Implementation and operationalisation of data governance strategy, framework and data management for PRASA (6 months)

Submission channel

• Bids are submitted electronically through the SAP Business Network (SAP Ariba) e-tender platform.
• Bidders must hold a SAP Business Network account before responding: either create a free account, or link an existing account to PRASA.
• Once registered with PRASA, bidders can respond to PRASA RFQs and RFPs and maintain their supplier data.

Accessing the advert

• Locate the RFQ or RFP on the National Treasury e-Tender website.
• Copy the https link shown under Special Conditions, paste it into a browser and open the page.
• Select Respond, then Register or Login.

Registration steps

• Log in with existing SAP Business Network credentials, or select Register Now to create a new profile.
• Enter the email address and consent to storing that email ID.
• Enter the one-time password sent to that email address.
• Select Netherlands: Amsterdam as the closest data centre, then confirm.
• Complete the company information and follow the remaining registration steps.

Responding to the event

• Select Respond, then Review Prerequisites and accept them to proceed.
• Answer every question, including all mandatory questions marked with an asterisk (*).
• Capture pricing against the specific line items and update the overall total.
• Submit the bid using Submit Entire Response; if mandatory questions or required information are missing, a pop-up identifies the section concerned.

Communication

• All RFP/RFQ correspondence must be conducted through the platform Message Board, which is the only channel for communicating with PRASA buyers and sourcing specialists.
• Bidders can view and reply to buyer messages, and compose new messages with an optional subject and attachments.

PRASA requires a service provider to implement and operationalise an enterprise-wide Data Governance Strategy, Framework and Data Management capability for a six-month period. The engagement is intended to maximise the value of PRASA's recently deployed Data Governance Platform (data warehouse, data lake, data integration and analytics). The provider must establish sustainable data management capabilities, implement priority data initiatives (Customer 360, Passenger Count, Integrated Financial Reporting, Train Tracking), and provide full-time specialist resources, while enabling skills transfer and sustainability.

Closing date: 5 November 2026 at 10:00 (per tender record).

Suppliers briefing: No briefing session will be held unless SCM issues a formal notice to bidders. Any clarification questions and PRASA responses must be managed through the official procurement channel — no briefing date, time or venue is stated.

Returnable forms and documents (all must be submitted):

• SBD 1 (Invitation to Bid): bidder and contact details, signed as the offer cover page.
• SBD 4 (Declaration of Interest): discloses whether any director or shareholder is employed by the state or connected to anyone at PRASA.
• SBD 6.1 (Preference Points Claim): claims B-BBEE points under the PPPFA 80/20 system.
• SBD 8 (Declaration of Bidder's Past Supply Chain Management Practices): declares no prior corrupt or fraudulent practices.
• SBD 9 (Certificate of Independent Bid Determination): certifies the price was set independently, with no collusion.
• JV/consortium/subcontracting agreement (or explicit 'Not applicable') where applicable.
• Information Security certification or ISO/IEC 27001 certificate.
• Valid B-BBEE certificate (SANAS-accredited) or applicable sworn affidavit for EME/QSE; a JV/consortium must submit a combined certificate in the JV/consortium's name.
• CSD registration number (or evidence of registration within 14 days after closing).
• Valid SARS Tax Compliance Status PIN.
• CIPC company registration documents.
• Copies of directors' identity documents.
• Signed availability confirmations, completed Annexure B, CVs, certified qualifications and relevant certifications for all nine key resources.
• Annexure A (pricing schedule) completed with fixed prices for each deliverable.

Disqualification risks:

• Missing or non-compliant mandatory document (Stage 1A or 1C) results in automatic disqualification.
• Missing basic compliance documents may result in disqualification unless PRASA grants a grace period (e.g. 7 days for outstanding documents, 14 days for CSD registration).
• Quotations received after the closing time.

Submission method and address not stated in the document.

