Password management solution (saas) – 5-Year supply, support and maintenance

Closing date: 22 September 2026 at 11:00. Non-compulsory briefing session: 28 August 2026 at 11:00 via Microsoft Teams (link provided in the tender document). Closing date for bid questions/enquiries: 04 September 2026. Publication date for Questions & Answers: 08 September 2026.

A non-compulsory briefing session will be held on 28 August 2026 at 11:00 AM via Microsoft Teams. Link: https://teams.microsoft.com/meet/344019301752423?p=v1PsxyG1MHgbDaHA53

Bid enquiries: Bathabile Mahlangu, Supply Chain Management Office, email [email protected]. No telephonic enquiries. Questions must be submitted in writing to the email address. Submission address: Road Accident Fund, Eco Glades 2 Office Park, 420 Witch-hazel Avenue, Centurion, 0046.

Bids must be hand-delivered or couriered to the tender box at the Road Accident Fund, Eco Glades 2 Office Park, 420 Witch-hazel Avenue, Centurion, 0046, on or before the closing date and time. Faxed and emailed bids are not accepted. Submit an original bid document plus one copy in the envelope. The proposal must be valid for 90 days from the closing date. Bids must be submitted on the official forms provided, not re-typed. Returnable documents: SBD 1 (Invitation to Bid), SBD 3.3 (Pricing Schedule – Professional Services), SBD 4 (Declaration of Interest), SBD 5 (National Industrial Participation Programme), SBD 6.1 (Preference Points Claim), proof of CIDB registration if applicable, the specification document, the General Conditions of Contract, a Tax TCS PIN (separate for each JV/consortium/sub-contractor party), a copy of the joint venture agreement if applicable, and proof of CSD registration. All SBDs must be completed, attached and signed. Failure to provide or comply with any required particulars may render the bid invalid. Late bids will not be accepted for consideration.

Mandatory returnable documents include: SBD 1, SBD 3.3, SBD 4, SBD 5, SBD 6.1, CIDB registration (if applicable), specification document, General Conditions of Contract, Tax TCS Pin, joint venture agreement (if applicable), and Central Supplier Database registration.

Evaluation proceeds in four phases. Phase 1: initial screening of responses. Phase 2: mandatory evaluation – bidders must comply with two mandatory requirements: (a) be an OEM-licensed or accredited partner/supplier for the proposed solution, with valid documentary proof from the OEM; (b) the solution must be GDPR and/or POPIA compliant, with the hosting data centre in Europe or South Africa, supported by proof. Failure on any mandatory requirement disqualifies the bid. Phase 3: technical/functional evaluation (100 points): Part A functionality – bidders must score at least 70/100 to proceed; Part B solution demonstration – bidders must score at least 80/100 to proceed. Phase 4: price and specific goals evaluation under the preferential point system. The applicable preference point system is 80/20 or 90/10; the document does not state which applies. Specific goals: South African citizens who had no franchise in national elections prior to 1983 or 1996 (10 points under 90/10, 5 under 80/20), women (8 under 90/10, 4 under 80/20), persons with disabilities (2 under 90/10, 1 under 80/20).

The RAF requires an enterprise Password Management Solution deployed as Software-as-a-Service (SaaS) for five years, with the RAF owning the subscription. The solution must generate complex and unique passwords, securely store passwords with industry-standard encryption, provide single sign-on integrated with Microsoft Entra ID, and scale to at least 3,600 users. It must support Windows, Linux, iOS, Android and MacOS, plus browser extensions for Chrome, Microsoft Edge and Safari. Business requirements include password generator, encryption, SSO, synchronisation across devices, auditing of user and admin activity, out-of-the-box and customisable reporting (password health, security score, activity history, users enrolled, breach alerts), integration with Microsoft Entra ID and external SIEM solutions, an admin console for access management and policy enforcement, alerts for breaches/reused passwords, and autofill. The solution must include a five-year SaaS subscription with OEM maintenance and support where the RAF can open support cases directly. Post-implementation professional services: maximum 5 hours per month, payable on usage basis only, with unused hours carried over on written request. Bidders must have a business continuity management plan available for RAF inspection. Proposals must be clearly indexed and cross-referenced to a table of contents.

Bidders must submit a project/implementation plan with activities and timelines, addressing: (i) cloud-based/SaaS deployment/provisioning, (ii) integration with RAF's authentication solutions, (iii) configuration of audit and reporting requirements, (iv) software deployment in the RAF environment, and (v) transition to production/handover to operations. Scoring: plan not provided = 0; addresses 0-2 requirements = 5; 3-4 requirements = 10; all 5 = 15. The plan is part of the technical/functional evaluation (total 100 points, minimum threshold 70).

