Appointment of a service provider to supply, and implement a cloud-based identity and access management solution including maintenance & support to the road accident fund (raf) for a period of five (5) years

The RAF seeks to appoint a service provider to supply, implement, and maintain a cloud-based Identity and Access Management (IAM) solution for a period of five years.

Closing date: 24 September 2026 at 11:00.

Non-compulsory briefing session: 7 September 2026 at 11:00 via Microsoft Teams.

Deadline for bid questions/enquiries: 10 September 2026.

Questions and Answers publication: 14 September 2026 on the RAF website and eTender portal.

Proposal validity period: 90 days from the closing date.

A non-compulsory briefing session will be held on 7 September 2026 at 11:00 via Microsoft Teams. Link: https://teams.microsoft.com/meet/324444746698351?p=eutfMVc6N4nLrFXyGM

Bid enquiries: Bathabile Mahlangu, email: [email protected]. No telephonic enquiries.

Technical enquiries: Not provided.

Submission address: Road Accident Fund, Eco Glades 2 Office Park, 420 Witch-hazel Avenue, Centurion, 0046.

Note: For NIP matters (if applicable), contact Mr Elias Malapane at dti (012 394 1401, [email protected]).

Submission: Hand deliver or courier proposals to the tender box at Road Accident Fund, Eco Glades 2 Office Park, 420 Witch-hazel Avenue, Centurion, 0046. Faxed and emailed bids are not accepted. Enclose an original and one copy in the envelope, clearly marked with the tender number and description. Bids must be deposited on or before the closing date and time.

Returnable documents (all must be completed, signed, and submitted):

• SBD 1 (Invitation to Bid): provides bidder and contact details, signed as the offer cover page.
• SBD 3.1 (Pricing Schedule – Firm Prices): completed and signed.
• SBD 4 (Declaration of Interest): discloses any employment by the state or connections to the procuring institution.
• SBD 5 (National Industrial Participation Programme): signed; required if imported content exceeds US$10 million.
• SBD 6.1 (Preference Points Claim Form): claims B-BBEE points for specific goals.
• Specification document and General Conditions of Contract (GCC).
• Tax TCS PIN or CSD number for tax compliance verification.
• Proof of CSD registration.
• If a joint venture or consortium, a copy of the joint venture agreement and separate tax TCS PINs for each party.
• Proof of authority to sign (e.g., company resolution).

Disqualification risks:

• Late submissions.
• Missing or unsigned returnable documents.
• Bidders or directors listed on the National Treasury Register of Tender Defaulters or Restricted Suppliers.

Proposal validity: 90 days from the closing date.

Returnable documents: SBD 1, SBD 3.1, SBD 4, SBD 5, SBD 6.1, specification document, GCC, Tax TCS PIN, CSD registration, joint venture agreement (if applicable), and proof of authority to sign. All must be completed and signed.

The evaluation uses the 80/20 or 90/10 preference point system, as determined by the RAF. Points are allocated as follows:

• Price: 80 or 90 points.
• Specific Goals: 20 or 10 points.

Specific goals and maximum points claimed (per the applicable system):

• South African citizen who had no franchise before 1994 (minimum 51% ownership): 10 points (90/10) or 5 points (80/20).
• Women (minimum 51% ownership): 8 points or 4 points.
• Persons with disabilities (minimum 51% ownership): 2 points or 1 point.

Bidders must submit proof of ownership to claim these points. Failure to submit documentation with the bid means points for specific goals are not claimed. The evaluation criteria published with the RFP will be used; no amendments after closing.

The RAF requires a cloud-based Identity and Access Management (IAM) solution to replace the existing system. The solution must be delivered as a SaaS offering, cloud-agnostic, and include implementation, maintenance, and support for five years.

