Private cloud hosting, infrastructure and software licences for tasez – 3-Year RFP

Compulsory briefing session: 18 August 2026, 10:00–12:00, at TASEZ Central Hub, Manitoba, The Willows 340-Jr, Pretoria, 0081.

• Last date for clarification questions: 28 August 2026.
• Closing: 01 September 2026 at 12h00.

SCM enquiries: SCM Office, 012 940 6378, [email protected].

• Submission address: The Procurement Officer, Tshwane Automotive Special Economic Zone, Building 21, CSIR, Meiring Naudé Road, Brummeria, Pretoria (Gauteng).
• Tender documents available at www.tasez.co.za from 11 August 2026.

Submission channel: hand delivery only; electronic, fax, email, telegram or telex submissions are not accepted.

• Mark the envelope “For attention: Supply Chain Management” and include the RFP number.
• Deliver to the tender box at the Main Gate, Building 21, CSIR Campus, Meiring Naudé Road, Brummeria, Pretoria, before 12h00 on 01 September 2026.
• Submit one original, bound and sealed, with the RFP title, closing date, company name and return address endorsed on the envelope. Include a scanned copy on a flash disk secured inside the file.
• Initial every page of the RFP on the right-hand side at the bottom.
• Amended bids must be in a separate envelope marked “Amendment to bid” and submitted with the original before closing.
• All documentation must be in English.
• Returnable forms: SBD 1 (Invitation to Bid), SBD 4 (Declaration of Interest), SBD 6.1 (Preference Points Claim), SBD 6.2 (Local Production and Content), SBD 2 (Tax Compliance), the Compulsory Enterprise Questionnaire, and the completed, priced and signed Pricing Schedule.
• Disqualification risks: late arrival, incomplete price list, unsigned or missing returnable forms, failure to initial pages, or contacting TASEZ staff other than the named contact.
• Clarification questions close 28 August 2026; all queries must be in writing to [email protected].
• Bids remain valid for 120 calendar days from the closing date.

Evaluation has three stages:

• Stage 1 – Administrative Requirements: pass/fail, no points. Requires CIPC registration, JV agreement or power of attorney, valid tax clearance or tax PIN, CSD report not older than three months, letter of good standing from the Department of Employment and Labour or RMA, UIF compliance certificate, valid B-BBEE certificate (sworn affidavit for EMEs, SANAS-accredited for QSEs), signed SBD 1, SBD 4, SBD 6.1, and a completed, priced and signed pricing schedule.
• Stage 2 – Technical/Functional Evaluation: scored out of 100; bidders must score at least 70 to proceed. Components: Company Experience (50 points), Key Personnel Qualifications (30 points), Project Execution Plan (20 points). Reference letters for similar cloud hosting, backup management, software licence management and data migration work score up to 20 points (5 references = 20, 4 = 20, 1–2 = 5). Project execution requires a description of monitoring tools and a sample monthly SLA report; poor or missing submission scores zero.
• Stage 3 – Price and Specific Goals: evaluated on the 80/20 principle. Risk assessment is conducted on the top three bidders using three years of audited financial statements.
• A valid ISO 27001 certificate (company) is a mandatory requirement.

Scope: provisioning, maintenance and support of TASEZ’s ICT systems, private cloud hosting, and software licences for three years.

