Audit log solution for sage 300 finance with mfa support – nrcs (90/10 preference system, 70-Point minimum)

Closing date: 25 September 2026 at 11:00

No briefing or site visit is stated in the document.

Bidding procedure enquiries:

• Contact: Don Mandlazi
• Email: [email protected]
• Telephone: 012 482 8921

Technical enquiries:

• Contact: Phatudi Mudzunga
• Email: [email protected]
• Telephone: N/A

Submission address: email only to [email protected]

Submission method: email only. No hand-delivered quotes accepted.

Submission email: [email protected]

Closing time: 25 September 2026 at 11:00

Returnable forms (all must be completed and signed):

• SBD 1 (Invitation to Bid): bidder and contact details, signed as the offer cover page.
• SBD 3.1 (Pricing Schedule – Firm Prices): fixed, all-inclusive pricing for the required services.
• SBD 4 (Declaration of Interest): discloses any director/shareholder employed by the state or connected to anyone at NRCS.
• SBD 6.1 (Preference Points Claim): claims B-BBEE points under the 80/20 system.
• Proof of CSD registration (business registration, tax compliance, B-BBEE certificate or sworn affidavit will be verified on CSD).
• SARS TCS PIN or printed TCS certificate (or CSD number if no TCS PIN).
• Proof of authority to sign (e.g. company resolution).

Disqualification risks:

• Any returnable form left unsigned or omitted.
• Late quotations, regardless of reason.
• Non-compliance with specifications.
• Bidders listed on the Register for Tender Defaulters or List of Restricted Suppliers.
• Bidders who are persons in the service of the state, or companies with directors who are.

Three-stage evaluation:

• Stage 1: Compliance with compulsory requirements (all returnable forms, CSD registration, tax compliance, B-BBEE evidence).
• Stage 2: Functionality evaluation. Minimum qualifying score: 70/100. Scoring includes SLA proposal (1–5 pts), client references (1–3 pts), and other criteria (total 100).
• Stage 3: 80/20 preference point system. 80 points for price, 20 points for B-BBEE status level (Level 1 = 20 pts, Level 2 = 18, Level 3 = 14, Level 4 = 12, Level 5 = 8, Level 6 = 6, Level 7 = 4, Level 8 = 2, non-compliant = 0).

The NRCS requires a suitably qualified and accredited Sage support partner to provide comprehensive support, maintenance, enhancement, security, and upgrade services for its ERP environment.

Systems in scope:

• Sage 300 Finance (version 2021): General Ledger, Accounts Payable, Accounts Receivable, Cashbook, Budget Maintenance, RecExpress.
• Sage 300 People: Personnel Management and Job Administration, Employee Self-Service (ESS) including Manager Self-Service, Payroll and Leave Management, Performance Management, Personal Development Plan (PDP).

Integrated systems (support only for integration issues affecting Sage; full application support excluded unless approved):

• Microsoft Dynamics 365 Customer Engagement (Levy Declarations, Customer Portal, Service Requests)
• Direct Hire (eRecruitment)
• Modern Flow (Workflow Automation, Requisition Management)

Scope of work includes:

