Cloud hosting services for modernised sa‑sams (south african school administration system)

Compulsory virtual briefing: 6 October 2026, 12:00–13:00. Non-attendance results in disqualification. No venue details provided (virtual).

SCM Enquiries:

• Contact: Martha Nkosi
• Role: Supply Chain Management
• Email: [email protected]
• Telephone: 012 752 6200

Technical Enquiries:

• Contact: Conrad Jacobs
• Role: Technical
• Email: [email protected]
• Telephone: 012 752 6200

Submission address (physical):

272 West Avenue

Block D Lakefields Office Park

Centurion, 01632

Postal address:

PO Box 11150

Die Hoewes, 0163

Submission method: Physical delivery to bid box at NECT Head Office, 272 West Avenue, Block D Lakefields Office Park, Centurion, 01632, or posted to PO Box 11150, Die Hoewes, 0163 (at sender's risk).

Closing: 26 October 2026 at 11:00.

Proposals must be on company letterhead.

Returnable documents (all mandatory):

• Valid B-BBEE Verification Certificate (SANAS-accredited) or sworn affidavit for EME/QSE.
• Valid SARS Tax Compliance Status (TCS) PIN.
• Completed and signed Declaration of Interest.
• CIPC company registration documents with certified copies of all directors'/members' identity documents.
• Original or certified bank confirmation letter issued within the last 3 months.
• For consortiums/joint ventures: fully signed agreement by all partners.

Disqualification for: late/incomplete submissions; missing any mandatory document; fraudulent information; failure to attend compulsory virtual briefing; no demonstrated software development/application customisation experience.

Returnable documents (all mandatory, must be completed, signed, submitted with proposal):

• B-BBEE Verification Certificate or sworn affidavit.
• SARS Tax Compliance Status PIN.
• Declaration of Interest (completed and signed).
• CIPC company registration documents with certified ID copies of all directors/members.
• Original/certified bank confirmation or bank-generated account confirmation letter ≤3 months old.
• Consortium/JV agreement (if applicable).

Deliverables to be included in proposal (verified via tables):

• MI Deployment Plan (architecture, zone config, load balancing).
• Instance Templates (stateful/stateless, GPUs).
• Autohealing Configurations (health checks, thresholds).
• Autoscaling Policies (configured and tested).
• Update Strategy (rolling/canary definitions).
• VM Insights Setup (metrics, alerting, dashboards).
• Documentation Package (runbooks, configuration guides).
• Training & Knowledge Transfer (sessions, user guides).
• Firewall Rule Documentation.

Environment Coverage Verification table: VMs, vCPU, RAM, Storage per environment, included in proposal (Y/N).

SLA Compliance Verification table: Bidder commitment and compliance status per metric.

Deliverables Verification table: Included in proposal, timeline specified, notes.

Three-stage evaluation:

Step 1: Mandatory Requirements (pass/fail) – all returnable documents must be submitted and valid.

Step 2: Functionality Evaluation (minimum 75/100 to proceed). Scoring:

1. Relevant Cloud Migration Experience (25 pts): GCP/Azure MIG deployment evidence (10), stateful workload/database migration (8), education/large-scale public sector (12M+ users) experience (7).
2. Technical Solution Design (30 pts): Autohealing/VM recovery design (10), multi-zone HA/DR strategy (8), VM Insights monitoring integration (7), autoscaling for peak cycles (5).
3. Implementation Methodology (20 pts): Rolling/canary deployment approach (7), data migration strategy with offline sync/validation (7), testing protocols including failure simulation/rollback (6).
4. Team Expertise & Certifications (15 pts): Cloud Architect 5+ yrs GCP/Azure certified (5), DevOps Engineer 5+ yrs IaC tools (5), DB Specialist 5+ yrs MySQL/stateful workloads (5).
5. SLA Compliance & Risk Mitigation (10 pts): ≥99.9% uptime commitment with penalties (3), <3-min auto-repair response evidence (3), data governance/security (POPIA/GDPR, SITA MIOS, SA data residency) (4).

Step 3: Price and Preference Points (80/20 system). Price max 80 points, Specific Goals max 20 points. Specific Goals (80/20): Black African Ownership 10, Women Ownership 5, Youth Ownership 3, People with Disabilities Ownership 2. Failure to submit proof for specific goals = no points claimed.

Scope: Design, deploy, and maintain cloud hosting for modernised SA-SAMS on a Cloud Platform using Managed Instance Groups (MIs) with integrated VM Insights.

