Hosted and managed private infrastructure-as-a-service (iaas) – request for information

Closing date: 27 November 2026 at 11:00

Information briefing session: 09 November 2026, 11:00–13:00, online via MS Teams (non-compulsory). Join link: https://teams.microsoft.com/meet/3821239257565388?p=GBuNOJ5FkISdf5rqWP; Meeting ID: 382 123 925 756 538 8; Passcode: RZ9Ui9Wn

Tender documents available from: 02 November 2026

Procurement enquiries (PURCO SA):

• Contact: Fisokuhle Dlamini
• Role: Procurement Officer
• Email: [email protected]
• Telephone: 011 545 0940 (also 011 545 0965)

Technical enquiries (ARC):

• Contact: Ms Nobubele Mlindi
• Role: Supply Chain Management
• Email: [email protected]
• Telephone: 060 536 5622

Technical enquiries must be submitted in writing via the PURCO SA website under ARC/12/10/2026. Only bidders who have purchased the bid document will receive responses. No other form of technical correspondence accepted.

Submission method: electronic only, via the PURCO SA website (https://purcosa.co.za). No physical, email or fax submissions accepted. No draft submissions; only final submissions evaluated.

Submission steps:

• Log in to https://purcosa.co.za using the username and password of the person who purchased the tender document.
• Go to https://purcosa.co.za/my-tenders, click 'Submit bid' and upload the bid documents.
• Review the Online Tender Submissions Guide at https://purcosa.co.za/online-tender-submissions-guide for preparation and upload details.
• Submit early to avoid last-minute issues; late submissions are not accepted.

Returnable documents (all must be completed and signed):

• SBD 1 (Invitation to Bid): bidder and contact details, signed as the offer cover page.
• SBD 2 (Tax Clearance Certificate Requirements): tax compliance evidence.
• SBD 4 (Bidder's Disclosure): declares any state employment or relationships with the procuring institution; false disclosure disqualifies.
• SBD 5 (National Industrial Participation Programme): signed and submitted with the bid.
• SBD 7 (Contract Form): to be completed and signed by the successful bidder.
• Company Profile: background and experience in delivering hosted and managed infrastructure.
• Proposed Solution Architecture: high-level architecture diagram of the proposed IaaS solution.
• Technical Solution Proposal: compute, storage, networking, virtualisation, cloud management and scalability.
• Technical Datasheets: manufacturer datasheets for proposed components.
• Bill of Materials (BOM): indicative configuration, quantities, capacities.
• OEM Certificate: valid proof of ownership.
• Key personnel certification: minimum OEM certification for deployment and support.
• Implementation and Migration Methodology: approach, migration plan, testing, commissioning, timeline.
• Proposed Service Levels and Support Requirements: availability, incident response, resolution targets, support hours, escalation, reporting.
• Security and Compliance Documentation: security policies, certifications, data protection measures.
• Business Continuity and Disaster Recovery Plan: backup, recovery, resilience, DR arrangements, indicative RPO/RTO.
• Indicative Pricing Schedule: costs for infrastructure, subscriptions, licensing, implementation, support, additional capacity.
• Service Description and Support Model: managed services, monitoring, maintenance, capacity management, division of responsibilities.
• Assumptions, Dependencies and Exclusions: customer prerequisites, infrastructure dependencies, limitations, excluded services.
• Appendix A: complete the spreadsheet and provide supporting documentation.
• Proof of authority to sign (e.g. company resolution).

Disqualification risks:

• Late submissions or physical/email/fax delivery.
• Incomplete or unsigned returnable forms.
• Removing any page from the original tender document.
• Misrepresentation of facts.
• Bids from persons in the service of the state, or companies/close corporations with directors/members in the service of the state.

This is a Request for Information (RFI), not a bid. No award will be made. ARC will use the responses to shape a future RFP. The RFI assessment framework (indicative weightings):

• Architecture outcomes: 20% (fit, simplicity, scalability, unified operations, lifecycle automation)
• Continuity, interoperability and migration risk: 25% (compatibility, skills/process reuse, coexistence, rollback, disruption risk)
• Resilience, backup, DR and security: 15% (service-tier alignment, recoverability, cyber resilience, data residency, controls)
• Operating model and support: 20% (demarcation, accountability, local capability, OEM support, manageability)
• Commercial model and 5-year TCO: 15% (transparency, comparability, predictability, growth economics, exit cost)
• Portability and exit: 5% (open interfaces, exportability, documentation, transition support)

No minimum qualifying score is stated. Any RFP criteria and weightings will be formally approved and published later.

The Agricultural Research Council (ARC) invites suitably qualified Original Equipment Manufacturers (OEMs) to respond to a Request for Information (RFI) for Hosted and Managed Private Infrastructure-as-a-Service (IaaS).

