Appointment of a Service Provider for the Provision of Subscription Services for a Governance, Risk and Compliance Solution for a Period of Twelve (12) Months

To appoint a competent service provider for the provision of subscription services for an

automated GRC solution for a period of twelve (12) months.

It is anticipated that only suitably qualified and reputable service providers with the necessary

expertise will respond to this RFQ, thereby enabling the MICT SETA to fulfil the stated purpose,

achieve the project objectives, and meet the minimum requirements set out in this ToR.

RFQ/MICT/92/2025 | P a g e

4. OBJECTIVES

The Objectives of the project are summarised as follows:

a) Implement an automated GRC system to streamline Audit, Risk and Legal management

processes.

b) Improve oversight, accountability, and reporting through automated workflows and

dashboards.

c) Maintain a full, tamper-proof audit trail of activities to enhance governance, oversight,

and accountability.

d) Implement alerts and escalation mechanisms to ensure timely action on risks, audit

findings, and compliance obligations.

e) Facilitate seamless integration with existing platforms (e.g., Integrated Learner

Management System (ILMS), Enterprise Resource Planning (ERP)) for consolidated

reporting and workflow efficiency.

f) Ensure the system can expand to accommodate additional modules, users, or

regulatory requirements in the future.

g) Provide a secure, reliable, and scalable hosting environment for the GRC solution, either

hosted by the Service Provider or on MICT SETA infrastructure, ensuring high availability,

compliance with data protection regulations, and disaster recovery capabilities.

5. PROJECT REQUIREMENTS

5.1. Core GRC Functionality

a) Integrated modules for Audit, Risk and Legal management.

b) Centralised dashboard for management oversight.

c) Support for multi-entry or multi-department structures.

d) Ability to integrate with existing platforms (e.g., ILMS, ERP, etc.).

e) Ability to work offline and create a replicate.

5.2. Audit Module

a) Audit planning and scheduling: Ability to create and manage comprehensive audit

plans, including resource allocation, task assignment, scheduling of recurring and ad hoc

audits, and monitoring of deadlines through dashboards.

b) Templates (working papers, reports, checklists etc): Ability to customise working papers,

reports templates to align with MICT SETA audit methodology.

c) Workflows: Ability to route tasks throughout the audit process i.e. planning, fieldwork and

reporting.

d) Notifications and escalations: Ability to notify due tasks and escalate unreviewed work or

outstanding review notes for reviewed work.

e) Action tracking: Workflow for management responses, automated reminders, and

escalation reports.

RFQ/MICT/92/2025 | P a g e

f) Outstanding actions: Ageing analysis of outstanding issues.

g) Global Internal Audit Standards: Alignment of audit process on the system to the Global

Internal Audit standards.

h) Findings: Consolidated report of all findings issued across all audits.

5.3. Legal and Compliance Module

a) Regulation / Framework Mapping: Ability to map internal controls to regulatory

frameworks, standards, or policies.

b) Policy Management: Lifecycle for policies (create, approve, publish), versioning,

distribution, and acknowledgement tracking.

c) Continuous Compliance Monitoring: Real-time or periodic control checks to see whether

controls are operating effectively.

d) Regulatory Change Management: Ability to update regulation or compliance

frameworks, track changes, and alert relevant stakeholders about compliance gap.

5.4. Risk and Compliance Management Module

5.4.1. Risk Management

a) Organisational and Process Structure: Ability to configure and maintain the organisational

hierarchy, maintain, and update process hierarchies and libraries, and fully customise risk

templates and process structures.

b) Risk Register and Controls:

• Capture and maintain risk registers across all divisions / business units

• Record and link risk number, objectives, risk descriptions, causes / contributing

factors, existing controls, control effectiveness ratings, and quarterly action plans.

• Support full moderation functionality for risk review and validation, online voting,

and control self-assessment features including rating of risk and controls, as well as

voting on risk readiness.

• Provide ability for risk owners and managers to update risks online via web access

(Lite/Open licences).

c) Key Indicators (KRIs, KPIs, KCIs):

• Create and maintain Key Risk Indicators and assign thresholds.

• Allow web-based capture of indicator values by responsible owners.

• Generate automated KRI reports and trend analysis.

RFQ/MICT/92/2025 | P a g e

• Provide ability for risk owners and managers to update risks online via web access

(Lite/Open licences).

d) Action Plans: Full action plan lifecycle support including:

• creation, assignment, due dates.

