Implementation of iso/iec 27001 & iso 14001 management systems – national tender (RFQ)

Closing date: 19 November 2026 at 11:00 (South African time).

• Queries deadline: within 2 days before the closing date (i.e. by 17 November 2026).
• RFQ validity period: 90 days from closing date.
• No compulsory briefing or site visit is stated.

Bidding procedure enquiries:

• Contact: Supply Chain Management
• Telephone: 012 432 1309
• Email: [email protected]

Technical enquiries:

• Contact: SCM
• Telephone: 012 432 1308
• Email: [email protected]

Submission address: e-tender portal (online).

Submission method: e-tender portal (online only).

• Submissions must be addressed to Supply Chain Management NLC.
• Submit in PDF format, protected against modification, deletion or addition.
• Financial/pricing information must be in a separate attachment from the technical/functional response.
• Mark submissions prominently with bidder name, tender number and tender title.
• Late or incomplete submissions will not be accepted.
• The NLC is not responsible for submission failures (power cuts, portal issues, poor network).

Returnable forms (all must be completed, signed and submitted):

• SBD 1 (Invitation to Bid): signed cover page with bidder details.
• SBD 4 (Declaration of Interest): discloses any state employment or connection to the procuring institution; false declaration disqualifies.
• SBD 6.1 (Preference Points Claim): claims B-BBEE and specific-goal points.
• POPIA Consent Form: signed consent for processing of personal information.
• B-BBEE Certificate or Sworn Affidavit (or consolidated certificate for JV).
• Full CSD Report with SARS Tax Compliance Status.
• CIPC registration documents (CK documents).
• JV Agreement (if applicable).
• Proof of authority to sign (e.g. company resolution).

Evaluation stages:

1. Stage 1 – Submission instructions and format: late or non-compliant submissions rejected.
2. Stage 2 – Administrative compliance: all required documents must be submitted.
3. Stage 3 – Mandatory requirements: failure to comply disqualifies.
4. Stage 4 – Technical evaluation (minimum qualifying score: 70/100).
5. Stage 5 – Price and specific goals (80/20 system).

Technical evaluation (100 points total):

• Company Experience (15%): years in existence, 0–5 points.
• Reference Letters (15%): 0–5 relevant client letters on letterhead; appointment letters not accepted.
• Team Leader Qualification & Experience (15%): must hold valid ISO/IEC 27001 Lead Implementer or Lead Auditor certification; 0–5 points based on years of experience.
• Project Team Qualifications (15%): academic/professional qualifications relevant to information security, environmental management, auditing, compliance or risk management; average of two experts' scores.
• Project Team Experience (20%): two officials' experience in ISO/IEC 27001 and ISO 14001 implementation; average of two experts' scores.
• Methodology and Approach (20%): detailed plan addressing all five deliverables within the four-month project duration.

Price and specific goals (80/20 system):

• Price: maximum 80 points, formula based on lowest acceptable price.
• Specific goals: maximum 20 points as follows:
• Black-owned: 100% = 8 points; 51–99% = 4; less than 51% = 0.
• Women-owned: 100% = 4; 30–99% = 2; less than 30% = 0.
• Youth-owned: 100% = 4; 30–99% = 2; less than 30% = 0.
• Disability-owned: 20%+ owners with disability = 4; 10–20% = 2; less than 10% = 0.

Due diligence and negotiation may follow for the preferred bidder.

The National Lotteries Commission requires a service provider to implement an Information Security Management System (ISMS) aligned to ISO/IEC 27001 and an Environmental Management System (EMS) aligned to ISO 14001.

Scope of work:

• Conduct a comprehensive gap analysis of current information security and environmental practices against both standards.
• Review existing policies, procedures, registers, controls and records.
• Identify and document non-conformities, gaps and partial compliance, clause by clause, for each standard.
• Provide a consolidated Gap Analysis Report per standard, including a prioritised remediation action plan with responsibilities and indicative timelines.
• Develop an ISO/IEC 27001 ISMS Manual for the NLC.
• Develop an ISO 14001 EMS Manual for the NLC.
• Present draft manuals to NLC management for review and incorporate comments into final approved versions.
• Provide awareness training on both standards for all identified NLC officials.
• Provide training material in electronic and printed format, plus attendance registers.

Deliverables:

1. Gap Analysis Report: ISO/IEC 27001 (clause-by-clause findings).
2. Gap Analysis Report: ISO 14001 (clause-by-clause findings).
3. ISO/IEC 27001 ISMS Manual.
4. ISO 14001 EMS Manual.
5. Training material and attendance registers.

Reporting: The service provider reports to the Chief Risk Officer.

Project duration: 6 months, effective from appointment, SLA signing, or as directed by the NLC.

Bidders must submit a detailed methodology and project implementation plan addressing each of the five deliverables within the four-month project duration.