Evaluation stages:

• Stage 1A – Mandatory Compliance: submission of signed JV/consortium/subcontracting or partnering agreement (or explicit 'Not applicable'); Information Security certification or ISO/IEC 27001 certificate. Failure to submit = disqualification.
• Stage 1B – Basic Compliance: B-BBEE certificate or affidavit, CSD registration, Tax Compliance PIN, CIPC registration, directors' ID copies. Failure may result in disqualification (grace period possible, e.g. 7 days).
• Stage 1C – Mandatory Technical Compliance: all nine key resources submitted with signed availability, Annexure B, CVs, certified qualifications and certifications; at least one technical personnel with valid HCIE-Cloud or HCIP-Cloud certificate (OEM of PRASA's Private Cloud and Data Platform); Data Governance Lead must have DAMA CDMP Practitioner or above (or related). Failure = automatic disqualification.

Stage 2 – Technical/Functionality (minimum threshold 70 out of 100, and at least 3/5 in every criterion):

• Relevant Company Experience: 40 points. Scoring: 0 points for no references; 1 point for 1 reference; 2 points for 2 references; 3 points for 3 references; 4 points for 4 references; 5 points for 5 or more references (presumably scaled to 40).
• Capability of Key Resources: 40 points. Scoring bands for each key role based on years of experience: less than 8 years = 0; 8 years = 1; 9–10 years = 2; 11–12 years = 3; 13–14 years = 4; 15+ years = 5 (per role, presumably aggregated to 40).
• Technical Approach and Implementation Methodology: 20 points. PRASA-specific response covering inception project plan, current-state assessment, data and information governance strategy, governance framework and operating model, Customer 360 governance pack, Passenger Count governance pack, Integrated Financial Reporting governance pack, Train Tracking governance pack, and knowledge transfer and handover pack. Scoring: 0 for no approach or only 1 element; 1 point for 2 elements; 2 points for 4 elements; 3 points for 6 elements; 4 points for 7 elements; 5 points for 9 elements (presumably scaled to 20).

Stage 3 – Price and Specific Goals (80/20 system):

• Price: 80 points. Formula: Ps = 80 [1 - ((Pt - Pmin) / Pmin)].
• Specific Goals: 20 points total, allocated as:
• Black Women Owned: 4 points (certified ID copies).
• Black Youth Owned: 4 points (certified ID copies).
• Owned by Black People with Disabilities: 4 points (certified ID copies and medical confirmation).
• B-BBEE Contributor Status Level 2 or better: 4 points (valid B-BBEE certificate or affidavit).
• EME or QSE with at least 51% Black Ownership: 4 points (audited AFS and/or valid B-BBEE certificate or affidavit).

Bidders scoring below 70 in Stage 2 do not proceed to Stage 3.

Scope of work (six-month engagement):

