Provision and implementation of a comprehensive and supported financial risks management and analytics system for ESKOM treasury department, designed for management and hedging of ESKOM portfolio risks

Bidders must complete and submit Schedule Q (Supplementary Terms) with their responses to the items specified, which will be drafted as legally binding commitments based on supplier responses and Eskom minimum requirements. The document requires responses to Sections A and the numbered clauses covering data ownership, security, confidentiality, privacy, data location, cross-border data flows, service termination, disaster recovery, service levels, insurance, indemnification, and liability. All returnable forms and documents required by the RFP must be included.

Bidders must agree to Eskom's minimum criteria as set out in Schedule Q. Key mandatory commitments include: Eskom retains full ownership of all data, information, insights, analyses, models, frameworks, and deliverables; no use of Eskom data for advertising or service improvement without written consent; no offshoring of data unless as a mere conduit; immediate and permanent destruction of data at contract end with a signed declaration; notification of security breaches (strict requirement); audit rights for Eskom including unannounced penetration tests; adherence to Eskom's data retention policies; provision of security certifications and audit reports (e.g., ISO 27001/2, SOC 1/2, ISAE); identification of data centre operators and acceptance of joint and several liability for third-party hosts; no withholding of services under any circumstances; and provision of financial reports to assess viability. Bidders must also complete the required response sections in Schedule Q.

The tender is for the provision and implementation of a comprehensive and supported Financial Risks Management and Analytics System for Eskom Treasury, designed for management and hedging of Eskom portfolio risks. Bidders must specify: whether the solution is cloud or on-premises; the cloud service model (SaaS, PaaS, IaaS, iPaaS, DRaaS, SECaaS, FaaS, DaaS, CaaS, or SaaS with AI); the hosting region (Eskom prefers South Africa and EU); whether the system is hosted on Eskom's Microsoft Azure tenant or Virtual Private Cloud; the type of data to be stored or processed; technology languages, platforms, stacks, and components used; and a description of the solution (on-premises, cloud, or hybrid). Bidders must also provide details on data storage, backup, preservation, retention, and disposition procedures, including file integrity checks, audit trails, and notification of changes to the system. The system must provide access to audit trails and metadata, and support data retrieval and restoration within defined service levels.

The supplier must provide details on the service offering, including technology languages, platforms, stacks, and components used, and describe the solution (on-premises, cloud, or hybrid). The supplier must also explain how the service will evolve over time, including migration and emulation activities.

Eskom requires the supplier to provide information regarding past performance with disaster recovery procedures, and to list subcontractors and their locations. The supplier must also provide details of its financial condition and mechanisms to enable Eskom access to services and data in the event of insolvency.

Eskom requires the supplier to provide evidence of security best practices such as ISO 27001/2 or SOC reports, annual penetration tests, SAST/DAST results, and DR test results. The supplier must also provide a gap analysis and risk mitigation plan where gaps exist between Eskom requirements and supplier policies.

Eskom requires the supplier to provide details of its standard offering related to service availability, including uptime requirements and details of planned downtime. The supplier must also advise on remedies available to Eskom in the event of downtime.

Bidders must provide details of their standard offering related to service availability, including uptime requirements and details of planned downtime. Bidders must advise on remedies available to Eskom in the event of downtime. Eskom requires that data transfer at contract termination be at no additional cost. Bidders must provide information on their financial condition and mechanisms to enable Eskom access to services and data in the event of insolvency. Eskom may require periodic financial reports and may terminate the agreement if it concludes the supplier lacks financial wherewithal.

Bidders must provide evidence of security best practices, including annual attestation documentation or security certifications such as ISO 27001/2, SOC 1/2, or ISAE reports. Bidders must provide results of annual penetration tests or red teaming exercises, SAST and DAST results, and DR test results. Bidders must provide a gap analysis and risk mitigation plan where gaps exist between Eskom requirements and supplier policies. Bidders must list subcontractors and their locations, and ensure subcontractors agree to the same level of obligations with back-to-back undertakings. Bidders must confirm whether they are accredited with a third-party certification program and provide details of audits, including scope and frequency (SOC 1 Type II and SOC 2 Type II attestation reports).

Eskom requires the supplier to maintain and enforce safety and physical security procedures with respect to access and maintenance of Eskom data, at least equal to industry standards, in accordance with Eskom security requirements, and providing appropriate safeguards against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure.

Eskom requires the supplier to provide disaster recovery and business continuity plans, including details on redundancy, RTO/RPO, and procedures to ensure services are not interrupted during disasters. The supplier must also provide a copy of its current disaster recovery plan and updates.

The agreement includes clauses on data ownership, availability, retrieval, storage, retention, disposition, security, confidentiality, privacy, data location, cross-border data flows, end of service, disaster recovery, service levels, insurance, indemnification, and liability. Eskom requires the supplier to warrant data availability, allow audits, and provide remedies for service breaches. Eskom reserves the right to terminate without penalty if the supplier changes or for convenience.

Schedule Q contains supplementary terms for cloud service providers, including Eskom minimum criteria for data ownership, security, confidentiality, privacy, data location, cross-border data flows, service termination, disaster recovery, and service levels. Eskom requires full data ownership, prohibits supplier use of Eskom data for advertising or other purposes without consent, mandates strict security measures, restricts offshoring of data, and requires data destruction upon contract termination.