Key capabilities required:

• Resilience: Auto-detect, recover, replace failed/degraded VMs via MIs.
• Scalability: Seamless scale in/out based on demand and policy thresholds.
• Observability: VM Insights monitoring of CPU, memory, network with actionable alerts.
• Availability: Multi-zonal regional deployment for HA and disaster resilience.
• Operational automation: Auto-updating, health checks to minimise manual maintenance.

Environments and VM specifications (all Ubuntu Latest LTS, PHP 7.4, MySQL latest-1):

• Production App Servers: 2 VMs, 24 vCPU, 64 GB RAM, 2,000 GB storage each.
• Production DB Servers: 2 VMs, 24 vCPU, 64 GB RAM, 2,000 GB storage each.
• Test (SIT): 1 VM, 8 vCPU, 16 GB RAM, 1,000 GB storage.
• UAT: 1 VM, 16 vCPU, 32 GB RAM, 1,000 GB storage.
• Data Warehouse: 1 VM, 16 vCPU, 64 GB RAM, 4,000 GB storage.
• Sandbox: 1 VM, 16 vCPU, 32 GB RAM, 1,000 GB storage.
• Development: 1 VM, 8 vCPU, 32 GB RAM, 1,000 GB storage.
• Document Repository: 1 VM, 8 vCPU, 24 GB RAM, 2,000 GB storage.

MI types: Zonal (simpler HA), Regional (mission-critical multi-zone), Stateful (persistent identity for databases/legacy).

Instance templates: VM machine types, boot/additional disks, metadata/startup scripts, GPU config, network tags/IAM roles, autohealing/health checks (application-based, separate thresholds for load balancing vs autohealing).

Autoscaling: CPU utilisation, RPS via load balancing metrics, custom metrics; min/max/target parameters; scheduled scaling for known patterns; GPU batch for ML.

Stateful workloads: Retain instance names, attached disks, metadata; support restart/update without state loss; checkpointing/session persistence.

Updates: Rolling (batch-based) and canary (pilot) with defined batch size, minimum healthy %, delay between batches; rollback procedures and automated post-update validation.

VM Insights: Enable on all MI instances; collect CPU (current/trend/prediction), memory (high/low/prediction), network throughput (received/sent/anomalies).

Alerting: High CPU >80% for 90% of 7 days; low memory <10% for 50% of 7 days; network anomalies; predicted performance issues; idle resources.

Dashboards: Real-time/historical system metrics (CPU, memory, disk I/O, network), custom app metrics; notifications/escalation policies; API-automated deployment.

Firewall: Least-privilege VPC rules with network tags; ingress: HTTP/HTTPS, SSH via IAP/trusted IPs, custom app ports; restrict internal services to subnets/service accounts; egress: OS patching, monitoring/logging, external APIs; block/log unnecessary outbound; VPC Flow Logs enabled; logging on critical rules; SIEM integration; service accounts/identity-based access; periodic review; default deny; SITA MIOS adherence; support autohealing/autoscaling/rolling updates.

Data residency: All school/learner data must be hosted within South African borders.

Deliverables: MI Deployment Plan, Instance Templates, Autohealing Configs, Autoscaling Policies, Update Strategy, VM Insights Setup, Documentation Package (runbooks, config guides), Training & Knowledge Transfer, Firewall Rule Documentation.

Timeline: 6–8 weeks total (1 wk requirements, 1 wk architecture, 2–3 wk deployment, 1–2 wk monitoring/optimisation, 1 wk documentation/training).

SLA targets: Availability ≥99.9%; auto-repair <3 min; scaling lag <60 sec; update failure rate <5%; monitoring coverage 100%; alerting delay <60 sec.

Monitoring/reporting: Real-time server/service monitoring, usage, capacity thresholds, outage alerting, downtime monitoring, monthly uptime per workload, SLA reporting, billing/usage reporting.

Disaster Recovery: Multi-zone replication, RTO <1 hr (Tier 1), RTO <4 hrs (Tier 2); backup: daily 14-day retention, weekly 4-week, monthly 12-month; bi-annual DR testing.

School onboarding: Year 1 (2026–Feb 2027) phased: 1–49, 50–100, 101–499, 500–1,499, 1,500–2,499, 2,500–4,000 schools. Year 2 (Mar 2027–Feb 2028) double capacity, 3 upgrades (Mar, Jun, Oct 2027) each 33% of Year 1 baseline. Proposal must include costed upgrade schedule.