• Current-State Assessment: assess PRASA's existing data governance, data management, data architecture, reporting and analytics environment; review the Data Governance Platform (data warehouse, data lake, integration, reporting, analytical capabilities); identify gaps in data ownership, quality, accessibility, integration, security, privacy, metadata, lineage and lifecycle management; identify key data sources, systems, stakeholders, dependencies, risks and priority business requirements; produce a current-state assessment and recommendations report.
• Data Governance Strategy and Framework: develop/review and operationalise an enterprise-wide Data Governance Strategy aligned with PRASA's business and digital objectives; develop a Data Governance Framework defining governance principles, structures, decision rights, accountabilities and escalation mechanisms; review/develop data architecture definitions; establish and run a Data Governance Council and supporting forums; define roles and responsibilities for data owners, stewards, custodians, system owners and users; develop a governance operating model and RACI matrix; establish compliance monitoring processes.
• Data Governance Policies, Standards and Procedures: develop/refine policies and standards for data quality, classification, access, sharing, integration, retention, security, privacy and acceptable use; establish naming, modelling, definition, capture, storage and reporting standards; develop issue identification/registration/escalation/resolution processes; align controls with legislation (including POPIA) and PRASA policies; establish document approval, publication, review and maintenance processes.
• Data Management Implementation – Priority Data Initiatives: establish practical data management capabilities across the data lifecycle; implement data quality rules, controls, validation and remediation; develop business glossary, data dictionary and metadata repository; document data lineage; establish master and reference data management; define data retention, archival and disposal; identify authoritative source systems and reduce duplication; develop performance measures, dashboards and reporting.
• Data Architecture and Integration: assess and refine enterprise data architecture in alignment with the Data Governance Platform; develop target-state architecture for priority initiatives; design data models, integration patterns, pipelines and information flows; integrate operational/business data into data warehouse and data lake; implement ingestion/transformation/validation/storage/consumption controls; ensure security, scalability, maintainability and alignment with PRASA technology standards; produce technical documentation.
• Priority initiatives (each with full lifecycle: requirements confirmation, source documentation, acceptance criteria, testing, deployment, operational documentation):
• Customer 360: consolidated and trusted view of customer information; customer master data, matching, deduplication and quality rules; customer profiles, segmentation models, analytical dashboards; secure and lawful processing controls.
• Passenger Count: integrate passenger-count data from operational systems; consistent definitions, measures and validation rules; dashboards showing volumes, trends, routes, stations, services and time periods; reconciliation and exception identification.
• Integrated Financial Reporting: integrate financial and operational data; common definitions, business rules, mappings and reconciliation controls; dashboards for financial performance, budget, expenditure, revenue and management reporting; traceability from reports to source.
• Train Tracking: integrate train movement, scheduling and operational data; integrated view of train location, service status, delays and performance (subject to source-system availability); quality and validation controls; operational dashboards and analytical reports.
• Specialist resources (full-time for six months): Data Governance Lead/Project Lead; Privacy and Information Governance Specialist; Power BI Specialist; Data Scientist; Data Engineer; Data Architect; Data Quality and Metadata Specialist; Data Analyst; Business Analyst/Change Management Lead. Replacement of any approved resource requires prior written PRASA approval and equivalent or superior qualifications.
• Programme and Project Management: maintain a detailed six-month implementation plan (activities, milestones, dependencies, responsibilities, deliverables); apply project governance, risk, issue and change control; run regular project/technical working sessions; submit progress reports; maintain project registers; manage stakeholder engagement.
• Change Management, Training and Knowledge Transfer: develop stakeholder engagement and adoption plan; conduct awareness and training sessions; deliver practical knowledge transfer (joint delivery, coaching, workshops); produce user guides, technical manuals, governance guides and training materials; ensure PRASA personnel can administer/maintain/support the capability after contract end.
• Testing, Deployment and Handover: develop test plans, cases and acceptance criteria; conduct data validation, integration, performance and UAT; resolve defects; deploy to PRASA environments via change management; submit complete documentation; conduct formal handover and provide close-out report.

Key deliverables (minimum):

• Current-state assessment and gap-analysis report
• Approved Data Governance Strategy and Framework
• Data governance operating model, structures and RACI
• Data governance and data management policies, standards and procedures
• Business glossary, data dictionary, metadata and data-lineage documentation
• Target-state data architecture, data models and integration designs
• Implemented data pipelines, quality controls and reporting mechanisms
• Operational Customer 360, Passenger Count, Integrated Financial Reporting and Train Tracking solutions
• Power BI dashboards, analytical models and management reports
• Training materials, user guides and knowledge-transfer records
• Monthly progress reports and updated project registers
• Final implementation roadmap, sustainability plan, handover documentation and close-out report

Deliverable target timing (within six-month term):

• Week 1: Inception and project plan
• Week 3: Current-state assessment
• Week 5: Data and information governance strategy
• Week 7: Governance framework and operating model
• Week 10: Customer 360 governance pack
• Week 12: Passenger Count governance pack
• Week 16: Integrated Financial Reporting governance pack
• Week 20: Train Tracking governance pack
• Week 24: Knowledge transfer and handover pack

All deliverables must be PRASA-specific, evidence-based, internally consistent, version-controlled, supported by editable source files, and approved by PRASA, complying with PRASA's governance, architecture, information security, technology and document-management requirements.

Methodology requirements:

• Submit a PRASA-specific technical approach covering: inception and project plan; current-state assessment; data and information governance strategy; governance framework and operating model; Customer 360 governance pack; Passenger Count governance pack; Integrated Financial Reporting governance pack; Train Tracking governance pack; and knowledge transfer and handover pack.
• Provide a detailed six-month implementation plan with activities, milestones, dependencies, responsibilities and deliverables.
• Apply project governance, risk management, issue management and change-control processes.
• Conduct regular project and technical working sessions with PRASA stakeholders.
• Submit progress reports and maintain project registers (risks, issues, decisions, actions, changes, deliverables).
• Develop and implement a stakeholder engagement and adoption plan.
• Conduct awareness and training sessions and provide practical knowledge transfer through joint delivery, coaching and workshops.
• Develop test plans, test cases and acceptance criteria; conduct data validation, integration, performance and UAT; deploy via PRASA change management; provide formal handover and close-out report.

