The appointment of a service provider for the provision of server support services (tower s), for a period of three (3) years, with an option to extend for two (2) years.

& Contract The Appointment of a Service Provider for the Provision of

term: Server Support Services (Tower S), for a Period of Three (3)

Years, with an Option to Extend for Two (2) Years.

Compulsory Virtual The Compulsory briefing session will be held virtually on

briefing session date: Microsoft Teams and can be accessed on the link below:

Click here to join the meeting

Date: 3 September 2026 at 11h00

Meeting ID: 372 590 126 277 329

Passcode: G2fi7PT6

Bidders to submit written

From 24 August 2026 to 09 September 2026

questions on or before:

SARS to respond to

bidders’ written questions 25 August 2026 to 11 September 2026

on or before:

23 September 2026 at 11:00

CLOSING DATE AND TIME Late bid proposals submitted after the closing date and time

(proposals due): will NOT be accepted nor considered, regardless of the

method used to send or deliver such documents to SARS.

---

of section contents

Main RFP Document Documents outlining the main RFP guidelines, instructions, conditions and

documents necessary for a Bidder to submit a proposal.

Business Document(s) outlining the BRS, technical requirements and other

2 Requirement information required by a Bidder to submit a proposal.

Specifications (BRS)

Standard Bid SBDs and other administrative documents that are required by National

3 Documents (SBDs) Treasury and SARS Procurement to be read, completed and returned as

part of a Bidder’s proposal.

Contract The proposed agreement under which SARS wishes to contract the

management services.

Response templates Where applicable, response templates that are required to be completed

and returned as part of a Bidder’s proposal.

4 key activities and dates

4.1 The table below lists certain key dates and activities relevant from the date of issue of the RFP up to

the closing date.

Table 2: Key activities and dates

No. Activity Date/Time /Details

1. Bid Number: RFP 03/2026

Description: The Appointment of a Service Provider for The Provision of

Server Support Services (Tower S).

Duration of contract

---

SARS currently makes use of server equipment from original equipment manufacturer

(OEM), Dell. This Business Requirements Specification (BRS) forms part of the RFP pack

and sets out the requirements that bidders must address in their proposals for the

provision of Server Device Support Services.

To achieve SARS’s Vision of a smart, modern SARS with unquestionable integrity that is

trusted and admired is of paramount importance. Pivotal to the delivery of SARS’ vision

are our digital platforms and technology infrastructure. To foster Strategic Objective 9, of

building public trust and confidence, our technology assets must demonstrate the highest

levels of robustness and security. It is indeed for these reasons, inter alia, that SARS’s

measure it on a planned 99% uptime and zero security breaches from known risks. In

support of this, the mandate is executed, among others, through partnering with third-

party suppliers to provide services and products to enable achievement of organizational

objectives.

This tender for the Tower S device support services aligned with several of SARS’s

Strategic Objectives, including:

• Objective 1: Clarity and certainty for taxpayers and traders of their obligations;
• Objective 2: Make it easy for taxpayers and traders to comply with their obligations;

© South African Revenue Service 2026

SARS RFP 03/2026 Business Requirements Specification

of 49

SARS confidential

• Objective 6: Modernise our systems to provide Digital and Streamlined services;

and zero security breaches from known risks.

• Objective 5: Increase and expand the use of Data within a comprehensive

knowledge management framework to ensure integrity, drive insight and improve

outcomes.

The primary objective of this RFP is to ensure the continuity and cost-effectiveness of

SARS’s Server device support services. SARS’s objectives in issuing this RFP do not

include a transformation of the technologies or services related to the support of SARS’s

Server devices. However, during the anticipated Term of the Server Device Support

Services Agreement, developments in, Server Device technologies, including

technologies to manage such environments, require that SARS maintains a flexible

approach in contracting Service Provider(s) to ensure that it can take advantage of these

developments and ensure the support methods and processes keep abreast of

developments in this field.

The landscape of server devices is constantly evolving and as SARS maintains its efforts

to modernize its systems, a changing mix of devices, brands and models are anticipated

to be introduced during the Term of the Server Device Support Services Agreement. It

will, therefore, be expected of the Service Provider(s) to support a wide and evolving

range of server devices as and when SARS may introduce them into the SARS

configuration, although the award of a contract does not confer the right of exclusivity to

provide support services for new devices.

