Enterprise backup solution renewal & support tender – national ICT opportunity (2 years)

Bidding procedure enquiries:

• Contact: Nonkululeko Mthethwa
• Telephone: (010) 593 0533
• Email: [email protected]

Technical enquiries:

• Contact: Mawande Jadezweni
• Telephone: (010) 593 0533
• Email: [email protected]

Submission address:

Community Schemes Ombud Service

Ground Floor

Die Anker Building

1279 Mike Crawford Road

Centurion, 0157

Submission method: deposit the bid in the tender box at the CSOS office before the closing date and time.

Submission address:

Community Schemes Ombud Service

Ground Floor

Die Anker Building

1279 Mike Crawford Road

Centurion, 0157

Closing time: 10 November 2026 at 12:00 PM.

Returnable documents (all must be completed, signed and submitted):

• SBD 1 (Invitation to Bid): bidder and contact details, signed as the offer cover page.
• SBD 3.3 (Pricing Schedule for professional services): completed pricing schedules.
• SBD 4 (Declaration of Interest): discloses whether any director or shareholder is employed by the state or connected to anyone at the department.
• SBD 6.1 (Preference Points Claim): claims B-BBEE points under the PPPFA 80/20 system.
• Valid B-BBEE certificate (SANAS-accredited), or sworn affidavit (EME), or CIPC-issued certificate.
• Proof of CSD registration (CSD summary report or CSD number).
• Valid tax PIN or tax compliance letter.
• Storvault OSM or distributor letter confirming the bidder is a registered reseller (mandatory).
• OSM letter stating the data residency of the solution (mandatory).
• Authority to sign / board resolution (proof of authority).

Disqualification risks:

• Bids received after the closing date and time.
• Bids not submitted on the official forms (re-typed bids).
• Counter conditions or amendments to bid conditions.
• Failure to comply with mandatory requirements (Storvault reseller and data residency letters).
• Failure to complete all pricing schedules in full and transfer totals to the summary cost schedule.
• Omissions or irregularities in the bid (may be waived at CSOS discretion).

Evaluation method: 80/20 preference point system under the PPPFA and Preferential Procurement Regulations, 2022.

Stage 1 – Pre-qualification and mandatory requirements:

• Bidders must submit the Storvault OSM or distributor letter confirming registered reseller status, valid at closing and for the contract duration.
• Bidders must submit an OSM letter stating the solution's data residency, which must be cloud-based with South African data residency.
• Failure to comply with mandatory requirements results in disqualification before functionality, price and preference evaluation.

Stage 2 – Functionality evaluation (minimum qualifying score: 70/100):

• Methodology (40 points): must address five components – hosted solution/data residence/storage; data protection and recovery (endpoint, server, M365); security/data loss prevention/threat scan; M365 backup deployment and support; advisory services for DRP and backup/recovery best practices. Scoring: 0 if any component not adequately addressed; 5 if all five adequately addressed.
• Company experience (20 points): five contactable client references on client letterhead for Storvault backup deployment and/or maintenance and support. References must be dated, signed, and confirm Storvault work. Scoring: 0 for none/non-responsive; 1 for one; 2 for two; 3 for three; 4 for four; 5 for five.
• Documentation and skills transfer (20 points): plan covering solution documentation/manuals, skills transfer to internal staff (training plan), custom report configuration/analytics, and ongoing support plan/platforms. Scoring: 0 if any component not adequately addressed; 5 if all four adequately addressed.
• Technical lead experience (20 points): CV of the technical lead with Storvault experience. Scoring: 0 for no/non-responsive CV; 1 for 1 year; 2 for 2 years; 3 for 3–4 years; 4 for 5–6 years; 5 for 7+ years. Only one CV for the technical lead; more than one results in 0.

Stage 3 – Price and specific goals (80/20):

• Only bidders achieving 70% in functionality proceed.
• Price and specific goals are evaluated under the 80/20 system.
• Specific goals points: 17 points for EME/QSE owned 51%+ by black women, youth, persons with disabilities, or military veterans; 1 point for EME/QSE owned 51%+ by black people in rural/underdeveloped areas or townships; 1 point for EME/QSE cooperatives owned 51%+ by black people; 1 point for EME/QSE owned 51%+ by black people in general (priority: Africans, Indians, coloureds).
• CSOS may invite bidders to presentations or interviews and may request additional information.

The CSOS requires renewal of the Storvault Enterprise Backup Solution licensing and support for a two-year (24-month) period, covering endpoint, server, virtual, physical, and Microsoft 365 cloud environments.

Current environment:

• Servers: 20 (Windows Server 2019 and 2022), estimated 10 TB storage.
• Endpoints (workstations): 300 (Windows 11 Professional), estimated 20 TB storage.
• Microsoft 365 users: 300 full suite, plus 45 email-only (Exchange Online).
• SharePoint and Teams sites: 151, estimated 8 TB.
• SQL Server databases: multiple instances (SQL 2012, 2014, 2019), estimated 6 TB.