Implementation methodology requirements (scored in functionality evaluation):

• Rolling/canary deployment approach: Batch-based safe replacement and pilot instances before full rollout; defined batch size, minimum healthy percentage, delay between batches; rollback procedures and error thresholds; automated post-update validation before next batch.
• Data migration strategy: Plan for migrating legacy SA-SAMS data including offline sync, validation protocols, handling offline/sync challenges.
• Testing protocols: Failure scenario testing plan, validation, error threshold definitions.
• Overall timeline: 6–8 weeks (1 wk requirements gathering, 1 wk architecture design, 2–3 wk deployment/configuration, 1–2 wk monitoring/optimisation, 1 wk documentation/training).
• Phased school onboarding schedule must be supported with capacity doubling in Year 2 and 3-stage upgrades every 4 months.
• Proposal must include detailed methodology aligned with 6–8 week timeline and onboarding schedule.

Experience and qualification requirements (scored in functionality evaluation):

• Relevant cloud migration experience: Case studies/project references on letterhead demonstrating GCP/Azure Managed Instance Group deployments (10 pts), stateful workload/database migration to cloud (8 pts), education sector or comparable large-scale public sector systems (12M+ users) (7 pts).
• Team expertise (CVs + certification copies required):

• Cloud Architect: 5+ years cloud architecture experience, GCP/Azure certified (5 pts).

• DevOps Engineer: 5+ years DevOps/IaC tools experience (5 pts).

• Database Specialist: 5+ years MySQL/database migration experience with stateful workloads (5 pts).

• Scoring guidance: 5 pts = 5+ years with relevant certifications and directly comparable project history; 3–4 pts = 5+ years but certifications pending or limited comparable history; 1–2 pts = <5 years or no relevant certifications; 0 = role not filled or no evidence.

Quality management requirements:

• SLA targets: Availability ≥99.9%; auto-repair response <3 min from health check failure; scaling lag <60 sec under demand surge; update failure rate <5% rollback; monitoring coverage 100% of MIs with VM Insights; alerting delay <60 sec post-threshold.
• Monitoring & reporting: Real-time server/service monitoring; usage reporting; capacity threshold reporting; alerting for outages, interruptions, resource availability, capacity thresholds; downtime monitoring; monthly uptime reporting per workload; SLA reporting; billing and usage reporting.
• VM Insights enablement on all MI instances with metrics: CPU (current, trend, prediction), memory (high/low, prediction), network throughput (received/sent, abnormal drops).
• Alerting policies: High CPU >80% for 90% of 7 days; low memory <10% for 50% of 7 days; network anomalies; predicted performance issues; idle/unused resources.
• Dashboards: Real-time/historical system metrics (CPU, memory, disk I/O, network), custom app metrics; notifications/escalation tied to VM Insights; API-automated deployment.
• Documentation deliverables: MI deployment architecture/runbooks, health check design/autohealing logic, scaling/update policies, monitoring setup/alerting conditions/thresholds, troubleshooting procedures.
• Training: Knowledge transfer workshops on updating/scaling MIs, monitoring/dashboard usage, responding to alerts/failures.
• Backup & DR: Multi-tier recovery (Tier 1 RTO <1 hr, Tier 2 RTO <4 hrs); backup tiers (daily 14-day, weekly 4-week, monthly 12-month); bi-annual DR testing.
• Firewall compliance: Least privilege, VPC Flow Logs, SIEM integration, periodic review, default deny, SITA MIOS adherence.
• Data governance: SA data residency, POPIA/GDPR compliance plan, security controls.

Pricing schedule (all costs ZAR, excl VAT):

1. Once-off Implementation Costs (itemised):

• Solution Design & Architecture (MI group design, workload mapping, zone config)
• Environment Setup (PROD/UAT/DEV/SIT/Sandbox/Data Warehouse/Doc Repo deployment)
• Autohealing Configuration (health checks, thresholds, recovery validation)
• Autoscaling Implementation (policy config CPU/RPS/custom metrics)
• VM Insights Deployment (monitoring setup, alert policies, dashboard creation)
• Data Migration (legacy SA-SAMS transfer and validation)
• Knowledge Transfer & Training (workshops, operational runbooks, handover)
• Project Management (implementation oversight 6–8 weeks)

