enterprise.

RFQ/MICT/92/2025 | P a g e

2.3 Does the bidder or any of its directors / trustees / shareholders / members / partners or

any person having a controlling interest in the enterprise have any interest in any other

related enterprise whether or not they are bidding for this contract? YES/NO

2.3.1 If so, furnish particulars:

........................................................................................

........................................................................................

No specific requirements found

B-BBEE Minimum Level: 3