Scope of work:

• Renew Storvault backup solution licenses for required workloads.
• Provide backup and recovery coverage for endpoint, server, virtual, physical, and M365 cloud environments.
• Centralised management, monitoring, alerting, reporting, and administration of backup activities.
• Support, maintenance, advisory services, incident escalation, and service level reporting.
• Assisted backup and recovery testing, documentation, knowledge transfer, and alignment to CSOS DR/BCP.
• Threat scan license activation and deployment to all active backups.
• Backup and recovery policy enhancements and reviews.
• Disaster recovery plan enhancements and reviews.

Required capabilities:

• Automated, plan-based backups with source-side deduplication and incremental-forever backups.
• Self-service restore for end users (mobile apps or web portal).
• Point-in-time, item-level, and cross-OS recovery.
• Threat scan with hyper threat hunting (hash/YARA IOC matching) and deep inspection (heuristic, signature, AI-driven malware/ransomware detection).
• Advanced threat detection, remote wipe, data encryption (in transit and at rest), anti-ransomware capabilities.
• Centralised policy management, automated deployment via MDM, eDiscovery, compliance management.
• Global access, MFA for management console, Azure AD/SAML integration, secure file sharing, migration assistant.
• Documentation and skills transfer: full setup documentation, training manuals, training for ICT infrastructure unit, automated custom report configuration, full access for at least five CSOS staff.

Advisory services:

• Align backup/recovery policy and procedures to the solution.
• Assist in updating the Disaster Recovery Plan.
• Conduct quarterly documented restore testing.
• Provide quarterly backup health reports, restore test reports, risk observations, DR readiness recommendations, and improvement actions.
• Support annual review of backup/recovery procedures.

Service level, recovery and security requirements:

• Propose backup schedules, retention periods, RTO, RPO, escalation procedures, monitoring, and reporting aligned to CSOS BCP/DR.
• Solution must support encryption in transit and at rest, RBAC, MFA for admin access, immutable or logically protected backup copies, ransomware detection/recovery, and audit logging.
• Provide incident management and support model with priority levels, response times, resolution targets, escalation paths, service desk channels, and monthly performance reporting.
• Confirm data residency, data location, data protection controls, POPIA-aligned processing, secure deletion procedures, and whether any processing occurs outside South Africa.

Out of scope:

• Procurement of unrelated infrastructure, endpoint devices, servers, or network equipment.
• Replacement of business applications, M365 services, or core production systems.
• Major re-architecture of the CSOS ICT environment unless required for the renewed backup service.
• Development, replacement, or modification of CSOS business applications unless required for backup integration, reporting, recovery, or agreed implementation.

The methodology must address five components: hosted solution/data residence/storage; data protection and recovery (endpoint, server, M365) implementation and support; security, data loss prevention, and threat scan implementation; M365 backup deployment and support; advisory services for DRP and backup/recovery best practices.

For each component, a detailed implementation and support mechanism must be included.

Scoring: 0 if any component not adequately addressed; 5 if all five adequately addressed.

The bidder must provide an implementation plan with key milestones: kick-off, environment assessment, licence renewal, configuration, testing, documentation, skills transfer, acceptance, and handover.

Company experience: provide five contactable client references on client letterhead for Storvault backup deployment and/or maintenance and support. References must be dated, signed, and confirm Storvault work. Scoring: 0 for none/non-responsive; 1 for one; 2 for two; 3 for three; 4 for four; 5 for five.

Technical lead: submit a CV/profile of the technical lead with experience working on the Storvault Backup Solution, detailing years of experience. Scoring: 0 for no/non-responsive CV; 1 for 1 year; 2 for 2 years; 3 for 3–4 years; 4 for 5–6 years; 5 for 7+ years. Only one CV for the technical lead; more than one results in 0.

Evaluation also considers qualifications and experience of staff proposed to handle the contract, and reference checks.

Quality assurance is a key priority of CSOS, including safekeeping of scheme governance documentation.

The solution must support encryption in transit and at rest, RBAC, MFA for admin access, immutable or logically protected backup copies, ransomware detection/recovery, and audit logging.

The bidder must provide a clear incident management and support model with priority levels, response times, resolution targets, escalation paths, service desk channels, and monthly service performance reporting.

Quarterly documented restore testing and quarterly backup health reports are required.

Acceptance of delivery is subject to successful licence activation, backup configuration, monitoring/reporting setup, documented restore testing, solution documentation, and skills transfer completion.

All pricing in ZAR, inclusive of applicable taxes, distinguishing once-off, recurring monthly, annual, variable, and total costs.

No hidden or unpriced cost components accepted.

