Renewal of quest licenses and managed services for the gauteng provincial legislature (2 years)

Briefing session (non-compulsory): 16 October 2026 at 11:00 AM, venue: Microsoft Teams

Closing date: 22 October 2026 at 11:00 AM

Commencement date: 1 November 2026

Completion date: 31 October 2028

Non-compulsory briefing session: 16 October 2026 at 11:00 AM, venue: Microsoft Teams.

Contact: T Bokgwathile

Email: [email protected]

Submission email: [email protected]

Mandatory returnable documents (failure to submit any results in automatic disqualification):

• Full technical proposal with supporting documents.
• Pricing schedule (firm pricing) on SBD 3.3, completed and signed.
• Bidder's Disclosure (SBD 4), original completed and signed.
• Preference Point Claim form (SBD 6.1), original completed and signed.
• Copy of full company registration documents.
• Copies of South African IDs for all directors.
• Company profile.
• Valid Quest OEM Authorization Letter confirming accreditation and status level.
• Joint Venture/Consortium agreement or Trust Deed (if applicable), with certified copies of shareholder certificates, company registration documents, and IDs of directors/members for all parties.

Submission method: electronic format, submitted via email to [email protected]

Late submissions will not be accepted and will be automatically disqualified.

All Standard Bidding Documents (SBD forms) must be fully completed and signed; failure to submit a completed and duly signed SBD 3 will automatically disqualify the bidder.

Evaluation is conducted in sequential phases using the 80/20 preference point system. Total points 100, cut-off points 70.

Phase 1: Administrative Compliance (Pre-qualification) - compliance with all mandatory administrative and statutory requirements, including signed and completed bid documents, company registration documents, and any other mandatory documentation. Non-compliance results in disqualification.

Phase 2: Functionality / Technical Evaluation - only bidders scoring a minimum of 70 out of 100 points on functionality proceed.

Functionality criteria (total 100 points, cut-off 70):

• Bidder Experience (weight 25): minimum four (4) signed reference letters of similar projects. 4 letters = 3 points, 5-6 letters = 4 points, 7 or more = 5 points.
• Team Lead Experience (weight 25): Team leader must have a bachelor's degree in IT or Information Systems and minimum 5 years' progressive experience in Cyber security. CV with qualification and 5 years' experience = 3 points, 6 years = 4 points, 7+ years = 5 points.
• Technical Proposal (weight 50): Must address 8 scope elements (Licensing, Managed Identity Services, Support Services, Monthly Reviews and Reporting, Service Level Agreement, Response and Resolution Times, Support Channels, SLA Requirements). Addressing 6 of 8 elements = 3 points, 7 of 8 = 4 points, all 8 = 5 points.

Phase 3: Price and Specific Goals (80/20) - only bidders achieving minimum 70 points on functionality qualify. Price contributes 80 points, Specific Goals contribute 20 points.

Specific Goals (20 points):

• Black Ownership (7): 100% = 7, 51% = 5, less than 51% = 3, not Black owned = 0.
• Women Ownership (5): 100% = 5, 51% = 3, less than 51% = 1, not Women owned = 0.
• Youth Ownership (5): 100% = 5, 51% = 3, less than 51% = 1, not Youth owned = 0.
• PWDs Ownership (3): 100% = 3, 51% = 2, less than 51% = 1, not PWDs owned = 0.

Price formula: Ps = 80(1 - (Pt - Pmin)/Pmin).

The Gauteng Provincial Legislature (GPL) requires the renewal of Quest software licenses and managed services for a period of two (2) years. The service provider must be an accredited Quest Software partner.

Scope includes:

• Licensing: Provide valid Quest license renewal for 2 years. First year: Quest (1-AAH-QOD-SKHYB-247) x 550 users and (1-TNO-QODSAAS-247) x 550 users. GPL reserves the right to review the number of users for the second year and request updated quotation.
• Managed Identity Services: Monthly extraction of identity logs and audit violations (minimum 4 reports per month where required). Continuous monitoring of GPL's audit violations. Risk prioritization and remediation guidance. Custom vulnerability reporting. Executive reporting on overall identity posture.
• Support Services: Tier 2 and Tier 3 technical support. Telephonic and remote support. Incident logging via helpdesk/email/phone. Defined support hours (minimum 8x5 with escalation capability).
• Monthly Reviews and Reporting: Monthly service review meetings, executive vulnerability reports, technical remediation reports, risk trend analysis, findings presented to GPL ICT.
• System Health Checks: Regular health checks on Quest platform, monitor scan performance and coverage, ensure optimal configuration and updates, provide recommendations for continuous improvement.
• Service Level Agreement (SLA): Must sign a formal SLA aligned to GPL requirements.