3 components of scope

SARS scope of the RFP Towers S

4 use of alternate technologies or processes during

The term

In defining the scope of Tower S, reference is made to technologies and/or specific

processes currently deployed within the SARS environment. Where a technology or

process has been specified in this Business Requirements Specification the Bidder’s

Proposal must be designed to comply with the specific technology and/or process.

During the Term of any agreement arising from the award of this RFP, the use of

alternative technologies and/or processes may be proposed by the Service Provider

and/or requested by SARS and their implementation will not be considered out of scope

of the award, provided that they effectively substitute, or supplement

technologies/processes contained in the Service Provider’s original Proposal. No

alternative technologies/processes may be implemented during the Term without SARS’

approval.

5 underlying principles to the services

The principles detailed in this paragraph apply to the Services to be delivered in Tower S.

© South African Revenue Service 2026

SARS RFP 03/2026 Business Requirements Specification

of 49

SARS confidential

5.1 Accountability

SARS requires a single, accountable Service Provider for the Services to be

delivered in Tower S. The Service Provider must engage all subcontractors on a

formal contractual basis and must ensure adherence to the conditions placed on

subcontractors as required by SARS. To ensure sufficient control is retained by the

Service Provider, the Service Provider is limited to subcontracting no more than 40%

(forty percent) of the business, by revenue. For further details on the conditions

attached to the Service Provider’s use of subcontractors, see paragraph 9 of the

Main RFP Document.

The Service Provider must supply all elements of the Services to SARS in the

Service Provider’s name. The Bidder must not propose a solution in any part of its

Proposal that is contingent on SARS granting the Bidder an agency for it to procure

elements of the solution from a third party in SARS’s name.

5.2 Non-exclusive

SARS intends to contract for the different areas of scope with the Service Provider

on the basis that certain of the Services (or categories of such equipment or

equipment located in certain locations) may be excluded from the scope.

SARS will retain the right to source any part of the scope of Services from other

Service Providers during the Term or to provide such part of the scope of Services

itself.

5.3 Flexibility

During the Term of the agreement SARS anticipates that it will change the landscape

of its infrastructure and configuration and the requirements for the support thereof.

SARS, therefore, retains the right to adapt the scope of equipment and processes to

its changing requirements including the right to:

• Include new categories and/or exclude current categories of equipment,

with regards to new categories the Service Provider will be given 90

(ninety) days’ notice to enable the new category;

• Include new manufacturers/brands models and/or exclude current

manufacturers/brands/models of equipment;

• Increase or reduce the quantities of equipment under support;

• Introduce equipment at new sites into the scope of support or exclude

equipment at existing sites from the scope of support; and

• Include or exclude existing or new sites from the scope of services.

Therefore, a Bidder must be prepared to contract to provide support services on a

flexible basis to accommodate SARS’s changing needs and requirements for support

of changing technologies.

© South African Revenue Service 2026

SARS RFP 03/2026 Business Requirements Specification

of 49

SARS confidential

5.4 Technical Transformation

SARS has no specific or immediate requirement to undertake a major technical

transformation in terms of the technology or processes as part of the Services. If

SARS undertakes a transformation of technology or process within the scope of a

Tower during the Term, the Service Provider appointed may be engaged, on a project

basis, to provide services supporting the transformation. For clarity, while a yearly

percentage of refresh of equipment is undertaken by SARS on a continuous basis,

this is not considered a technical transformation and SARS may reduce the number

of devices to be supported.

5.5 Compliance

The Service Provider is required to execute the processes, procedures, schedules

and work practices developed in accordance with the Server Device Support Services

Agreement. Throughout the Term of the agreement, the Service Provider will be

required to improve and modify these processes, procedures, schedules and work

practices as required by SARS.

The Bidder must note the obligation to adhere to SARS PPS&G in the Server Device

Support Services Agreement.

5.6 Performance Standards

It is of critical importance to SARS that the Service Provider provides the Services

to meet or exceed the Service Levels specified in Schedule C of the Device Support

Services Agreement and its Appendices. The Service Provider will be required to

measure, monitor and report upon the delivery of the Services against the Service

Levels. The Service Provider must draw performance-related information from the

SARS Service Management System to construct and produce the required monthly

reports on Service Level achievements. The information to be presented in the report

and the format of the report will initially be agreed upon between the Service Provider

and SARS during Transition and will be continuously improved during the Term. The

Service Level requirements are set out at a high level with explanatory notes in this

document but must be read together with Schedule C of the Server Device Support

Services Agreement.

