National Energy Regulator of South Africa Tenders & RFQ's

Closing: responses must reach nersa by 11 november 2026 at 11:00. Data residency: all data must reside within south africa's borders; where that is not practically possible, section 72 of popia must be complied with. Data classification: every dataset must be classified under the minimum information security standards before IT is placed in the cloud; data classified secret or top secret must not be moved to public, hybrid or community clouds wherever practical, while public-facing content should sit in a public cloud. Contract conditions: the agreement must record that nersa owns all rights, title and interest in the data, identify the geographic locations where storage and processing occur, state the governing jurisdiction, provide for safe return or transfer of data if the provider is taken over, and set out what happens to data, applications and infrastructure at contract end (transfer, return or permanent deletion). Security controls: the state security agency principles apply, covering physical and environmental security, ICT business continuity and incident response, network inventory and configuration management, data encryption, access control, monitoring and logging, network security, and identity and access management; access rights must be reviewed regularly and backups taken and reviewed to limit data loss. Pre-adoption assessments: a comprehensive risk assessment is required for each cloud service, captured in a business case and presented to the audit and risk committee, together with a cloud readiness assessment before adoption; the business case must cover scope, short, medium and long-term budget, total cost of ownership, required skills and enabling infrastructure. Contract term: the hub is required for five years; cloud contracts running longer than three but less than five years are treated as medium term and must allow early termination, with the method of calculating any damages agreed at contracting.