Appointment of an ICT service provider / consultant for the ICT infrastructure revamp project (SCM74/ICT/INFRASTRUCTURE/REVAMP/2026)

PACOFS requires appointment of a highly experienced ICT service provider/consultant with a track record to advise on the critical ICT Infrastructure Revamp Project covering infrastructure, network and cybersecurity. The consultant must assist ICT Management in benchmarking the current environment against ISO standards, cybersecurity best practice, POPIA and other applicable data protection legislation, and give recommendations to PACOFS Management for internal decisions. The service provider must be independent and vendor-neutral. The role is advisory only; PACOFS makes final implementation decisions. Bidders must base pricing and work plan on the environment baseline in Annexure C.

Closing date: 13 November 2026 at 11:00

Validity period: quotations valid until 13 December 2026 (30 days from closing).

No compulsory briefing or site visit is stated in the document.

Enquiries

• Contact: SCM Department
• Email: [email protected]
• Telephone: 051 447 7771 ext. 2234, 2301 and 2238

Submission

• Method: email
• Submission email: [email protected]

Site access and deliveries: arrangements via the ICT Manager Office for access control (Annexure C item 11).

Submission method: email only

Submission email: [email protected]

Closing time: 13 November 2026 at 11:00

Hand-delivered submissions are not accepted. Late submissions are not considered.

Returnable documents (Phase 1 compulsory, unless noted):

• SBD 4 (Declaration of Interest): discloses any director or shareholder employed by the state or connected to the institution.
• SBD 6.1 (Preference Points Claim): claims B-BBEE preference points and specific goals.
• Proof of CSD registration.
• Detailed company profile showing relevant experience, knowledge and directorships.
• Valid B-BBEE certificate or affidavit (non-submission will not disqualify the quotation).
• For the project team (Annexure B): certified copies of qualifications and certifications, and full CVs for each proposed member.

Failure to submit the Phase 1 compulsory documents leads to disqualification.

Three-phase evaluation:

Phase 1 – Compulsory documents: must be complete and submitted, otherwise disqualification.

Phase 2 – Functionality (100 points); minimum qualifying score: 70 points to proceed.

• B1 Company Experience of Project Team (30): 10 years' comparable ICT infrastructure/cybersecurity assessment experience, 5 years' O365/Microsoft 365 risk-based security analysis. 5 points per valid authorised reference letter on client letterhead (client name, full service description, contact person with details); maximum 30.
• B2 Methodology and Project Understanding (25): method statement covering all 5 components (project objectives; scope and deliverables; supervision approach; tools and resources for full project lifecycle; QA/QC relevance of tools and processes). 25 points for all 5, 20 for 4, 15 for 3, 10 for 2, 5 for 1, 0 for none.
• B3 Experience and Certificates of Proposed Team (25): allocated across roles – ICT Project Manager/Lead Consultant 10; Cybersecurity Team Member 5; ICT Network and Infrastructure Team Member 5; ICT Governance/Risk Specialist 5. Minimum experience per role applies.
• B4 Work Plan (20): detailed programme and costed plan showing all 5 components (milestones, critical path, resource allocation, task dependency map, monthly project cash flow). 5 points for all 5 components, 4 for 4, 3 for 3, 2 for 2, 1 for 1, 0 for none. A Microsoft Project visual alone is not sufficient.

Phase 3 – Price and Specific Goals (80/20 system per PPR 2022 Regulation 4(1)):

• Price: 80 points
• Specific goals: 20 points (as per SBD 6.1)

Tax compliance: a recommended bidder who is not tax compliant gets 7 days to rectify, failing which the bid is disqualified.

PACOFS requires an ICT consultant to advise on the infrastructure, network and cybersecurity revamp of its single building (5 floors plus Artists Flats). All recommendations are advisory; PACOFS makes final implementation decisions.