The Bidder’s attention is drawn to the Service Level Targets and the provisions of

Schedule C of the Server Device Support Services Agreement regarding Service

Level Credits.

SARS will assign a Site Classification (Metro, Town or Rural) to each SARS Site.

The Bidder must consult SARS Site Classifications to obtain the Site Classification

that will be associated with each SARS site at the Effective Date. The Site

Classification will be one of the factors determining the price of support for devices

at a SARS Site.

© South African Revenue Service 2026

SARS RFP 03/2026 Business Requirements Specification

of 49

SARS confidential

5.7 Service Levels and Service Coverage Periods

The definition of the performance standards applicable to a device category is

specified with respect to two dimensions: Service Coverage Period and Service

Level.

“Service Coverage Period” relates to the hours of service applicable to a device

that will be one of Basic, Standard, Extended or Premium.

“Service Level” relates to the time within which the Service Provider must respond

and repair the device. The Service Level is specified by a Service Level Class

(Bronze, Silver, Gold) which describes the repair time applicable to a server device

(and may, in certain cases, be specified in terms of response time).

SARS requires the Bidder to quote a monthly rate for every applicable server device-

based service for every combination of Site Classification (Metro, Town or Rural);

Service Coverage Period Basic, Standard, Extended and Premium) and Service

Level (Bronze, Silver or Gold) for every device type.

The definitions of Bronze, Silver or Gold within Tower S and the definitions of Basic,

Standard, Extended and Premium within Tower S are set out under the service

descriptions paragraph 6.3 of this document, respectively.

5.8 Specification of Service Coverage Period and Service Level for a Server Device

In each Tower, each SARS Site has been assigned a Service Level and Service

Coverage Period that applies to all server devices in the Tower that are registered

to that SARS Site. At the Commencement Date, the Service Level and Service

Coverage Period assigned to a site will be as specified in SARS Site Classifications

per Tower S. SARS may change the Service Level and Service Coverage Period

assigned to a SARS Site during the Term with 60 (sixty) days’ notice.

If support is required for a server device which has been moved from the site at which

it is registered, then the Service Provider must still provide support for the server

device at the SARS site to which it has been moved, subject to the following:

• The shorter of the Service Coverage Periods between the SARS site to

which the device is registered and the SARS site to which the device has

been moved will apply.

• The least stringent of the Service Levels between the SARS site at which

the device is registered and the SARS site to which the device has been

moved will apply.

• For example:

A server registered at Beit Bridge has a Service Coverage Period of

“Standard” and a Service Level of “Silver”. The server is moved to Lehae la

SARS in Brooklyn, which has a Service Coverage Period of “Premium” and

a Service Level of “Bronze”. The Service Coverage Period and the Service

Level applied to the device will be “Standard” and “Bronze”, respectively,

although SARS is being charged for a “Standard” and “Silver” service for the

device. This example is set out in the table below.

© South African Revenue Service 2026

SARS RFP 03/2026 Business Requirements Specification

of 49

SARS confidential

Table 1: Service Coverage Period of Standard and a Service Level of

Silver

Service Site at which the Site where the Applicable

Coverage Device is Device is Service Level

Period registered physically

Service

Coverage Standard Premium Standard

Period

Service Level

Silver Bronze Bronze

Class

(Note that the values for Service Coverage Period and Service Levels in the

example above are for illustrative purposes only and the Bidder must consult

SARS Site Classifications as per Tower S for the actual Service Coverage

Periods and Service Levels that are specified for each SARS site).

5.9 Change of Service Coverage Period and Service Level

The Bidder must provide rates for all combinations of Site Classification, Service

Coverage Period and Service Level requested for all categories of devices. SARS

may, during the Term, with 60 (sixty) days’ notice, change the Service Level and/or

Service Coverage Period that applies to a SARS site. The rates associated with the

new Service Level and Service Coverage Period must be charged from the day the

new Service Level and Service Coverage Period come into effect.