2. Recurring Infrastructure & Support Costs (per environment, monthly/annual):

• PROD: 24/7 monitoring, auto-scaling, security patching, ≤3-min auto-repair; Compute 96 vCPU/384 GB RAM; Storage 16 TB
• UAT: Compute 24 vCPU/96 GB RAM; Storage 4 TB
• SANDBOX: Compute 24 vCPU/96 GB RAM; Storage 3 TB
• DEV/SIT: Compute 32 vCPU/112 GB RAM; Storage 4 TB
• Data Warehouse: Compute 16 vCPU/64 GB RAM; Storage 4 TB
• Document Repo: Compute 8 vCPU/32 GB RAM; Storage 5 TB
• Managed Services Premium Support: SLA management, incident response, performance optimisation

3. Backup & Disaster Recovery Costs (monthly/annual):

• Daily Backups 14-day retention Tier 2 (RTO <4 hrs)
• Weekly Snapshots 4-week retention
• Monthly Archives 12-month retention
• Disaster Recovery Multi-zone replication Tier 1 (RTO <1 hr)
• DR Testing Bi-annual test execution

4. Summary: Year 1 Total (ZAR), Annual Recurring (Years 2–5), Total Contract Value (5-year).

Pricing currency: ZAR, exclusive of VAT.

Pricing structure (itemised):

1. Once-off Implementation Costs (non-recurring): Solution Design & Architecture (MI group design, workload mapping, zone config); Environment Setup (PROD/UAT/DEV/SIT/Sandbox/Data Warehouse/Doc Repo deployment); Autohealing Configuration (health checks, thresholds, recovery validation); Autoscaling Implementation (CPU/RPS/custom metrics policies); VM Insights Deployment (monitoring setup, alert policies, dashboards); Data Migration (legacy SA-SAMS transfer/validation); Knowledge Transfer & Training (workshops, runbooks, handover); Project Management (6–8 week oversight).
2. Recurring Infrastructure & Support Costs (per environment, monthly/annual):

• PROD: 24/7 monitoring, auto-scaling, security patching, ≤3-min auto-repair; Compute 96 vCPU/384 GB RAM; Storage 16 TB.
• UAT: Compute 24 vCPU/96 GB RAM; Storage 4 TB.
• SANDBOX: Compute 24 vCPU/96 GB RAM; Storage 3 TB.
• DEV/SIT: Compute 32 vCPU/112 GB RAM; Storage 4 TB.
• Data Warehouse: Compute 16 vCPU/64 GB RAM; Storage 4 TB.
• Document Repo: Compute 8 vCPU/32 GB RAM; Storage 5 TB.
• Managed Services Premium Support: SLA management, incident response, performance optimisation.

3. Backup & Disaster Recovery Costs (monthly/annual): Daily backups 14-day retention Tier 2 (RTO <4 hrs); Weekly snapshots 4-week retention; Monthly archives 12-month retention; DR multi-zone replication Tier 1 (RTO <1 hr); Bi-annual DR test execution.
4. Summary: Year 1 Total (ZAR), Annual Recurring Years 2–5, Total Contract Value (5-year).

No bid security, bond, or guarantee amounts specified. Payment terms not detailed. Financial capacity thresholds not stated.

Mandatory compliance documents:

• CSD registration (implied via CIPC and tax).
• Valid SARS Tax Compliance Status PIN.
• B-BBEE: SANAS-accredited verification certificate or sworn affidavit for EME (≤R10m turnover) or QSE (≤R50m turnover). Failure to attach = disqualification.
• CIPC company registration with certified ID copies of all directors/members.
• Original/certified bank confirmation letter ≤3 months old.
• Completed and signed Declaration of Interest.
• Attendance at compulsory virtual briefing (6 Oct 2026).
• Demonstrated previous experience in software development/application customisation.

Technical compliance checklist (must be met):

• Data hosted within South African borders.
• 99.9% availability with secondary failover datacentre.
• Support for phased school onboarding (1,672 schools Year 1).
• Doubling capacity Year 2 (Mar 2027–Feb 2028).
• 3-stage upgrade plan (Mar, Jun, Oct 2027).
• Ubuntu Latest LTS OS.
• Disaster Recovery with multiple Recovery Tiers.
• Backup with multiple Backup Tiers.
• Firewall rules aligned with least privilege principle.
• VPC Flow Logs enabled.
• SITA MIOS security standards adherence.
• Identity-Aware Proxy (IAP) for SSH access.

