Supply, installation and 24-Month support of a privileged access management (pam) solution for nrcs (RFQ 050-26)

The purpose of this RFQ is to appoint a service provider to provide, install and support a Privileged Access Management (PAM) solution equivalent to BEYONDTRUST, installed on NRCS servers. NRCS has on-premises applications on Windows Server 2016 and 2019, uses Microsoft Active Directory synchronized to Microsoft 365, and uses Sage 300 and Sage 300 People with Microsoft SQL Server. The environment is managed by 8 NRCS administrators and about 12 consultants. NRCS uses Microsoft Windows Hyper-V as the hypervisor and plans to migrate some applications to the cloud.

Closing date: 31 August 2026 at 11:00. No other dates are specified in the document.

Bidding procedure enquiries: Glenda Mathane, telephone 012 482 8765, email [email protected]. Technical information: Siyabonga Mfeka, telephone 012 482 8716, email [email protected]. Bid response documents may be emailed to [email protected] and [email protected]. Physical address: SABS Campus, No. 1 Dr Lategan Road, Groenkloof, Pretoria.

Bids must be submitted on the official forms provided (not re-typed) or online. Bids must be delivered by the stipulated time to the correct address; late bids will not be accepted. Bid response documents may be emailed to [email protected] and [email protected]. The completed bid document must be placed in a file with dividers between every schedule, numbered as per the checklist. Returnable forms include: SBD 1 (Invitation to Bid), SBD 3.1 (Pricing Schedule – Firm Prices), SBD 4 (Declaration of Interest), SBD 6.1 (Preference Points Claim), Authority for Signatory (with resolution), and the Supplier Declaration Form. Bidders must register on the Central Supplier Database (CSD) to upload mandatory information. Failure to provide required particulars may render the bid invalid.

Bid document checklist: Schedule 1 - Valid and original SARS Tax Clearance Certificate (verified on CSD); Schedule 2 - Latest company registration certificate from CIPC or proof of company registration; Schedule 3 - Certified ID copies of directors/trustees/shareholders and their shareholding percentages; Schedule 4 - Original and valid B-BBEE status level verification certificate or certified copy; Schedule 5 - Functionality Evaluation Criteria.

Evaluation is in three stages. Stage One: Compliance with administrative and mandatory requirements – failure to provide required information or documentation may lead to disqualification. Stage Two: Functionality evaluation – bidders must obtain a minimum of 80 out of 100 points to proceed; failure automatically disqualifies. Stage Three: 80/20 preference point system – 80 points for price, 20 points for B-BBEE status. Functional evaluation (desktop) has a threshold of 70% and is weighted as follows: Methodology/Project Plan (40 points), Service Plan (30 points), Past Experience (30 points).

The service provider must provide, install and support a Privileged Access Management (PAM) solution equivalent to BEYONDTRUST, installed on NRCS servers. The solution must: store and manage passwords of privileged accounts; automate password rotations; record video of activities on NRCS servers and applications; enable multifactor authentication for privileged users; provide logging, auditing and control over privileged users; and report and alert on risky behaviors. Support and licenses are required for 24 months. The provider must provide skill transfer to 4 NRCS officials. Service must be provided and confirmed within one month from the purchase order issue date. Mandatory requirements: valid Partner Certification with the OEM and a Skills Transfer plan for NRCS IT Staff.

The bidder must provide a methodology and project plan covering all aspects of the PAM solution requirements as listed in the scope of work. The methodology is evaluated under functionality (40 points).

The bidder must submit 3 signed letters of appointment from previous companies where similar services were rendered. Letters must not be older than 5 years. The bidder must also provide a complete list of similar contracts awarded over the last five years, including current contracts, with company name, nature of work, value, contact person and duration. This information is deemed material to the award.

Goods supplied must conform to the standards in the bidding documents and specifications. The supplier must permit the purchaser to inspect records and have them audited. Pre-bidding testing is for the bidder's account. Inspections, tests and analyses may be carried out; if supplies do not comply, the supplier bears the costs and may be required to replace rejected supplies at their own expense.

Pricing must be on SBD 3.1 (Pricing Schedule – Firm Prices). Only firm prices will be accepted; non-firm prices (including those subject to exchange rate variations) will not be considered. The offer must be valid for 180 days from the closing date. Pricing schedule includes: Item 1 – Privileged Account Management software for 24 months; Item 2 – any other costs (specify). Subtotal, VAT @ 15%, and total including VAT. All delivery costs must be included in the bid price. The bid price must include all applicable taxes.

Bidders must be registered on the Central Supplier Database (CSD) to upload mandatory information: business registration, directorships, tax compliance status, and banking information. Bidders must submit a valid SARS Tax Clearance Certificate (verified on CSD) or provide a TCS PIN or CSD number. A B-BBEE status level verification certificate or sworn affidavit (for EMEs and QSEs) must be submitted to qualify for preference points. A company registration certificate from CIPC or proof of company registration is required. Certified ID copies of directors/trustees/shareholders and their shareholding percentages must be provided. The following forms must be completed and signed: SBD 4 (Declaration of Interest) – discloses any employment by the state or relationship with the procuring institution; SBD 6.1 (Preference Points Claim) – claims B-BBEE points; Authority for Signatory – attach a resolution authorising the signatory. Failure to disclose all CSD-registered active companies linked to directors will lead to disqualification.

The contract is subject to the General Conditions of Contract (GCC) and any Special Conditions of Contract (SCC) which prevail in case of conflict. Key GCC provisions include: performance security may be required within 30 days of contract award, in the form of a bank guarantee, irrevocable letter of credit, or cashier's/certified cheque; payment within 30 days of invoice; prices fixed for the contract duration; no assignment without consent; delays may incur penalties; termination for default or insolvency; and disputes settled per GCC. The successful bidder will be required to sign a written contract form (SBD 7.2).

Mandatory requirements: valid Partner Certification with the OEM and a Skills Transfer plan for NRCS IT Staff. The service provider must provide support for 24 months, provide licenses for a PAM solution equivalent to BEYONDTRUST, and provide skill transfer to 4 NRCS officials. Service must be provided and confirmed within one month from the purchase order issue date.

Evaluation stages: Stage One – Compliance with administrative and mandatory requirements; Stage Two – Functionality evaluation, minimum 80 out of 100 points to proceed; Stage Three – 80/20 preference point system (80 points price, 20 points B-BBEE). Functional evaluation (desktop) threshold is 70%, weighted: Methodology/Project Plan (40), Service Plan (30), Past Experience (30).