5.10 Measurement and Reporting Service Levels

The Service Provider must produce monthly Service Level reports in accordance

with Schedule C of the Server Support Services Agreement. In this regard, the

Service Provider must produce the reports using data from the SARS Service

Management System. The method of obtaining the data from SARS Service

Management System must be determined and processes defined as part of the

Transition project.

5.11 Request to Expedite Repair or Service

Regardless of the Service Coverage Period associated with a device, SARS may

request that the Service Provider attends to the repair or service of a specific server

device outside the Service Coverage Period attached to the device. This service

request is known as an “Expedited Service Request”. The Bidder is required to

provide a fixed rate, which is chargeable with every Expedited Service Request that

SARS makes.

© South African Revenue Service 2026

SARS RFP 03/2026 Business Requirements Specification

of 49

SARS confidential

This fixed rate is only related to the elements of costs of expediting the services and

must not include any costs related to the repair or service that already forms part of

another rate/charge associated with the repair or service.

An Expedited Service Request will be initiated by a request from an approved

member of SARS personnel to the Service Provider. During Transition, SARS will

confirm the names of the SARS personnel that may approve an Expedited Service

Request. On receipt of a request from SARS, the Service Provider must offer SARS

a committed time of arrival at the site and/or a committed time to repair. SARS may

accept or reject such offer provided by the Service Provider. If SARS accepts the

Expedited Service Request offer, the Service Provider will provide the expedited

services at the associated Expedited Service Request rate. If the Service Provider

does not meet the committed time of arrival on site and/or the committed time to

repair after acceptance by SARS of the offer, no part of the Expedited Service

Request rate is payable by SARS. The acceptance or rejection of the Service

Provider’s offer by SARS will in no way relax the base Service Level already

applicable to the device(s).

The Service Provider must provide a monthly report detailing the Expedited Service

Requests attended to during the preceding month. The Service Provider must

analyse the Expedited Service Requests and include recommendations for ways to

reduce the number of Expedited Service Requests in the monthly report.

5.12 OEM Relationship

The Service Provider must have a back-to-back agreement in place with the

applicable OEMs (or their official representatives) and OEM partner certification in

support of the equipment for which the Service Provider is contracted to provide

services to SARS. SARS’s requirement is for the Service Provider to have the back-

to-back agreements in place and partner certifications with the applicable OEMs by

the Commencement Date. On OEM renewals, if the Service Provider fails to meet

the obligations on an annual basis, then the penalty under Common Service

(Schedule C (Service Levels) of the Server Support Services Agreement will apply.

The Service Provider must ensure that the back-to-back agreement for all services

remains effective throughout the Term of the Server Device Support Services

Agreement.

During the Term of the agreement, SARS may elect to change the equipment/brands

currently used within SARS or introduce new equipment from a new manufacturer.

The Service Provider must be prepared to enter into new/additional back-to-back

agreements and partner certifications within 90 days with OEMs (or their official

representatives) to accommodate SARS’s requirement for support for the newly

introduced equipment/brands.

© South African Revenue Service 2026

SARS RFP 03/2026 Business Requirements Specification

of 49

SARS confidential

5.13 Mandatory Information Security Requirements

a. Information Security Governance & Compliance

• The Service Provider shall comply with all SARS Policies, Procedures,

Standards and Guidelines (PPS&G), including but not limited to

information security, cyber security, data protection, and access control

requirements, as amended from time to time.

• The Service Provider shall align to ISO/IEC 27001 or an equivalent

internationally recognised standard for the full duration of the

Agreement.

• Upon request by SARS, the Service Provider shall provide evidence of

certification, independent assurance reports, or formal attestations

demonstrating compliance with its security obligations.

• Failure to comply with security requirements shall constitute a material

breach of the Agreement.

b. Third Party, Subcontractor and Supply Chain Security

• The Service Provider shall remain fully accountable for the security

posture, actions, and omissions of all subcontractors, OEM partners,

couriers, and third-party repair providers.

• The Service Provider shall not subcontract any service involving access

to SARS systems, data, or devices without prior written approval from

SARS.

• All subcontractors and third parties shall be contractually bound to

security obligations no less stringent than those imposed on the Service

Provider.

• The Service Provider shall implement supply chain risk management

controls, including verification of the authenticity and integrity of:

o Hardware components

o Firmware

o Whole Unit Spares (WUS)

o Replacement parts

c. Personnel Security, Vetting and Confidentiality

• All Service Provider personnel accessing SARS sites, systems, or

devices shall undergo SARS-approved vetting, including Oath of

Secrecy screening, prior to access being granted.