Prices firm for the full contract duration unless escalation is expressly stated, justified, and accepted by CSOS.

Escalation must disclose affected items, basis, calculation method, effective date, frequency, and maximum percentage cap. CPI/CPIX/foreign exchange/OEM increases must be supported by evidence.

Evaluation uses total cost of ownership for the full two-year period.

Payment terms: 30 days from invoice, subject to agreed payment plan based on deliverables and milestones.

Pricing schedules: Schedule 1 (implementation services), Schedule 2 (licenses renewal), Schedule 3 (maintenance and support), and a summary cost schedule. All schedules must be completed in full and totals transferred to the summary; failure invalidates the bid.

CSOS may conduct supplier due diligence including financial stability confirmation.

Pricing format:

• All pricing in South African Rand (ZAR), inclusive of applicable taxes.
• Must distinguish once-off, recurring monthly, annual, variable, and total costs over the full contract period.
• No hidden or unpriced cost components accepted.
• Prices must remain firm for the full contract duration unless escalation is expressly stated, justified, and accepted by CSOS.
• Escalation must disclose affected items, basis, calculation method, effective date, frequency, and maximum percentage cap. CPI/CPIX/foreign exchange/OEM increases must be supported by evidence.
• Evaluation uses total cost of ownership for the full two-year period, including all disclosed costs.

Pricing schedules (must be completed in full and totals transferred to the summary cost schedule):

• Schedule 1: Solution Implementation Services – once-off assessment/implementation, documentation/skills transfer/training, other costs.
• Schedule 2: Licenses Renewal – Storvault Server Foundation (20 per year), Storvault Capacity TopUp (8 TB year 1, 10 TB year 2), Metallic Office 365 (325 per year), Storvault Laptop Foundation (325 per year), variable cost provision.
• Schedule 3: Maintenance and Support – 24 months of maintenance/support, quarterly advisory services (8 quarters), other costs.
• Summary cost schedule: totals from all schedules plus any other costs, giving the total bid price (incl. VAT). Failure to complete all schedules invalidates the bid.

Payment terms: 30 days from invoice, subject to an agreed payment plan based on deliverables and milestones.

Supplier due diligence: CSOS may conduct due diligence prior to award or during the contract, including site visits, financial stability confirmation, and requests for additional information.

CSD registration:

• Compulsory registration on the National Treasury Central Supplier Database (CSD) at submission and for the duration of the contract if successful.
• Provide CSD summary report or CSD number.

Tax compliance:

• Must be tax compliant at submission and remain compliant for the contract duration.
• Submit SARS tax compliance status PIN (TCS PIN) or printed TCS certificate.
• Consortia, joint ventures, and subcontractors must each submit a separate TCS certificate/PIN/CSD number.

B-bbee:

• Submit a valid B-BBEE certificate issued by a SANAS-accredited verification agency, or a sworn affidavit signed by the EME representative and attested by a Commissioner of Oaths, or a B-BBEE certificate issued by CIPC.
• To qualify for preference points for specific goals, the CSD report must reflect EME or QSE status with 51% or more black ownership for at least one designated group.

State employment:

• No bids from persons in the service of the state, companies with directors who are state employees, or close corporations with members who are state employees.

Single bid rule:

• No entity or associated entities may be involved in more than one bid; non-compliance may result in disqualification of both entities.

Fronting:

• Government condemns fronting; investigations may be conducted. If fronting is established, the bidder has 14 days to prove otherwise; failure may invalidate the bid/contract and lead to restriction from public sector business for up to 10 years.

Bid validity: 120 days from submission.

Contract duration: 24 months.

Bids are binding and irrevocable for 120 days.

CSOS may amend, modify, withdraw, or terminate the RFP at any time without notice or liability.

Amendments will be communicated in writing; no oral amendments considered.

CSOS may conduct site inspections or request supporting documentation to verify bid information.

Bidders must notify CSOS SCM in writing of any material changes in control or composition after submission; CSOS may disqualify the bidder.

Bids become the property of CSOS and will not be returned; CSOS will make reasonable efforts to maintain confidentiality.

Non-responsive bids may be waived at CSOS discretion, applied consistently.

CSOS may require a formal presentation at a date and time determined by CSOS; costs borne by the bidder.

CSOS is not obliged to appoint the lowest-priced bidder if it lacks capacity or comprehension of the scope; may appoint the second-ranked bidder with justification.

Service delivery manager must attend to deficiencies within 24 hours of written notification.

At contract end or termination, the provider must support transition and exit activities: handover, data export/transfer, secure deletion confirmation, knowledge transfer, and continuity support.

Acceptance of delivery subject to successful licence activation, backup configuration, monitoring/reporting setup, documented restore testing, solution documentation, and skills transfer completion.

Bidders must cater for after-hours work to minimise business impact.