• Transition from current cloud infrastructure to a new private hosted environment, including migrating data and applications.
• Server infrastructure: Active Directory (primary and secondary for DR), SQL application server (SQL 2022, SAGE), AD Connect, and Patch Manager — Windows Server 2019/2022, 32–64 GB RAM, Intel Xeon Gold CPU, 139–500 GB C: drive, 1.95 TB D: drive.
• Hosted in South Africa in a certified data centre; IaaS with Backup as a Service and dedicated firewalls.
• Backups and DR: two data centres, minimum 36 CPU, 917 GB RAM, 7.5 TB hosted space; RPO 6 hours, RTO 4 hours; full image backups, replicas, retention 90 days daily, 52 weekly, 36 monthly, yearly for contract duration; quarterly restore testing.
• Security: firewall management per TASEZ policy, VPN, real-time threat detection, endpoint/server/network security, DLP, identity and access management, vulnerability and patch management, audit logging, ransomware protection.
• Antivirus/endpoint security: supply, manage and support anti-virus and mailbox protection, maintain signature files, provide reports and training.
• Software licences: Microsoft SQL Server, Windows Server, backup/recovery/retention software, antivirus/endpoint, email protection, Microsoft O365; maintain SSL certificate records and renewals.
• Support: 24/7/365 help desk for service requests, incidents and problems; TASEZ handles first- and second-line end-user support.
• Governance: align with COBIT 2019; provide dashboards, analytics and reports on user activity, performance, capacity, availability and security violations.
• Website and intranet: host and maintain TASEZ website, SharePoint intranet, domain, database, mailboxes, email aliases, SSD storage and unlimited traffic; live 24/7/365.

Bidders must provide a project execution plan detailing the approach to delivering the services.

• Describe monitoring tools (e.g. dashboards, alerts) and provide a sample monthly SLA report.
• Outline change management processes and migration procedures for the cloud environment.
• Provide details on OS administration, incident/problem/escalation management, network configuration, performance/capacity/availability monitoring, access to dashboards/logs/reports, user access management, and access for TASEZ ICT personnel.
• Detail backup, disaster recovery and business continuity arrangements.
• Describe security mechanisms including real-time threat detection, endpoint/server/network security, DLP, identity and access management, vulnerability and patch management, firewall/IDS/IPS, security incident management, backup security and ransomware protection, audit logging and compliance reporting.
• Demonstrate alignment with COBIT 2019 and provide dashboards, analytics and reports.
• Provide a plan for website, intranet (SharePoint) and domain hosting and maintenance.

Company Experience (50 points): reference letters from previous clients for similar projects in cloud hosting, backups management, software licence management and data migration. Scoring: 5 references = 20 points, 4 references = 20 points, 1–2 references = 5 points. TASEZ may verify authenticity.

• Key Personnel Qualifications (30 points):
• Project Manager: 3 certificates (level 6 or higher) = 35 points, 2 certificates = 20, 1 certificate = 15, none = 0.
• Systems Engineer (Cloud qualification, Azure equivalent): 2 certificates = 20, 1 = 15, none = 0.
• Account Management qualification (ITIL or COBIT): 1 certificate = 15, none = 0.
• Names of key personnel must be provided; failure to provide names results in nil points.
• Systems Engineer experience: 6–9 years = 15 points, 3–5 years = 10, 1–2 years = 5, 0 years = 0.

Technical evaluation includes a Disaster Recovery Plan (DRP) with details of the secondary/DR site location and evidence of DR testing, scored up to 15 points for good understanding.

• A declaration of the data centre is required, scored up to 10 points for partial understanding.
• Bidders must provide a sample monthly SLA report covering patch management, server availability, backup report and security report.

Complete the pricing schedule with unit costs and totals for each of the three years.

• Items: Office 365 E5 (100 users), anti-virus, remote monitoring and management, email security (100), cloud backup (1), cloud-based server (1), migration and change management, backups (100 at 500 GB each per month), monitoring (100), website and domain hosting, Exchange Server management, ICT security, SharePoint development.
• Provide sub-totals per year, add 15% VAT, and state the total for the three years.
• All prices must be VAT inclusive in ZAR and firm and fixed for the contract duration.
• The total on the Price Declaration Form must match the pricing schedule total.

Pricing must be VAT inclusive in South African Rand and firm and fixed for the contract duration.

• Complete the pricing schedule exactly as provided; an incomplete price list renders the bid non-responsive.
• The total RFP price declared on the Price Declaration Form must match the pricing schedule total; if they differ, the declared figure prevails.
• Pricing schedule items include Office 365 E5 (100 users), anti-virus, remote monitoring and management, email security (100), cloud backup (1), cloud-based server (1), migration and change management, backups (100 at 500 GB each per month), monitoring (100), website and domain hosting, Exchange Server management, ICT security, and SharePoint development.
• Provide sub-totals for each of the three years, add 15% VAT, and state the total for the three years.
• Include all delivery and labour costs in the proposal.
• Contract duration is three years.