• The Service Provider shall ensure ongoing confidentiality obligations for

all personnel, including after termination of employment or contract.

• SARS reserves the right to deny or revoke access for any Service

Provider personnel at its sole discretion without prejudice.

• The service provider shall ensure timely notification of personnel

termination or any changes in support roles during term of contract.

d. Access Control & Privileged Access Management

• SARS shall implement strict role-based access control (RBAC) ensuring

personnel have access only to the minimum privileges required to

perform their duties.

© South African Revenue Service 2026

SARS RFP 03/2026 Business Requirements Specification

of 49

SARS confidential

• All privileged access to SARS systems shall be time-bound, auditable,

and approved by SARS.

• The Service Provider shall not share credentials under any

circumstances.

• Multi-factor authentication (MFA) shall be mandatory for all access to

SARS systems where technically feasible.

• SARS will implement session logging, monitoring, or recording for

privileged activities.

e. System Integration & Interface Security

• Any system integration between the Service Provider and SARS

environments shall be subject to SARS security architecture approval

prior to implementation.

• All interfaces, APIs, and integrations shall:

o Use strong authentication mechanisms

o Encrypt data in transit

o Be restricted to approved network zones

o Be documented and approved

• The Service Provider shall not expose SARS systems to additional

interfaces or network connections without explicit written approval.

• SARS reserves the right to suspend or terminate integrations deemed

to pose a security risk.

f. Data Protection, Privacy & POPIA Compliance

• The Service Provider shall protect all SARS data, including taxpayer and

confidential information, in accordance with:

o POPIA

o SARS confidentiality obligations

o Applicable legislation and regulations

• The Service Provider shall not copy, store, process, or transmit SARS

data outside of approved environments.

• Data shall not be removed from SARS devices unless explicitly

authorised in writing.

g. Data Sanitisation & Device Lifecycle Security

• All devices subject to:

o Swap out

o WUS replacement

o Decommissioning (re use or disposal)

• shall undergo certified data sanitisation aligned to recognised standards

(e.g. NIST aligned wiping).

• The Service Provider shall provide evidence of data destruction or

sanitisation upon request as per SARS PPS&G.

• WUS devices shall be data clean, hardened, and approved before

installation in the SARS environment.

h. Firmware, BIOS and Platform Security

• The Service Provider shall ensure only OEM approved, digitally signed

firmware is installed on SARS devices.

© South African Revenue Service 2026

SARS RFP 03/2026 Business Requirements Specification

of 49

SARS confidential

• Firmware updates shall follow SARS change management procedures

and must not introduce downgrade or integrity risks.

• The Service Provider shall immediately notify SARS of any OEM

announced security vulnerabilities, firmware flaws, or end-of-support

risks.

j. Physical Security & Asset Handling

• The Service Provider shall ensure secure handling, storage, and

transport of all SARS devices.

• A documented chain of custody shall be maintained for all device

movements.

• Devices shall be protected against tampering, theft, or unauthorised

access, including during transport and storage.

• SARS may require security escorts or enhanced physical controls for

sensitive movements

i. Security Incident Management & Breach Notification

• The Service Provider shall immediately notify SARS of any:

o Actual or suspected security incident

o Data breach

o Loss, theft, or compromise of a SARS asset

• Notification shall occur without undue delay and include:

o Nature of the incident

o Affected assets or systems

o Immediate containment actions taken

• The Service Provider shall cooperate fully with SARS SOC, CSIRT, and

forensic investigations.

• The Service Provider shall not communicate externally regarding any

security incident involving SARS without prior written approval.

j. Monitoring, Audit & Assurance

• SARS reserves the right to audit the Service Provider’s security controls,

processes, and compliance at any time.

• The Service Provider shall remediate identified security findings within

timeframes specified by SARS.

• Repeated or unresolved security findings may result in penalties, service

credits, or contract termination

k. Business Continuity & Resilience

• SARS may request the Service Provider to assist with server

infrastructure during Business Continuity and Disaster Recovery testing.

l. Termination & Data Return

• Upon termination or expiry of the Agreement, the Service Provider shall

securely return or destroy all SARS data and assets.