• For each deliverable, the plan must set out: approach and key activities aligned to ISO/IEC 27001 and/or ISO 14001; resources (team members and roles); timelines, sequencing and dependencies; milestones and outputs for NLC sign-off; quality assurance, stakeholder engagement and risk mitigation.
• Scoring: 0 = no methodology or not relevant; 1 = generic; 2 = basic; 3 = adequate; 4 = comprehensive; 5 = comprehensive, integrated and NLC-aligned, preparing the NLC for certification.

Company experience: bidder must demonstrate previous experience in implementing ISO/IEC 27001 and ISO 14001 management systems, including number of projects, size, complexity, and relevance to public sector or similar regulatory environment. Scoring based on years in existence (0–5 points).

Reference letters: 0–5 relevant client letters on letterhead, including contact name, address, phone number, contract duration and brief description of services. Appointment letters not accepted.

Team Leader: must hold valid ISO/IEC 27001 Lead Implementer or Lead Auditor certification. Scoring based on years of experience in management system implementation (0–5 points).

Project team qualifications: relevant academic/professional qualifications (e.g. BSc/BCom IT, Information Security, Environmental Management, Internal Audit, Risk Management). Scoring based on NQF level and certifications; at least one team member must hold an environmental management certification (e.g. ISO 14001 Implementer, Lead Implementer or Lead Auditor).

Project team experience: two officials with experience in ISO/IEC 27001 and ISO 14001 implementation projects; CVs required. Scoring based on years of relevant experience (0–5 points).

Pricing must be submitted in South African Rand, VAT inclusive, covering all costs, disbursements and expenses.

• Complete every line item in the pricing schedule; incomplete schedules may render the quotation non-responsive.
• Prices must remain firm and valid for 90 days from the closing date.
• The pricing schedule template lists five cost items: gap analysis against ISO/IEC 27001; gap analysis against ISO 14001; development of ISMS Manual; development of EMS Manual; awareness training on both standards.
• Provide amounts excluding VAT, VAT amount, and totals including VAT.

Pricing format: fixed fee per deliverable, VAT inclusive, quoted in South African Rand.

• Complete every line item in the pricing schedule; incomplete schedules may render the quotation non-responsive.
• Prices must remain firm and valid for 90 days from the closing date.
• No bid security, bonds, guarantees or retention are stated.
• Payment terms: no services may be rendered before an official NLC Purchase Order is received.

Mandatory registrations and documents:

• CSD registration (www.csd.gov.za) – mandatory; award cannot be made to unregistered bidders.
• SARS Tax Compliance Status (TCS PIN or CSD number) – each JV/consortium member must provide separately.
• CIPC registration documents (CK documents).
• B-BBEE certificate or sworn affidavit (for EMEs/QSEs) to claim preference points.
• POPIA consent form (signed).
• SBD 4 declaration of interest – false declaration disqualifies.
• SBD 6.1 preference points claim form.
• JV agreement (if applicable).
• COIDA registration and good standing – proof may be requested.
• Bids must be in English.
• Foreign suppliers with no local entity need not register on CSD.

Bidders must warrant that all employees (including subcontractors) are covered under the Compensation for Occupational Injuries and Diseases Act (COIDA).

• The Commission may request documentary proof of registration and good standing with the Compensation Fund.
• Hard copies of certified qualifications, memberships, COIDA etc. may be requested for assessment; failure to submit within 3 working days renders the bidder non-responsive.

The project includes implementing an Environmental Management System (EMS) aligned to ISO 14001.

• Conduct a gap analysis of current environmental management practices against ISO 14001.
• Develop an ISO 14001 EMS Manual for the NLC.
• Provide awareness training on ISO 14001 for NLC officials.
• At least one proposed team member must hold a relevant environmental management certification (e.g. ISO 14001 Implementer, Lead Implementer or Lead Auditor).

Contract duration: 6 months, effective from appointment, SLA signing, or as directed by the NLC.

• No services may be rendered before an official NLC Purchase Order is received.
• The RFQ document is confidential; no part may be used, copied, disclosed or conveyed without prior written permission from the Commission.
• Copyright and intellectual property in the RFQ vests with the Commission.
• Late and incomplete submissions will not be accepted.
• The RFQ takes precedence over any attached documents; where the RFQ is silent, PPPFA applies.
• Bidders may not make news releases about the RFQ or award without Commission consent.
• Bidders must not canvass Commission officers between closing and award.
• Collusion between bidders leads to automatic disqualification and restriction from doing business with organs of state.
• Supplier performance reviews are conducted; non-performance may lead to formal remedial action and escalation.
• Personal information is processed under POPIA; bidders consent by signing.

Additional evaluation criteria:

• The 80/20 preference point system applies (price 80 points, specific goals 20 points).
• Minimum qualifying score for technical evaluation: 70/100.
• Bidders must fully comply with mandatory requirements; failure results in disqualification.
• The Commission may request hard copies of certified qualifications, memberships, COIDA etc. within 3 working days; failure renders the bidder non-responsive.
• Due diligence may be conducted on the preferred bidder.
• Negotiation may occur before contract conclusion; bidders may be asked for best and final offers.