Purpose: To gather information on feasible future-state architectures, operating models, migration approaches and indicative three- to five-year total cost of ownership (TCO). This is not a bid and does not commit ARC to procure.

Current environment baseline (provisional, to be validated):

• Virtual machines: 106 total (100 powered on, 6 powered off); 79 Microsoft Server OS, 27 Linux; 95 critical, 11 non-critical.
• Compute: 256 vCPU, 3.07 TB RAM; average CPU utilisation 26.13%, peak 33.23%, headroom 66.77%.
• Storage: HPE Nimble HF60, 120 TB stated; usable capacity 122.7 TiB, consumed 81.5 TiB, utilisation 66.5%, available 41.2 TiB, data reduction 4.0x.
• Backup: Veeam, HPE StoreOnce 5250, MSL3040 LTO-8.
• Network: ARC WAN/SD-WAN/MPLS, Aruba 8320, Cisco MDS.
• Hosting: one primary hosted data centre (currently Teraco); secondary site required.
• Estate: ~2,000 users, 3,500 M365 accounts, 1,684 licensed users, 280 SQL databases.

Desired outcomes:

• Self-service or simplified provisioning with catalogues, templates, blueprints, policy-based controls.
• Unified management across VMs, clusters, capacity, performance, alerts, protection.
• Lifecycle automation for compute, storage, network, firmware, platform software, hypervisors.
• Flexible virtualisation: support current VMware workloads and a credible path to alternative or mixed virtualisation.
• Elastic capacity: modular scaling without disruptive redesign.
• Resilience: high availability, fault-domain design, non-disruptive maintenance, clear service-level boundaries.
• Data services: enterprise block/file, snapshots, replication, encryption, performance tiers.
• Data protection: integrated backup, immutable/air-gapped recovery, rapid restore, DR orchestration.
• Security: segmentation, least privilege, MFA/RBAC, audit trails, secure APIs, vulnerability management.
• Hybrid integration with Microsoft Azure, ARC identity, WAN/SD-WAN/MPLS.
• Commercial model: pay-upfront, subscription, reserved-capacity or consumption options with transparent metering.
• Portability: documented export, migration, open APIs, transition support.

Capacity scenarios to price:

• Baseline: validated current demand plus agreed operational headroom.
• Moderate growth: baseline + 25%.
• High growth: baseline + 50%.
• Recommended: evidence-based three- and five-year forecast.

Workload service tiers (planning targets):

• Tier 1 (Critical): RPO ≤15 min, RTO ≤2 hours.
• Tier 2 (Important): RPO ≤4 hours, RTO ≤8 hours.
• Tier 3 (Standard): RPO ≤24 hours, RTO ≤48 hours.

Data residency: All production data and primary/DR copies must reside in South Africa unless ARC expressly approves otherwise.

Migration and transition: Provide discovery, dependency mapping, migration waves, pilot approach, coexistence, data seeding, cutover, downtime assumptions, rollback criteria, business-continuity controls, database/file/backup/DR migration considerations, knowledge transfer, training, and a high-level schedule expressed as phases and dependencies.

Support and managed services: Service desk hours and channels, South African support footprint, OEM escalation, end-to-end accountability, monitoring, incident/problem/change/patching/configuration/capacity management, full-stack lifecycle, operational dashboards, and optional fully managed, co-managed or self-managed models with responsibility matrix and pricing.

Response structure (mandatory):

1. Executive summary and proposed option.
2. Current-state assumptions and information gaps.
3. Proposed architecture and operating model.
4. Hosted and Managed Infrastructure Services.
5. Capability response using Appendix A.
6. Virtualisation strategy and licensing implications.
7. Capacity, performance and scalability approach.
8. Backup, cyber recovery and DR.
9. Security, compliance and South African data residency.
10. Migration, coexistence, rollback and exit approach.
11. Service demarcation and responsibility matrix.
12. Indicative three- and five-year TCO using Appendix B.
13. Risks, dependencies, exclusions and decisions required from ARC.
14. Relevant South African reference implementations.

ARC invites suitably qualified infrastructure, managed service, and data-centre OEMs to respond. The response must cover: proposed architecture and operating model (up to two options), technology proposal (compute, storage, network, virtualisation, management, licensing), continuity and interoperability with existing HPE, VMware, Veeam and Azure environments, migration and transition approach, security and compliance, support and managed services, and commercial/TCO information. The response must follow the mandatory structure in section 15 and complete both appendices. ARC will assess responses using the RFI assessment framework.