Company experience: Relevant company experience is evaluated with verifiable client reference letters on the client's letterhead. Scoring: no references or non-compliant = 0 points; 1 reference = 1 point; 2 references = 2 points; 3 references = 3 points; 4 references = 4 points; 5 or more references = 5 points (weighted to 40 points).

Key personnel qualifications and experience (all full-time for six months):

• Data Governance and Management Lead/Project Lead: DAMA CDMP Practitioner or above (or related); at least 8 years in data management, including at least 3 years leading governance implementation.
• Privacy and Information Governance Specialist: relevant degree/diploma; POPIA, classification, retention and access governance experience.
• Power BI Specialist: relevant degree/diploma; Microsoft Power BI certification or equivalent; at least 8 years developing Power BI models, DAX, dashboards, report governance, performance optimisation, deployment pipelines and user enablement.
• Data Scientist: relevant degree/diploma; at least 8 years in statistical analysis, machine learning, forecasting, data profiling, feature engineering, model documentation and insight generation.
• Data Engineer: relevant degree/diploma; valid HCIE-Cloud or HCIP-Cloud certifications (OEM of PRASA's Private Cloud and Data Platform); at least 8 years designing and building data pipelines, integration patterns, quality checks, data stores, APIs, SQL, scripting and operational data workflows.
• Data Architect: relevant degree/diploma; at least 8 years in data architecture, modelling, metadata, master data, lineage, integration architecture, governance standards and enterprise information design; DAMA or related certification preferred.
• Data Quality Specialist: relevant degree/diploma; at least 8 years in data management, quality or governance, specialising in quality assessments, root cause analysis, remediation, governance programs and enterprise data management; DAMA-related certification preferred.
• Data Analyst: relevant degree/diploma; at least 8 years in analytics or reporting, specialising in data extraction/transformation, KPI reporting, BI, trend and predictive analytics; DAMA-related certification preferred.
• Business Analyst/Change Management Lead: relevant degree/diploma; at least 8 years facilitating cross-functional processes and training.

Evaluation of key resources is based on years of experience: less than 8 years = 0; 8 years = 1; 9–10 years = 2; 11–12 years = 3; 13–14 years = 4; 15+ years = 5 (per role, weighted to 40).

Quality and validation controls are required across data initiatives: define and implement data quality rules, controls, validation processes and remediation procedures; establish data quality and validation controls for train-tracking; establish reconciliation controls for financial reporting; conduct test planning, data validation, system integration, performance and user-acceptance testing; resolve identified defects and obtain formal acceptance from authorised PRASA stakeholders. All deliverables must be PRASA-specific, evidence-based, internally consistent, version-controlled and supported by editable source files.

Pricing schedule (Annexure A):

• Fixed total price (excl. VAT) for each of nine deliverables: inception and project management; current-state assessment; data and information governance strategy; governance framework and operating model; Customer 360 governance project; Passenger Count governance project; Integrated Financial Reporting governance project; Train Tracking governance project; knowledge transfer and handover.
• Prices must be fully inclusive of professional fees, project management, workshops, travel, administration, documentation, reporting and handover.
• Overall evaluated quotation price includes: A1 fixed governance deliverables (excl. VAT), total excl. VAT, VAT (15%), and total incl. VAT.
• Bidders must complete Annexure B (Key Resource Schedule) placing the cover page immediately before each key resource's CV, citing proposed person, qualification/certification, and CV page.

Price evaluation (Stage 3): 80 points for price using formula Ps = 80 [1 - ((Pt - Pmin) / Pmin)].

Pricing format: Fixed, fully inclusive price for each deliverable (Annexure A – Fixed Governance Deliverables). Prices must include professional fees, project management, workshops, travel, administration, documentation, reporting and handover. Prices are quoted excluding VAT; the schedule requires total excl. VAT, VAT (15%), and total incl. VAT.

Pricing schedule items (each fixed total excl. VAT):

1. Inception and project management
2. Current-state assessment
3. Data and information governance strategy
4. Governance framework and operating model
5. Customer 360 governance project
6. Passenger Count governance project
7. Integrated Financial Reporting governance project
8. Train Tracking governance project
9. Knowledge transfer and handover

No bid security, bond, guarantee, retention or payment terms are stated.