• A formal data destruction attestation shall be provided to SARS

© South African Revenue Service 2026

SARS RFP 03/2026 Business Requirements Specification

of 49

SARS confidential

6 service definitions and requirements

A Service Provider appointed must provide all the services detailed in this paragraph 6

unless otherwise specified.

6.1 Service Management

The Service Providers appointed in Tower S will be required to maintain standards

of service management and/or conform to best practice IT Service Management in

their organisations dealing with the following processes:

• Incidents Management;
• Problems Management;
• Change and Release Management;
• Configuration Management;
• Service level management;
• Performance and Capacity management; and
• Service management reporting.

The Service Provider must hold an ISO certification (ISO 20000 – IT Service

Management) OR a formal IT Service Management Maturity Assessment report

showing an overall organisational Maturity score of 4 (quantitively managed or

equivalent) or higher.

The appointed service provider must have a well-established IT Service

Management system/toolset that is automated to support the efficient and effective

delivery of IT services to SARS. The automated system will have a ticketing and

incident management module that allows for the automated creation, assignment,

tracking of tickets, notifications and escalation based on pre-defined rules. The CMDB

module should automatically keep track of the configuration items (CIs) in the IT

infrastructure. The solution should allow for the automated creation, assessment,

and approval of change requests. Furthermore, the automated system will have

robust service management reporting and analytics capabilities. It should generate

automated reports and dashboards, providing insights into various ITSM metrics,

such as ticket volumes, resolution times, SLA compliance, and other performance

indicators. This enables data-driven decision-making and helps identify areas of

improvement.

The Service Provider must provide a 24x7 external web interface (e.g., a Contact or

Service Centre) for the reporting of incidents and problems and to provide status

updates. Service Providers are not required to interface directly with the SARS

service management system, nor are they required to receive requests, respond to

incidents or generally update records directly from the SARS service management

system.

The Service Provider will be expected to participate, provide information and

perform tasks as may be prescribed by the SARS PPS&G in terms of incident,

problem, change, service level management, performance and capacity

management.

The Service Provider will also be required to receive, route and update tickets on

SARS’s Service Management System. The Service Provider must provide as many

personnel as SARS has provided licensing to work directly on SARS’s Service

Management System to receive, route and update tickets.

© South African Revenue Service 2026

SARS RFP 03/2026 Business Requirements Specification

of 49

SARS confidential

Should the Service Provider require additional licenses, it will be at the Service

Provider’s cost. The Service Provider may, in addition to this at its own cost, develop

and implement an interface between the SARS Service Management System for

incident management. SARS will co-operate with the Service Provider in developing

such an interface, but SARS reserves its rights to make configuration changes as

and when it sees fit to the SARS Service Management System and will give the

Service Provider reasonable notice of its intended changes. Any costs relating to the

hardware, software licensing, maintenance and configuration of the interface will be

for the Service Provider.

Therefore, SARS recommends that the Service Provider determines the feasibility

(number of incidents per month) to integrate during the Transition period since there

are several factors to consider when integrating with SARS as per below:

• Hardware costs;
• Software costs;
• People costs being on standby and resolving technical issues, testing after

changes on firewalls, network, servers, software, etc.;

• Security considerations exposing more interfaces, etc.; and
• Customisation/development costs.

The Service Provider will have the capability to log, receive, route and update tickets

remotely without VPN services required during the Transition period. The Service

Provider must ensure sufficient personnel are provided (remotely where required) to

meet the contractual performance standards, including the Service Levels.

If the Service Provider receives sufficient incidents and there is a benefit to SARS

and the Service Provider and it is viable to integrate, then the Service Provider

should pursue the integration route.

Currently, the SARS standard for Service Management (Incident Management)

integration is Web Services as per below:

• Enterprise Service Bus (Broker) and B2B Gateway (DMZ);
• Integration (Inter-Enterprise);
• Messaging (Queues) and Web Services;
• Async (Queues) and Sync (Web Service Calls);
• Request-Response;
• Integration Time: Near real-time;
• Message Multiplicity: Single Entity; and
• Message Size: Small.

Table C-1 sets out the number and type of SARS Service Management System

licenses that SARS will make available to the Service Provider for Tower S. The

Service Provider may, during the Term, with 30 (thirty) days’ notice, request

additional Service Management licenses. However, the Service Provider must note

that the costs associated with such additional licenses will be recovered from the

service provider.