Minimum B-BBEE status level 3 contributor.

• B-BBEE certificate: SANAS-accredited verification certificate for QSEs and generics; EMEs with turnover below R3 million may submit a sworn affidavit or CIPC certificate.
• CSD registration with a report not older than three months.
• Valid tax clearance certificate or SARS tax PIN; tax status verified through CSD and SARS.
• CIPC registration documents.
• Valid letter of good standing from the Department of Employment and Labour or RMA, and a valid UIF compliance certificate.
• Valid ISO 27001 certificate (company).
• No persons in the service of the state may bid; directors or members in state service disqualify the bid.
• Returnable forms: SBD 1, SBD 2, SBD 4, SBD 6.1, SBD 6.2, Compulsory Enterprise Questionnaire, and proof of authority to sign (e.g. board resolution).
• Joint ventures: each partner must submit separate tax compliance certificates and complete separate enterprise questionnaires.

Contract duration is three years.

• The successful bidder must sign a written contract form (SBD 7).
• Contract conditions are based on a Service Level Agreement (SLA).
• The General Conditions of Contract apply and bind the bidder whether returned or initialled or not.
• The bid is subject to the Preferential Procurement Policy Framework Act 2000 and the Preferential Procurement Regulations 2017.
• TASEZ may amend bid conditions, validity period, specifications or extend the closing date before closing; bidders will be advised in writing.
• TASEZ may award the bid in whole or in part without furnishing reasons, and may negotiate pricing with the preferred bidder.
• TASEZ may conduct site visits to verify information provided.
• Misrepresentation during the contract lifecycle is addressed; bidders must not change bid conditions without written approval.
• Governing law, confidentiality, indemnity, limitation of liability, and protection of personal information clauses apply.

All communication must be in writing to [email protected]; bidders may not contact other TASEZ employees.

• Clarification questions close 28 August 2026.
• Bids valid for 120 calendar days from closing.
• TASEZ may amend conditions, extend closing date, or award in part or whole without reasons.
• TASEZ may award to an empowerment company or require a joint venture with an empowerment company.
• TASEZ may conduct site visits to verify information.
• Incomplete price list renders bid non-responsive.
• TASEZ may review pricing and negotiate with the preferred bidder.
• The General Conditions of Contract apply.
• Bidders must register on CSD.

Tax compliance (SBD 2): bidders must submit a SARS tax PIN and a printed tax compliance certificate; each JV or subcontractor party must submit separate certificates; a CSD report may substitute where no PIN is available.

• Foreign suppliers must answer a questionnaire on residency, branch, permanent establishment and source of income in South Africa; if all answers are no, no tax compliance status is required.
• Compulsory Enterprise Questionnaire: complete for each JV partner, including enterprise name, VAT number, CIDB number, particulars of sole proprietors/partners or companies/close corporations; attach SBD 4 and SBD 6.1; authorises TASEZ to obtain a tax clearance; confirms the enterprise is not on the Register of Tender Defaulters, has no fraud or corruption convictions in the last five years, has no conflict of interest, and that the information is true and correct.
• Bidders must be registered on the Central Supplier Database (CSD).
• Bidders must not be persons in the service of the state.

Stage 1 – Administrative Requirements: pass/fail; requires CIPC registration, JV agreement or power of attorney, valid tax clearance or PIN, CSD report not older than three months, letter of good standing, UIF compliance certificate, valid B-BBEE certificate, signed SBD 1, SBD 4, SBD 6.1, and completed pricing schedule.

• Stage 2 – Technical/Functional: minimum 70 out of 100 to proceed. Company Experience (50), Key Personnel Qualifications (30), Project Execution Plan (20).
• Stage 3 – Price and Specific Goals: 80/20 principle; risk assessment on top three bidders using three years of audited financial statements.
• A valid ISO 27001 certificate is a mandatory requirement.