Renewal of ivanti ism (enterprise service management) maintenance and support services for the road accident fund

This document is the SBD4 Declaration of Interest form for the Road Accident Fund tender for Ivanti ISM maintenance and support services. The declaration requires bidders to provide transparency regarding state employment, institutional relationships, and related enterprise interests. All bids must be submitted independently without collusion. The document emphasizes constitutional principles of transparency, accountability, impartiality, and ethics in the bidding process.

This document contains only the SBD4 Declaration of Interest form. The actual submission requirements, returnable documents list, and submission address are not included in this document. Bidders must complete the SBD4 form declaring: (1) whether the bidder or any directors are employed by the state, (2) whether any connected person works at the procuring institution, and (3) interests in other related enterprises. The declaration certifies that the bid was submitted independently without collusion or prior consultation with competitors. False declarations may result in disqualification, reporting to the Competition Commission, or restriction from public sector work for up to 10 years.

The document does not contain technical specifications for the Ivanti ISM maintenance and support services. This section of the tender specification appears to be missing from the provided document. Bidders should note that the tender requires an accredited support partner of Ivanti for the renewal of Ivanti Neurons for Enterprise Service Management (ISM) maintenance and support for a period of twelve months.

The SBD4 Declaration of Interest form requires bidders to disclose: (1) Whether the bidder or any directors/trustees/shareholders/members/partners or persons with controlling interest are employed by the state, (2) Whether any person connected to the bidder has a relationship with someone employed by the procuring institution, (3) Whether the bidder has interests in other related enterprises. Bidders must declare that they have submitted their bid independently without consultation, communication, or arrangement with competitors regarding quality, quantity, specifications, prices, market allocation, or intentions. The bid must not have been disclosed to competitors prior to opening. The declaration is made in line with principles of transparency, accountability, impartiality, and ethics as enshrined in the Constitution of South Africa.

Must be an accredited Ivanti support partner.

Demonstrated experience in Ivanti ISM (Neurons for Enterprise Service Management) maintenance and support.

Compliance with South African data protection laws (POPIA).

Ability to implement and maintain strict physical and cybersecurity measures.

Willingness to undergo security screening/vetting by RAF for directors and resources.

Capacity to handle confidential, personal, or sensitive information securely.

Subcontractors (if any) must meet the same eligibility and compliance standards.

The service provider must comply with the Protection of Personal Information Act (POPIA).

• The service provider will handle RAF's confidential, private, personal, or sensitive information (files, data, documents).
• The service provider must have policies to meet RAF requirements and POPIA provisions.
• Required security measures include:
• Document handling and transportation: Use secure, lockable transport systems and containers.
• Record keeping: Maintain accurate records of document location, access history, and retention schedule.
• Document retrieval: Use secure protocols, verify requester identity, and ensure secure transport.
• Secure storage: Store physical documents in lockable cabinets.
• Access control: Limit access to authorised personnel only, with monitoring.
• Fire suppression: Have a fire suppression system (e.g., CO2 extinguishers) on premises.
• Physical security: Secure perimeter, controlled access, surveillance, alarms, and 24/7 monitoring.
• Network security: Implement firewalls, intrusion detection, and encryption.
• Cybersecurity: Use robust measures against malware, phishing, and unauthorised access; encrypt data in transit and at rest; regularly update and patch systems.
• Incident reporting: Have a documented incident response plan and report breaches to RAF promptly.
• Subcontractor oversight: Ensure subcontractors adhere to the same data protection and cybersecurity standards.
• Audit and monitoring: RAF reserves the right to audit compliance; the service provider must cooperate.

The service provider must implement comprehensive security and data protection measures.

• Comply with the Protection of Personal Information Act (POPIA) and other applicable data protection laws.
• Safeguard data against unauthorised access, disclosure, alteration, and destruction.
• Immediately inform RAF of any data breaches or security incidents.
• Impose confidentiality obligations on agents, subcontractors, or third parties handling records.
• Screen or vet third-party service providers handling PII and require data protection agreements.
• RAF reserves the right to conduct security screening or vetting of company directors and resources provided.
• Implement robust cybersecurity measures, including encryption and regular system updates.
• Have a documented incident response plan for data breaches.
• Ensure subcontractors adhere to the same data protection and cybersecurity standards.
• Cooperate with RAF audits and monitoring of compliance.

The service provider must have fire suppression and physical security measures.