• End-user support, incident investigation and resolution, system monitoring, access and authorisation maintenance, performance monitoring and optimisation.
• Application of security and functional updates, testing, and enhancement of functionality.
• Upgrade Sage 300 Finance and Sage 300 People to the latest vendor-supported version approved by NRCS, including planning, installation, configuration, testing, migration, UAT support, knowledge transfer, and post-implementation support.
• Supply, install, configure, test, support and maintain an Audit Log Solution compatible with current and upgraded Sage environments. The solution must monitor and record user activities, transactions, additions, modifications, approvals, reversals, deletions, before-and-after values of key records, user logins, security changes, and support segregation of duties monitoring. Audit information must be exportable to Excel, PDF and other formats.
• Implement and support a Multi-Factor Authentication (MFA) solution for Sage 300 Finance and related components (Sage 300 People already supports MFA).
• Payment gateway integration support and maintenance: building APIs, supporting integrations, configuration, testing, monitoring secure transactions, real-time payment status updates, automated receipts, incident resolution, reconciliation support, and compatibility with provider updates.
• Year-end financial support: dedicated support during annual financial statement preparation, audit preparation, and year-end processing; assistance with Age Analysis, sub-ledger to GL reconciliation, posting errors, transaction imbalances, and reporting exceptions.
• Maintenance schedule: Official releases of bug fixes and new features implemented once a month, collectively, within the last week of the calendar month. Security updates implemented within two working days of release. Production maintenance performed outside business hours; provider must be available.
• All maintenance performed remotely; NRCS provides access. If on-site maintenance is required, NRCS pays travel, accommodation, subsistence and other charges.
• In case of server crash, NRCS and provider jointly restore the system.
• Provider must submit copies of its Incident Management, Request Management, Change Management, and Problem Management processes.
• Skills transfer: formal knowledge transfer to NRCS ICT Team, with a plan demonstrating how knowledge and skills will be transferred and effectiveness assessed.
• Monthly reporting: number of incidents logged/resolved, SLA performance statistics, outstanding incidents, enhancements completed, hours utilised/remaining, security and maintenance activities, risks and recommendations.
• Contract duration: 12 months.
• Exit and handover: full knowledge transfer and handover of all system documentation and configurations at contract end.

Limitations and exclusions (NRCS responsibility):

• Maintenance of Windows operating system and IIS webserver.
• Routine backups of database and server.
• Antivirus software for Windows OS.
• Creation and maintenance of SSL certificates.
• Application access and authorisation (NRCS maintains user access profiles and segregation of duties).

The service provider must submit a Service Level proposal aligned with NRCS requirements and prioritisation approach. Incidents will be assigned a Severity Code from 1 to 4 based on impact and availability of workarounds.

Severity codes and target response/resolution times:

• Severity 1: Initial response 30 minutes, subsequent response every 1 hour, resolution 8 hours.
• Severity 2: Initial response 45 minutes, subsequent response every 2 hours, resolution 16 hours.
• Severity 3: Initial response 1.5 hours, subsequent response every 4 hours, resolution 4 calendar days.
• Severity 4: Initial response 2 hours, subsequent response next business day, resolution 20 calendar days.

The provider must submit its Incident Management, Request Management, Change Management, and Problem Management processes.

The provider must submit a knowledge transfer plan demonstrating how skills will be transferred to NRCS ICT Team and how effectiveness will be assessed.

Bidders must be accredited Sage support partners with current accreditation for Sage 300 Finance and Sage 300 People.

Functionality evaluation includes experience criteria:

• Evidence of Sage 300 version upgrade projects (Finance and/or People). Scoring ranges from 1 point (no evidence) to 5 points (four or more projects including MFA, Audit Log solutions, security enhancements, and successful knowledge transfer).
• Client references: contactable reference letters on client's official letterhead confirming successful completion of a Sage 300 version upgrade. The letter must indicate client name, Sage product upgraded, successful completion, and contact person/email/telephone. Scoring ranges from 1 point (no references) to 5 points (five or more references).
• Technical feasibility: detailed information on how the system will be supported and maintained, demonstrating skills, expertise, and capacity. Processes such as incident management, problem management, escalation matrix, and change management must be submitted.

Quality requirements are embedded in the scope of work:

• All updates must be Official Releases; Development Releases only used in extreme cases with Technical Contact advice.
• Updates must be tested in a Development/UAT environment before production implementation.
• A written log of updates applied to the Production Environment must be maintained.
• The provider must submit copies of its Incident Management, Request Management, Change Management, and Problem Management processes.
• The provider must ensure systems perform optimally without errors, defects, system failures, or bugs.
• The provider must test and validate payment gateway functionality after system updates, enhancements, or infrastructure changes.
• The provider must provide test results before requesting the customer to test.

Pricing must be fixed and firm, all-inclusive. Non-firm prices (including those subject to exchange rate variations) will not be considered.

Pricing items:

• Monthly fee for support and maintenance (quantity 12)
• Upgrade of Sage 300 Finance to the latest vendor-supported version (quantity 1)
• Supply, configuration and support of Audit Log Solution (quantity 1)
• Training sessions (as and when required)

Subtotal, then VAT 15%, then total amount including VAT.