Key deliverables:

• Inception report and detailed project mobilisation plan
• Consolidated Findings Report, Remediation Roadmap and Executive Summary
• Verification Oversight on project implementation
• Project close-out report

Scope areas:

IT Infrastructure Assessment

• Verify ICT asset register against physical servers, storage and network equipment; record age, warranty and support status.
• Assess server room (power, UPS, cooling, fire protection, physical access control, cabling) against industry practice.
• Assess DR/BCP plan including backups, RTO/RPO and whether recovery has been tested.
• Risk-based security assessment of Microsoft 365 (access, MFA, email security, file sharing, retention, backup) using Microsoft Secure Score and system reports.
• Rank recommendations by risk.

Network Assessment

• Assess LAN, WAN and Wi-Fi (design, segmentation, switches, routers, firewalls, wireless access points).
• Record condition, capacity, age and support status; identify single points of failure.
• Assess network monitoring tools and recommend suitable monitoring and alerting.
• Assess requirements for fibre installation from the main street to the building.
• Audit network points and cabling (data and telephone), including quantities and condition.
• Rank recommendations by risk.

Cybersecurity Assessment

• Non-intrusive vulnerability assessment of network, servers, endpoints and systems; requires PACOFS's written authorisation.
• Rate vulnerabilities by likelihood and impact (critical/high/medium/low).
• Review security policies against ISO/IEC 27001, POPIA and applicable legislation.
• Gap analysis of security controls (firewall, anti-malware, backup, access control, patch management).
• Provide remediation actions with priority, indicative cost and timeline.

Consolidated Findings Report

• Rate each finding critical/high/medium/low.
• Provide ranked recommendations with indicative cost and timeline.
• Provide a short-, medium- and long-term remediation roadmap.
• Provide an executive summary for presentation to management.

Environment baseline (Annexure C):

• One building, 5 floors plus Artists Flats
• 1 server room / comms room
• ICT staff: ICT Manager, ICT Specialist, 2 ICT Casuals
• 72 users
• 4 servers plus 1 terminal server
• Desktops: 19; Laptops: 28
• Network: 16 Wi-Fi access points, 1 firewall, 1 router, 8 network switches, 8 telephone network switches
• Network points: 80 telephone, 80 data
• Microsoft 365: 72 licences used, 100 planned
• Fibre has not yet been pulled inside the building; it will be part of the implementation plan
• Existing documentation available: asset register, network diagrams, ICT policies, DR/BCP plan
• Site access arranged via ICT Manager Office
• Contact person: ICT Specialist; deliverable approver: ICT Manager and PACOFS Management

Bidders must base their pricing and work plan on the environment baseline in Annexure C.

A detailed methodology (B2, 25 points) must cover project objectives, scope of work and deliverables, a detailed explanation of how supervision of the work will be carried out, tools and resources to be used for the entire project life cycle, and the relevance/suitability of tools and processes to ensure quality control and assurance. Scoring is by number of the five components included: all 5 = 25 points, 4 = 20, 3 = 15, 2 = 10, 1 = 5, none = 0.

Company minimum: 10 years' demonstrable experience delivering ICT infrastructure projects of comparable scope, with per-skill minimums as listed in the minimum requirements (e.g. 10 yrs asset management, 10 yrs server room/data centre assessment, 10 yrs DR/BCP, 5 yrs O365 security, 10 yrs network assessment/architecture/monitoring/fibre, 10 yrs vulnerability/security gap assessment, 10 yrs IT governance, 10 yrs ICT risk assessment, 10 yrs ICT project management). Company profile must show this experience, supported by client reference letters.

Key personnel (minimum per role, with CVs and certified certificates):

• ICT Project Manager / Lead Consultant: 10 yrs project management, 10 yrs ICT project experience, 10 yrs ICT infrastructure assessment, relevant certified certifications.
• Cybersecurity Team Member: recognised cybersecurity certification(s) where applicable, 10 yrs cybersecurity or vulnerability scanning assessment.
• ICT Network and Infrastructure Team Member: 10 yrs ICT infrastructure experience, 10 yrs fibre and structured cabling including telephone infrastructure.
• ICT Governance / Risk Specialist: 10 yrs risk-based ICT assessments, 10 yrs IT governance and policy development.