Respondents must provide a company profile indicating background and experience in delivering hosted and managed infrastructure. Provide valid proof of OEM ownership and a minimum OEM certification required for deployment and support. Key personnel must hold the required OEM certification. Provide relevant South African reference implementations. The respondent profile must include legal entity, ownership, years in operation, South African operational footprint, and the relevant OEM.

Respondents must propose a backup and recovery architecture including retention tiers, immutability, encryption, air-gap or isolation controls, malware/ransomware recovery and restore validation. Explain integration with or transition from Veeam, StoreOnce and tape services. Propose DR architecture by workload tier, secondary-site requirements, replication method, orchestration, testing and evidence of recoverability. Distinguish infrastructure/data availability from application availability and state all exclusions. Provide separate indicative costs for backup, cyber recovery, DR infrastructure, connectivity and testing.

Pricing is indicative and non-binding. All amounts must exclude VAT and identify pricing date, validity period, exchange-rate assumptions, and annual escalation assumptions. Provide a breakdown pricing schedule for information purposes only. SBD 3.3 (Pricing Schedule – Firm Prices) is marked 'Not applicable at this stage'. Provide indicative costs for infrastructure, subscriptions, licensing, implementation, support and additional capacity. Provide three- and five-year TCO for baseline, +25%, +50% and recommended scenarios.

Pricing is indicative and non-binding. All amounts must exclude VAT and identify pricing date, validity period, exchange-rate assumptions, and annual escalation assumptions.

Cost categories to disclose:

• Infrastructure/service subscription: reserved capacity, buffer, consumed capacity, unit rates, minimum commitment, metering method.
• Software and licensing: hypervisor, management, backup, database dependencies, third-party licences.
• Hosting and connectivity: rack, power, cross-connect, bandwidth, secondary-site costs.
• Managed services: fixed and variable fees by responsibility model.
• Implementation and migration: discovery, design, build, migration, testing, training, project management.
• Growth: unit prices for compute, memory, storage, protected capacity; lead times and discount tiers.
• Lifecycle: refresh, upgrade, support costs during term.
• Exit: data/configuration extraction, migration assistance, knowledge transfer, secure deletion.
• Provide three- and five-year totals for baseline, +25%, +50% and recommended TCO forecast.

SBD 3.3 (Pricing Schedule – Firm Prices) is marked 'Not applicable at this stage'.

No bid security, bonds, guarantees or retention are stated for this RFI. The National Industrial Participation (NIP) programme may impose a performance guarantee to the DTI for contracts with imported content exceeding US$10 million (see description section).

Tax compliance:

• Provide a SARS Tax Compliance Status PIN or a Central Supplier Database (CSD) number/report.
• Remain tax compliant for the entire contract term.
• Bidders making taxable supplies over R1 million in any 12-month period must register as VAT vendors within one month of award if successful.
• In consortia/JVs/sub-contracts, each party must submit a separate tax compliance certificate, PIN or CSD number.
• No bids from persons in the service of the state, or companies/close corporations with directors/members in the service of the state.

B-bbee:

• A B-BBEE status level verification certificate or sworn affidavit (for EMEs and QSEs) must be submitted to qualify for preference points.

OEM requirements:

• Valid proof of OEM ownership.
• Minimum OEM certification for deployment and support.
• Key personnel certification.

Other:

• Proof of authority to sign (e.g. company resolution).
• All SBD forms must be completed and signed.
• Bidders must not remove any page from the original tender document.
• Misrepresentation of facts leads to disqualification and contract cancellation.
• Proposals must remain valid for 180 days after submission; shorter validity may be rejected.
• Bidders listed on the Register for Tender Defaulters or List of Restricted Suppliers are automatically disqualified.

No specific health and safety requirements are stated in the tender document. The RFI focuses on IT infrastructure services; no OHS plan or safety certification is required.

Proposals must remain valid for 180 days after submission. ARC may request an extension in writing. ARC is not liable for any costs incurred in preparing or submitting a proposal. ARC does not bind itself to accept the lowest or any proposal. ARC may cancel the bid at any time if the recommended service provider fails to meet requirements. ARC may conduct site inspections of the recommended provider's premises or clients. All production data and primary/DR copies must reside in South Africa unless ARC approves otherwise. POPIA-aligned controls, operator obligations, sub-processors, breach notification, retention, deletion and audit rights must be described. Responses must follow the mandatory structure and complete both appendices. ARC may request clarifications, demonstrations, or non-binding workshops. Respondents bear their own costs. ARC may use RFI information for planning, subject to confidentiality markings. References to existing OEM products are for context only and do not indicate preference.

No additional evaluation criteria beyond the RFI assessment framework described in the main evaluationCriteria section. The RFI will not result in an award; ARC will use responses to shape a future RFP.