Offer valid for 90 days from closing date.

All delivery costs must be included in the bid price.

Pricing format: Fixed and firm, all-inclusive pricing. Non-firm prices (including those subject to exchange rate variations) will not be considered.

Pricing items:

• Monthly fee for support and maintenance (quantity 12)
• Upgrade of Sage 300 Finance to the latest vendor-supported version (quantity 1)
• Supply, configuration and support of Audit Log Solution (quantity 1)
• Training sessions (as and when required)

Offer validity: 90 days from the closing date of the bid.

All delivery costs must be included in the bid price.

VAT: 15% to be added to the subtotal.

No bid security, guarantee, or retention is stated in the document.

CSD registration: Proof of registration on the Central Supplier Database is required. The following will be verified on CSD: business registration (including directorship and membership details), tax compliance status, and B-BBEE certificate or sworn affidavit.

Tax compliance: Bidders must submit a SARS TCS PIN or a printed TCS certificate. If no TCS PIN is available, a CSD number must be provided. In consortia/JVs/subcontracting, each party must submit a separate TCS certificate/PIN/CSD number.

B-BBEE: A B-BBEE status level verification certificate or sworn affidavit (for EMEs and QSEs) must be submitted to qualify for preference points. Points are awarded per the 80/20 system (Level 1 = 20 pts down to Level 8 = 2 pts, non-compliant = 0).

Sage accreditation: Bidders must be accredited Sage support partners with current accreditation for Sage 300 Finance and Sage 300 People.

State employment: No bids will be considered from persons in the service of the state, companies with directors who are, or close corporations with members who are.

Foreign suppliers: Must complete the questionnaire in SBD 1 if applicable.

SBD 4 (Declaration of Interest): Must disclose any relationship with NRCS employees or state employment. Failure to disclose all CSD-registered active companies linked to all directors leads to disqualification.

SBD 6.1 (Preference Points Claim): Must be completed to claim B-BBEE points.

SBD 7 (Contract Form): Successful bidder will be required to fill in and sign a written contract form.

General Conditions of Contract (GCC): Must be signed on each and every page by the service provider.

B-BBEE verification certificate or sworn affidavit (for EMEs and QSEs) must be submitted to qualify for preference points.

The 80/20 preference point system applies: 80 points for price, 20 points for B-BBEE status level.

Points for B-BBEE level: Level 1 = 20, Level 2 = 18, Level 3 = 14, Level 4 = 12, Level 5 = 8, Level 6 = 6, Level 7 = 4, Level 8 = 2, non-compliant = 0.

Failure to submit proof of B-BBEE status with the bid means no preference points are claimed.

Contract duration: 12 months.

Special conditions:

• NRCS may, at its sole discretion, award an assignment or any part thereof to the service provider.
• The service provider may not cede, assign, or subcontract any part of the agreement without prior written authorisation from NRCS.
• NRCS may vary an instruction to include more assignment.
• The successful contractor must comply with NRCS policies and procedures and maintain a high level of confidentiality of information.
• All information, documents, programs and reports must be regarded as confidential and may not be made available to any unauthorised person or institution without the written consent of the Chief Executive Officer or delegate.
• The service provider may prepare a separate pricing schedule in light of the items provided in the pricing schedule.
• The General Conditions of Contract (GCC) must be signed on each and every page.
• Training sessions will be scheduled as and when required.
• NRCS reserves the right to award the bid in full or part, and to not appoint or cancel the project.

NRCS may award in full or part, vary instructions. Service provider may not cede/assign/subcontract without written authorisation. Confidentiality of all information. GCC signed on each page. Training as required.

Bidders must be accredited Sage support partners with current accreditation for Sage 300 Finance and Sage 300 People.

Must submit completed SBD forms (SBD 1, 3.1, 4, 6.1), CSD registration proof, B-BBEE certificate or sworn affidavit, client references for Sage 300 support, SLA proposal, knowledge transfer plan, and incident/problem/change management processes.

Must comply with NRCS policies and procedures, maintain confidentiality, and sign the GCC on each page.

Must not be persons in the service of the state, nor companies with directors who are.

Must not be listed on the Register for Tender Defaulters or List of Restricted Suppliers.