Company track record (20 points): provide at least two reference letters for implementation/support/supply of a Password Management Solution within the last seven years from bid closing. Letters must be on client letterhead with nature of service, dates (day/month/year format if in the seventh year), contact person and details. Scoring: less than 2 references = 0; 2 references = 15; more than 2 = 20. Resource requirements (5 points): provide one Password Management Specialist/Engineer with at least 3 years' cybersecurity experience, part of which must relate to deploying/supporting password management solutions, plus valid cybersecurity certifications. Submit detailed CV with dates (month & year) and copies of certificates. Scoring: not provided or below minimum = 0; meets minimum = 3; exceeds = 5. Overlapping experience counted once.

The bidder must have a business continuity management plan available for inspection by the RAF during the contract. The proposed solution must implement encryption in line with industry standards and be GDPR and/or POPIA compliant, with hosting in Europe or South Africa.

Complete SBD 3.3 (Pricing Schedule – Professional Services). Indicate a ceiling price for the total project including all expenses and taxes. Provide hourly/daily rates for personnel, cost per phase and man-days, travel expenses (actual costs recoverable with proof), and other expenses (e.g. accommodation). State period required for commencement, estimated man-days, and whether rates are firm for the full contract period; if not firm, provide adjustment basis (e.g. CPI).

Pricing must be submitted on SBD 3.3 (Pricing Schedule – Professional Services). Bidders must indicate a ceiling price for the total estimated time for completion of all phases, including all expenses and all applicable taxes. Provide hourly and daily rates for personnel involved, cost per phase and man-days, travel expenses (actual costs recoverable with proof), and other expenses such as accommodation. State the period required for commencement after acceptance, estimated man-days for completion, and whether rates are firm for the full contract period; if not firm, provide the basis for adjustment (e.g. CPI). The offer must be valid for 90 days from the closing date. No bid bond or performance guarantee is stated for this tender, except that under the NIP programme a successful bidder with a contract value above R10 million may be required to submit a performance guarantee to the dti.

Bidders must be registered on the National Treasury Central Supplier Database (CSD). Bidders must be tax compliant and provide a SARS Tax TCS PIN (or CSD number if no TCS PIN); in JVs/consortia/sub-contracting, each party must submit a separate TCS PIN. Bidders who are persons in the service of the state, or companies/close corporations with directors/members in the service of the state, will not be considered. Bidders listed on the National Treasury register of Restricted Suppliers or Tender Defaulters are automatically disqualified. Proof of CIDB registration is required if applicable. The bidder must be an eligible, registered service provider in terms of applicable laws. The bidder must be an OEM-licensed or accredited partner/supplier for the proposed solution, with valid proof. The solution must be GDPR and/or POPIA compliant, with hosting in Europe or South Africa. Returnable forms: SBD 1, SBD 3.3, SBD 4, SBD 5, SBD 6.1 – all must be completed, attached and signed. A joint venture agreement must be provided if applicable. Proof of authority to sign (e.g. company resolution) must be submitted.

Preference points will be awarded for specific goals under the 80/20 or 90/10 system. Goals: South African citizens who had no franchise in national elections prior to 1983 or 1996 (10 points under 90/10, 5 under 80/20), women (8 under 90/10, 4 under 80/20), persons with disabilities (2 under 90/10, 1 under 80/20). Claims must be supported by proof; failure to submit proof means points are not claimed.

The successful bidder will be required to sign a written contract form (SBD 7). The contract is subject to the Preferential Procurement Policy Framework Act, 2000, the Preferential Procurement Regulations, 2017, the General Conditions of Contract (GCC) and any special conditions. Under the National Industrial Participation (NIP) Programme, contracts with imported content equal to or exceeding US$10 million (or multiple contracts exceeding US$3 million each over two years) incur an NIP obligation of 30% of imported content. Successful bidders with contracts above R10 million must report details to the dti within five working days of award. The NIP obligation agreement is between the dti and the successful bidder, not the purchasing institution.

Bidders must be registered on the Central Supplier Database and be tax compliant. Bidders must not be persons in the service of the state. Bidders must submit a valid TCS PIN or CSD number. Joint ventures must submit separate TCS PINs for each party. Bidders must be OEM-licensed or accredited partners/suppliers for the proposed solution. The solution must be GDPR/POPIA compliant with hosting in Europe or South Africa.

Evaluation phases: Phase 1 initial screening, Phase 2 mandatory evaluation (OEM partnership and GDPR/POPIA compliance), Phase 3 technical/functional evaluation with functionality threshold of 70/100 and solution demonstration threshold of 80/100, Phase 4 price and specific goals evaluation.