SLA incident classification and response times:

• Severity 1 (Critical): Response 15 min, start 1 hr, resolution 4 hrs.
• Severity 2 (High): Response 30 min, start 4 hrs, resolution 8 hrs.
• Severity 3 (Medium): Response 2 hrs, start 8 hrs, resolution 24 hrs.
• Severity 4 (Low): Response 4 hrs, start 24 hrs, resolution 48 hrs.

All incidents must be logged and tracked via a formal ticketing system.

The technical proposal must describe the approach to each of eight scope elements: Licensing, Managed Identity Services, Support Services, Monthly Reviews and Reporting, Service Level Agreement, Response and Resolution Times, Support Channels, and SLA Requirements. Proposals addressing 6 of 8 elements (excluding Response and Resolution Times and Support Channels) score 3; 7 of 8 elements score 4; all 8 elements score 5.

Bidder Experience: Minimum four (4) signed reference letters of similar projects. 4 letters = 3 points, 5-6 = 4 points, 7+ = 5 points. Team Lead Experience: Bachelor's degree in IT or Information Systems and minimum 5 years' progressive experience in Cyber security. CV with qualification and 5 years = 3 points, 6 years = 4 points, 7+ years = 5 points.

Pricing schedule (SBD 3.3) must be completed for professional services. Prices quoted in ZAR, VAT inclusive/exclusive. Offer valid for 120 days. Bidders must indicate whether rates are firm for the full period; if not, provide basis for adjustments. Include ceiling price, personnel rates (hourly/daily), phases with cost per phase and man-days. Travel and other expenses only actual costs recoverable with certified invoices and proof.

Pricing must be quoted in South African Rand (ZAR), VAT inclusive/exclusive as specified. Offer must be valid for 120 days from closing date. Firm pricing required for the full contract period; if not firm, provide basis for adjustments (e.g., CPI). Payment will be made upon satisfactory delivery of agreed milestones. No advance payments unless approved in writing. Travel and accommodation expenses: only actual costs recoverable, with certified invoices and proof of expenses. Pricing schedule must include ceiling price based on total estimated time, hourly/daily rates for personnel, phases with cost per phase and man-days.

Mandatory compliance requirements (failure to submit results in automatic disqualification):

• CSD registration (company registration documents) and CIPC compliance.
• Valid tax clearance (SARS requirements).
• Copies of South African IDs for all directors.
• Valid Quest OEM Authorization Letter confirming accreditation and status level.
• Valid B-BBEE certificate or affidavit as per 80/20 preference point system.
• SBD 4 (Bidder's Disclosure) - disclose if any director/shareholder is employed by the state or connected to the procuring institution; false declaration disqualifies.
• SBD 6.1 (Preference Point Claim Form) - claim specific goals points (Black, Women, Youth, PWDs ownership).
• SBD 3.3 (Pricing Schedule - Professional Services) - firm pricing, signed.
• Company profile.
• Experience: minimum four (4) signed reference letters of similar projects.

Contract period: Two (2) years, from 1 November 2026 to 31 October 2028. Payment upon satisfactory delivery of agreed milestones. No advance payments unless approved in writing. Confidentiality obligations apply. GPL reserves the right to appoint one or more service providers, not to make any appointment, or to establish a panel. GPL is not bound to accept lowest-priced bid. Late submissions automatically disqualified. False or misleading information leads to disqualification. Bidders must comply with SCM, CIPC, and SARS requirements. All costs incurred by bidders are for bidder's own account.

The service provider must be an accredited Quest Software partner with valid Quest OEM Authorization Letter. The provider must sign a formal SLA and a 2-year managed services contract. GPL reserves the right to review the number of users for the second year and request an updated quotation. Monthly identity scanning minimum 4 times per month. All incidents logged via formal ticketing system.

Mandatory requirement: submit a valid Quest OEM Authorization Letter confirming accreditation and status level. Demonstrate experience with a list of similar projects and a proven record of four (4) similar assignments. Provide a technical proposal and pricing schedule. Availability of appropriately qualified personnel with relevant certifications and capacity to deliver within required timeframes.

Functionality evaluation criteria: Bidder Experience (weight 25), Team Lead Experience (weight 25), Technical Proposal (weight 50). Total 100 points, cut-off 70 points. Only bidders scoring 70 or more proceed to Price and Specific Goals phase using 80/20 system. Price formula: Ps = 80(1 - (Pt - Pmin)/Pmin). Specific Goals: Black Ownership (7 points), Women Ownership (5), Youth Ownership (5), PWDs Ownership (3).