Mandatory compliance (Stage 1A):

• Signed JV/consortium/subcontracting/partnering agreement where applicable (or explicit 'Not applicable')
• Information Security certification or ISO/IEC 27001 certificate

Basic compliance (Stage 1B):

• Valid B-BBEE certificate (SANAS-accredited) or applicable sworn affidavit for EME/QSE; JV/consortium must submit combined certificate in the JV/consortium's name
• CSD registration number (a bidder not registered may be afforded 14 days after closing to register, subject to PRASA procurement requirements)
• Valid SARS Tax Compliance Status PIN
• CIPC company registration documents
• Copies of directors' identity documents

Mandatory technical compliance (Stage 1C):

• All nine key resources submitted with signed availability confirmations, completed Annexure B, CVs, certified qualifications and relevant certifications, with availability for the full six-month period
• At least one technical personnel with valid HCIE-Cloud or HCIP-Cloud certification issued by the OEM of PRASA's existing Private Cloud and Data Platform
• Data Governance and Management Lead must hold DAMA Certified Data Management Professional (CDMP) at Practitioner level or above (or related certification)

Key resource qualification and experience requirements (all require relevant degree/diploma where noted):

1. Data Governance and Management Lead/Project Lead: DAMA CDMP Practitioner or above (or related); at least 8 years in data management, including at least 3 years leading governance implementation.
2. Privacy and Information Governance Specialist: relevant degree/diploma in ICT, computer science, data management, data governance or ICT governance; demonstrable POPIA, data classification, retention and access governance experience.
3. Power BI Specialist: relevant degree/diploma in ICT, analytics, data, finance or related; Microsoft Power BI certification or equivalent; at least 8 years developing Power BI semantic models, DAX measures, dashboards, report governance, performance optimisation, deployment pipelines and user enablement.
4. Data Scientist: relevant degree/diploma in statistics, mathematics, data science, computer science, engineering or related; at least 8 years in statistical analysis, machine learning, forecasting, data profiling, feature engineering, model documentation and business insight generation.
5. Data Engineer: relevant degree/diploma in computer science, ICT, data engineering or related; valid HCIE-Cloud or HCIP-Cloud certifications issued by the OEM of PRASA's existing Private Cloud and Data Platform; at least 8 years designing and building data pipelines, integration patterns, data quality checks, data stores, APIs, SQL, scripting and operational data workflows.
6. Data Architect: relevant degree/diploma in ICT, computer science, data management or enterprise architecture; data governance, architecture or DAMA-related certification preferred; at least 8 years in data architecture, data modelling, metadata, master data, lineage, integration architecture, governance standards and enterprise information design.
7. Data Quality Specialist: relevant degree/diploma in ICT, computer science, data management or data governance; DAMA-related certification preferred; at least 8 years in data management, data quality or data governance roles, specialising in data quality assessments, root cause analysis, data remediation, data governance programs and enterprise data management.
8. Data Analyst: relevant degree/diploma in ICT, computer science, data management or data governance; DAMA-related certification preferred; at least 8 years in analytics or reporting roles, specialising in data extraction and transformation, KPI reporting, business intelligence, trend analysis and predictive analytics.
9. Business Analyst/Change Management Lead: relevant degree/diploma in ICT, computer science, data management, data governance or change management; at least 8 years facilitating cross-functional processes and training.

Certified copies must not be older than three months where certification is requested by PRASA.

Contract term: six (6) months from appointment. The service provider shall work with PRASA's ICT, business owners, finance, operations and nominated governance structures. Replacement of any approved resource requires prior written PRASA approval and equivalent or superior qualifications and experience. No penalty, termination or other contractual terms are stated.

Additional evaluation context: Stage 2 technical/functionality minimum threshold is 70 out of 100, with at least 3/5 in every criterion. Technical approach scoring is based on the number of required elements covered: 0 for no approach or 1 element, 1 for two, 2 for four, 3 for six, 4 for seven, 5 for nine elements (weighted to 20 points). Specific goals at Stage 3 are as described in the B-BBEE section. No further criteria are stated.