Certified copies of qualifications and full CVs for each proposed team member must be attached. Team members may not be substituted after appointment without PACOFS's prior written approval; replacements must meet the same minimum requirements.

The methodology must demonstrate the relevance and suitability of tools and processes used to ensure quality control and assurance in all phases of the project (component of B2 evaluation, worth part of the 25 points).

Pricing schedule (Annexure A): complete the table with unit and total prices.

• Prices in South African Rand, VAT-exclusive and VAT-inclusive.
• Prices must be all-inclusive of travel, tools/licensing and disbursements unless otherwise stated.

Items to price: Infrastructure Assessment and Recommendations; Network Assessment and Recommendations; advice on scanning types after environment assessment; consolidated findings report and remediation roadmap; executive presentation; other/disbursements (specify).

No bid security, bond, guarantee, retention or payment terms are stated in the document.

Mandatory registration and status

• Registered and active on the Central Supplier Database (CSD). CSD will verify business registration, bank account holder, in-service-of-the-state status, tax compliance, identity and tender default/restriction status.
• Not on the National Treasury Register of Tender Defaulters or List of Restricted Suppliers.

Company experience (minimum)

• 10 years delivering ICT infrastructure projects of comparable scope (networking, cybersecurity, data centre/fibre infrastructure).
• Specific per-skill minimums: ICT asset management/verification 10 yrs; server room/data centre assessment 10 yrs; DR/BCP 10 yrs; O365/Microsoft 365 security analysis 5 yrs; network infrastructure assessment 10 yrs; network architecture 10 yrs; network monitoring 10 yrs; fibre and structured cabling 10 yrs; vulnerability assessment 10 yrs; security gap assessment 10 yrs; IT governance/policy 10 yrs; ICT risk assessment and reporting 10 yrs; ICT project management 10 yrs.
• Company profile must demonstrate this experience, supported by client reference letters.

Project team minimum requirements (per role)

• ICT Project Manager / Lead Consultant: 10 yrs project management, 10 yrs ICT project experience, 10 yrs ICT infrastructure assessment, CV, relevant certified certifications.
• Cybersecurity Team Member: recognised cybersecurity certification(s) where applicable, 10 yrs cybersecurity or vulnerability scanning assessment, relevant certified certificates.
• ICT Network and Infrastructure Team Member: 10 yrs ICT infrastructure experience, 10 yrs fibre and structured cabling including telephone infrastructure, CV, relevant professional certified certificates.
• ICT Governance / Risk Specialist: 10 yrs risk-based ICT assessments, 10 yrs IT governance and policy development, CV, relevant professional certified certificates.

Team members may not be substituted after appointment without PACOFS's prior written approval; replacements must meet the same minimum requirements.

B-bbee

• Submit a valid B-BBEE certificate or affidavit to claim specific goals in terms of SBD 6.1 (non-submission will not disqualify the quotation).

Contract period: 1 year service level agreement.

Independence and vendor neutrality: The appointed service provider must give vendor-neutral advice and must declare in writing, before appointment, any reseller, partner, distributor or other commercial relationship with a product or service supplier that could influence recommendations. A service provider is "involved" in the project if it, or any director, member, subsidiary, affiliate or subcontractor, is appointed under this RFQ or supplies a member of the project team. Involved parties may not bid for, or take part in, the implementation phase.

PACOFS reserves the right not to appoint any provider, not to accept the lowest price or any bid, and to accept the bid in the entity's best interest.

Award may be withdrawn or a contract cancelled if the bidder is found to be on National Treasury's list of tender defaulters or restricted suppliers, or blacklisted by another government institution.

See evaluationCriteria section for full details. Phase 3 allocates 80 points for price and 20 for specific goals (80/20 system, PPR 2022 Regulation 4(1)). Minimum functionality score of 70 points is required to proceed.