• Have a fire suppression system or similar (e.g., CO2 fire extinguishers) on premises to prevent damage or loss of documents in a fire.
• Ensure the premises have a secure perimeter with controlled access and/or surveillance systems.
• Have secure doors, locks, and alarms to prevent unauthorised access.
• Implement physical security measures to ensure the safety and security of documents.

The service provider must ensure the security of documents and data.

• Implement physical security measures: controlled access points, surveillance cameras, and/or 24/7 monitoring.
• Protect all document storage facilities against unauthorised access.
• Immediately inform RAF and provide evidence (e.g., CCTV footage, police reports) of any real, attempted, or suspected breach of physical security.
• Implement network security measures: firewalls, intrusion detection, and encryption to protect against unauthorised access or attacks.
• Access control: Grant access on a need-to-know basis, use strong authentication methods, and regularly review permissions.
• Data protection obligations: Handle personal and sensitive data in compliance with laws; safeguard against unauthorised access, disclosure, alteration, and destruction; inform RAF immediately of breaches; ensure confidentiality by imposing obligations on agents, subcontractors, or third parties.
• Third-party oversight: Screen or vet third-party service providers handling PII and require data protection agreements.
• RAF reserves the right to conduct security screening or vetting of company directors and resources.
• Cybersecurity standards: Implement robust measures against cyber threats; use encryption for data in transit and at rest; regularly update and patch systems.
• Incident reporting and response: Have a documented incident response plan; report security incidents or data breaches to RAF promptly.
• Subcontractor and third-party oversight: Ensure subcontractors adhere to the same standards; the service provider is responsible for their compliance.
• Audit and monitoring: RAF reserves the right to audit and monitor compliance; the service provider must cooperate with audits.

The Road Accident Fund (RAF) seeks to appoint an accredited Ivanti support partner for the renewal of Ivanti ISM (Ivanti Neurons for Enterprise Service Management) Maintenance and Support for 12 months. The service provider must facilitate maintenance renewal with Ivanti OEM, provide 100 onsite/online support hours, apply security patches, perform upgrades, and conduct enhancements, report development, and training.

RFQ issued: 19 June 2026. Closing date and time: 25 June 2026 at 15:00. RFQ validity period: 30 days from closing date. Expected service start: 12-month agreement from the date of the last signatory.

Enquiries: Email [email protected] or contact Ntsako Baloyi at 012 649 2023. Submission address: Email all quotations to [email protected]. Delivery address for goods/services: RAF Head Office, 420 Witch Hazel Avenue, Centurion, Eco Glades, Pretoria, 0046.

Submit all RFQ responses via email to [email protected]. Late quotations will not be accepted. Complete and sign all Annexures (Standard Bidding Documents and Mandatory Evaluation documents). Collusive bidding or multiple submissions from entities with common directors/shareholders will result in disqualification. If not contacted within 14 working days of RFQ issuance, consider the proposal unsuccessful. Prohibition: Do not offer gifts, hospitality, or benefits to RAF officials. Report any solicitation to the RAF fraud line at 0800 005919 or risk being restricted from conducting business with Organs of State.

Scope: Renewal of Ivanti ISM (Ivanti Neurons for Enterprise Service Management) Maintenance and Support for 12 months. Services required: Facilitate once-off maintenance renewal with Ivanti OEM, including security patches, hotfixes, and software releases. Provide 100 onsite and online support hours. Apply security patches and perform version upgrades. Conduct capability/module enhancements, report development, and training in new capabilities. OEM must provide technical documentation and support for deployments.

Pricing must be VAT-inclusive (if VAT-registered) and quoted in ZAR. VAT vendors must include VAT; failure to do so will deem the quoted price as all-inclusive. Non-VAT-registered suppliers charging VAT will be disqualified. Only prices completed in the provided tables will be evaluated. No price changes accepted after the Award Letter/PO is issued. Two pricing tables required: (1) Remote and Onsite Support Hours (100 hours), (2) Once-Off Ivanti Service Manager Maintenance Renewal (8 units for Ivanti Service Management Concurrent 2015, 40 units for Ivanti Help Desk Concurrent).

Mandatory: Service provider must be an accredited Ivanti support partner in South Africa. Submit a valid Accreditation Certificate or Letter of Accreditation from Ivanti OEM by the closing date. RAF reserves the right to verify. Additional requirements: CSD registration is mandatory for all suppliers. Tax compliance (SARS) is required. Suppliers with disabilities must provide a valid medical certificate. Complete SBD 4 (Bidders Disclosure) and SBD 6.1 (PPR 2022). Annexure A: Security Measures must be submitted.