No CIDB grading required (non-construction). No professional body registrations specified. Local content percentages not mentioned.

B-BBEE requirements:

• Evidence: SANAS-accredited verification certificate OR sworn affidavit for EME (≤R10m annual revenue) or QSE (≤R50m annual revenue).
• Failure to attach = disqualification.
• Preference point system: 80/20 (tender value ≤R50m).
• Specific goals points (80/20): Black African Ownership 10, Women Ownership 5, Youth Ownership 3, People with Disabilities Ownership 2.
• No proof submitted for specific goals = no points claimed.
• Organ of state may require substantiation of claims at any time.
• Fraudulent claims lead to disqualification, cost recovery, contract cancellation, restriction from state business up to 10 years, possible criminal prosecution.

Health and safety not explicitly addressed beyond standard IT security/firewall requirements. No OHS, safety plan, or HSE compliance requirements specified in the document.

Environmental requirement: School and learner data must be hosted within South African borders (data residency). No other environmental impact or sustainability requirements stated.

Contract terms derived from special conditions and SLA commitments:

• NECT reserves right not to award, to interview shortlisted bidders, to invite presentations, to negotiate price with preferred bidder, to appoint multiple providers, to amend bid conditions/validity/specification/closing date before closing (communicated in writing and posted on NECT website).
• NECT not bound to accept lowest bid; awards to functionally acceptable and financially advantageous bidder.
• Bid may be awarded whole or in part.
• NECT may conduct site visits at bidder offices/client sites.
• National Treasury Instruction 2017 Cost Containment Measures (hourly rates) may apply.
• NECT may request verification documents and conduct background checks including FICA on entity and directors.
• NECT may appoint panel of service providers at its discretion.
• NECT has final decision on interpretation of tender requirements.
• SLA commitments: ≥99.9% uptime with penalties/remedies for breach; auto-repair <3 minutes; data residency within SA borders, POPIA/GDPR compliance, SITA MIOS adherence.
• Contract duration implied 5 years (pricing schedule shows Year 1 + Years 2–5 recurring).
• Termination, penalties, liquidated damages not explicitly detailed beyond SLA breach remedies.

Special conditions (NECT reservations):

• Right not to award bid/project/contract.
• Right to interview shortlisted bidders before final selection.
• Successful bidders may be invited for presentation.
• Right to negotiate price with preferred bidder.
• Right to appoint more than one service provider.
• Right to amend bid conditions, validity period, RFQ specification, or extend closing date before closing (written notice to issued bidders, posted on NECT website).
• Not bound to accept lowest bid; awards to functionally acceptable and financially advantageous bidder.
• Right to award bid whole or in part.
• Right to conduct site visits at bidder offices/client sites.
• May apply National Treasury Instruction 2017 Cost Containment Measures (hourly rates).
• Right to request verification documents and conduct background checks including FICA on entity and directors.
• Right to appoint panel of service providers at sole discretion.
• Final decision on interpretation of tender requirements and responses.

Mandatory submission requirements (Step 1):

• Valid B-BBEE Verification Certificate (SANAS-accredited) or sworn affidavit for EME/QSE.
• Valid SARS Tax Compliance Status PIN.
• Completed and signed Declaration of Interest.
• CIPC company registration documents with certified copies of all directors'/members' IDs.
• Original/certified bank confirmation letter ≤3 months old.
• For consortiums/JVs: fully signed agreement by all partners.
• Attendance at compulsory virtual briefing (6 Oct 2026, 12:00–13:00).
• Demonstrated previous experience in software development/application customisation.

Disqualification for: missing tax clearance; fraudulent/inaccurate info; missing declaration of interest; missing company registration; missing B-BBEE certificate/affidavit; missing briefing attendance; no software development experience.

Technical compliance checklist (must be met):

• Data hosted within SA borders.
• 99.9% availability with secondary failover datacentre.
• Support for phased school onboarding (1,672 schools Year 1).
• Doubling capacity Year 2 (Mar 2027–Feb 2028).
• 3-stage upgrade plan (Mar, Jun, Oct 2027).
• Ubuntu Latest LTS OS.
• Disaster Recovery with multiple Recovery Tiers.
• Backup with multiple Backup Tiers.
• Firewall rules aligned with least privilege principle.
• VPC Flow Logs enabled.
• SITA MIOS security standards adherence.
• Identity-Aware Proxy (IAP) for SSH access.

Evaluation criteria (same as evaluationCriteria section above).