Key requirements:

• Integrate with SAP HR as an authoritative source for automated user lifecycle management.
• Manage digital identities for employees, contractors, and partners.
• Provide Single Sign-On (SSO), Multi-Factor Authentication (MFA), and support for Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC).
• Enforce least privilege access and segregation of duties.
• Perform periodic access reviews and recertification.
• Ensure compliance with audit requirements and governance policies.
• Integrate with existing systems (Active Directory, SAP, Azure, etc.).
• Include user provisioning, de-provisioning, and identity governance.
• Provide comprehensive audit logging, monitoring, and security event forwarding.
• Achieve 99% uptime, with Recovery Time Objective (RTO) ≤ 4 hours and Recovery Point Objective (RPO) ≤ 8 hours.
• Support data encryption at rest and in transit, and comply with POPIA and GDPR.
• Be scalable, extensible, and support open interoperability standards.
• Include a needs analysis, solution design, configuration, customisation, testing, data migration, training, and knowledge transfer.
• The bidder must have a business continuity management plan available for inspection.
• The RAF will own the subscription for the contract duration.

The bidder must follow a phased approach including needs analysis, design, configuration, customisation, testing (UAT), data migration, and deployment. The solution must be scalable, extensible, and support open interoperability standards. The design must be presented to the RAF’s Enterprise Architecture review board for approval.

The bidder must be a highly qualified and experienced IT service provider with a proven track record in implementing cloud-based IAM solutions. Key personnel include a dedicated IAM Engineer and Service Delivery Manager for post-implementation support. The bidder must demonstrate relevant experience in similar projects.

The bidder must have a business continuity management plan available for inspection. The solution must achieve 99% uptime, with RTO ≤4 hours and RPO ≤8 hours. The solution must include comprehensive audit logging, security monitoring, and data protection measures. The bidder must provide a dedicated support team and ITSM system for incident management.

Pricing must be submitted on SBD 3.1 (Firm Prices). The bid price must cover the entire solution including subscription, implementation, and five years of maintenance and support. Only firm prices are accepted. The offer must be valid for 90 days.

Pricing must be submitted on SBD 3.1 (Pricing Schedule – Firm Prices). Only firm prices are accepted; no price variation based on exchange rates. The bid price must include all applicable taxes. The offer must be valid for 90 days from the closing date. The solution price should cover the subscription, implementation, and five years of maintenance and support. No bid bond is specified. If the contract value exceeds R10 million and imported content exceeds US$10 million, a performance guarantee may be required under the NIP programme.

Mandatory compliance documents:

• CSD registration (Central Supplier Database).
• Valid Tax Compliance Status (TCS) PIN or CSD number for tax verification.
• All SBD forms (SBD 1, 3.1, 4, 5, 6.1) completed and signed.
• Proof of authority to sign (company resolution).
• For joint ventures/consortia: separate TCS PINs and a copy of the joint venture agreement.

Additional requirements:

• Bidders must not be listed on the National Treasury Register of Tender Defaulters or Restricted Suppliers.
• The bidder must be a registered service provider under applicable laws.
• B-BBEE: Preference points are claimed via SBD 6.1 for specific goals (ownership by historically disadvantaged groups, women, persons with disabilities). No minimum B-BBEE level is specified; points are awarded based on ownership percentages.
• No CIDB grading required (non-construction).

Preference points are awarded for specific goals: ownership by historically disadvantaged South Africans (minimum 51% ownership), women (minimum 51%), and persons with disabilities (minimum 51%). Points are claimed via SBD 6.1. No minimum B-BBEE level is specified; points are based on ownership percentages.

The successful bidder will be required to sign a formal contract (SBD 7). The contract is subject to the General Conditions of Contract (GCC) and any special conditions. If the imported content exceeds US$10 million, the National Industrial Participation Programme (NIP) obligations apply, requiring a performance guarantee and bi-annual reporting to the dti.

Companies or directors listed on the National Treasury Register of Restricted Suppliers or Tender Defaulters will be automatically disqualified from the bidding process.

The bidder must be an eligible, registered service provider under applicable laws. The bidder must have a business continuity management plan available for inspection during the contract period.

The evaluation will be based on the criteria published with the RFP, using either the 80/20 or 90/10 preference point system. Points are awarded for price and specific goals (ownership by historically disadvantaged South Africans, women, and persons with disabilities). No other functionality thresholds are specified in the tender document.