© South African Revenue Service 2026

SARS RFP 03/2026 Business Requirements Specification

of 49

SARS confidential

Table C-1. SARS Service Management System licenses that will be made

available per Service Management module for Tower S respectively

License type Tower S

Change Management 1 X Service

Management

Suite Named

Configuration 1 X Service

Management Management

Suite Named

Incident Management 2 x Service Desk

Named

Problem Management 1 x Service Desk

Named

Release Management 1 x Service Desk

Named

SARS reserves the right to change its service management system during the

intended Term.

SARS will not provide permanent seating and provisions will be made during

transition period for the Service Provider personnel performing service management

services for Tower S.

The Service Provider must ensure that sufficient personnel are provided to meet the

contractual performance standards, including the Service Levels, regardless of the

number of Seats provided by SARS. The Service Provider must monitor the

utilisation of the licenses and must submit a request to SARS for the

increase/decrease of the number of licenses as and when required. SARS will review

the request for the additional/reduced requirement and, if approved, adjust the

provisioning accordingly within 30 (thirty) days from the date of the request. The

Service Provider will not be excused from its obligations to meet the Service Levels

if SARS is unable to meet the number of licenses that are requested by the Service

Provider in excess of the numbers in Tables C-1. SARS will, on a regular basis,

review the licenses across all services and functions by the Service Provider and if

the number of licenses provided by SARS cannot be justified, SARS reserves the

right to reduce the allocations accordingly.

6.2 Device-based Services

The applicability of the Device-based Services to categories of Tower S Servers is

set out in paragraph 10.

© South African Revenue Service 2026

SARS RFP 03/2026 Business Requirements Specification

of 49

SARS confidential

6.3 Service Descriptions

The Services are set out at a high level in this document and must be read together

with the provisions set out in the statements of work in the Server Device Support

Services Agreement, in particular Schedule B (Service Management Services

SOW); Schedule B-S (Server Support Services SOW)

The Bidder will be required to compile detailed operational procedures based on the

requirements set out for the various device categories during Transition. The Bidder

must reference the relevant provisions in Schedule B (Service Management Services

SOW); Schedule B-S (Server Support Services SOW); Server Device Support

Services Agreement for a detailed description of the obligations required during

Transition.

6.4 General obligations applicable to all Device-based Services

The Bidder must take special note of the service management-related activities set

out in the Schedules listed above, which are applicable to all the services described

hereunder. The Bidder must include these service management activities in its

costing and pricing for the services.

6.5 General housekeeping activities

Unless specifically excluded, general housekeeping activities must be performed

every time the Service Provider is required to perform either a repair or Standard

Chargeable Service. These activities must be included in the Bidder’s costing and

pricing for the services. The general housekeeping activities must include at a

---

Cell L2: East 5247, 5 Philip Frame Road, Chiselhurst, East London, 5247

---

Nb: failure to provide / or comply with any of the above particulars may render the bid invalid.

---

Any person (natural or juristic) may make an offer or offers in terms of this invitation to bid. In line with the principles of transparency, accountability, impartiality, and ethics as enshrined in the Constitution of the Republic of South Africa and further expressed in various pieces of legislation, it is required for the bidder to make this declaration in respect of the details required hereunder.

---

Preference points claim form in terms of the preferential procurement regulations 2022

---

Master services agreement server device support services

---

The Appointment of a Service Provider for the Provision of Server Support Services (Tower S), for a Period of Three (3) Years, with an Option to Extend for Two (2) Years.

---

relates to a function defined in the process flow diagram.

Manage ICT Incidents - Internal SOP Revision: 3 of 10

SS-TECH-10-S01

Effective 12 December 2022

2.2 Manage ICT Incidents

Manage ICT Incidents - Internal SOP Revision: 3 of 10

SS-TECH-10-S01

Effective 12 December 2022

---

The Appointment of a Service Provider for the Provision of Server Support Services (Tower S), for a Period of Three (3) Years, with an Option to Extend for Two (2) Years.

---

The Appointment of a Service Provider for the Provision of Server Support Services (Tower S), for a Period of Three (3) Years, with an Option to Extend for Two (2) Years.

---

Cell C14: Monthly Server Computing Device Support - Rates per Device