• reminders and progress tracking.

• status updates by relevant officials using web access.

e) Incident Reporting:

• Online incident capture functionality.

• Support linking incidents to related risks.

• Provide incident reporting and summaries for divisional and organisational levels.

f) Reporting and Dashboards:

• Provide risk reports including risk heatmaps, risk registers, control effectiveness

reports, and key risk indicator reports.

• Support export to Excel, PDF, or presentation-ready formats.

• Provide user-friendly dashboards for risk trends and risk status.

5.4.2. Compliance Management

Statutory Compliance Monitoring and Reporting:

a) Automated reporting on compliance status, gaps, and outstanding actions.

b) Aggregated reporting of checklist results.

c) Provide compliance dashboards for executives and committees.

5.5. User Access

a) Audit, Legal and Risk should have full administration rights to their specific modules.

/ KPI value capture, survey / checklist completion, participation in voting / assessments.

c) System should allow configuration of user permissions by role, unit, or responsibility.

5.6. Licensing Requirements

RFQ/MICT/92/2025 | P a g e

Item No.

Core Module 1

Risk Management 3

Compliance Management 2

Audit Module 4

5.7. Security

a) The protection of an organisation's systems and data is important. The bidder

should comply with industry standards and regulations such as POPIA and provide a

robust security framework along with effective risk management and mitigation

strategies.

encrypting data both in transit and at rest.

c) Use secure protocols like HTTPS, SSL/TLS, and VPNs to protect data during transmission.

to identify and address potential security gaps.

respond to security incidents promptly.

f) The solution should have role-based and permission-based access settings.

5.8. Training

a) User training

b) Audit and Risk Unit

c) Legal and Compliance Unit

d) First-line ICT support team

e) Deliver training materials such as manuals, quick-reference guides, and online help.

5.9. Support and Maintenance

a) The service will be available with a guaranteed uptime of 99.9% each calendar month,

excluding scheduled maintenance. This ensures that the integrated system remains

operational and accessible for the vast majority of the service period.

RFQ/MICT/92/2025 | P a g e

services and the resolution of support incidents.

hours.

provide reasonable turnaround times for after-hours incident resolution.

project, including a direct or central point of contact for logging, and managing

incidents.

5.10. Hosting Requirements

a) The cloud architecture.

b) Cloud service model.

5.11. Data Migration

The Service Provider shall be responsible for all data migration activities during system

implementation and all data handover activities at the end of the contract period. The

requirements are as follows:

a) The Service Provider shall be fully responsible for the end-to-end data migration from MICT

SETA’s existing data sources into the new GRC solution.

migrated data to support a smooth transition to the automated GRC system.

c) At the end of the contract period, termination, or non-renewal of services, the service

provider shall ensure a complete, secure, and verifiable handover of all MICT SETA data

stored, processed, or generated within the GRC solution.

limited to:

• Structured and unstructured data;

• Metadata;

• System logs and activity records;

• Audit trails;

RFQ/MICT/92/2025 | P a g e

• Configuration settings, templates, and system structures; and

• Any other information classified as MICT SETA intellectual property.

6. PROJECT DURATION

a) The estimated duration for the GRC solution is twelve (12) months, commencing from the

project initiation date. The project may be divided into several key phases, each with

specific deliverables and milestones to ensure smooth progress and timely completion

according to the terms of reference of the MICT SETA, and the successful bidder’s

proposal and project plan.

b) The data being shared with the successful bidder remains the Intellectual Property (IP) of

MICT SETA. Under no circumstances, the successful bidder will be allowed to disclose off

such information without prior written permission of MICT SETA.

all IP of MICT SETA and destroy any personal information obtained as part of the services

included in this ToR.

RFQ/MICT/92/2025 | P a g e

7. PRICING SCHEDULE

Name of bidder: _____________________________ RFQ number: __________________

Closing date: _______________________________

RFQ shall remain valid for acceptance for a period of 90 days counted from the closing date.

Bidders to provide further cost breakdown where necessary under each line item, and sub-total and the overall RFQ

price (Total) should be included. The below table is for illustration only:

No. Description Frequency Unit price Total price

(Once-off, (Excl. VAT)

Monthly)

1. Core Module Once-off R R

2. Risk Management Once-off R R

3. Compliance Management Once-off R R

4. Audit management Once-off R R

5. Implementation Roadmap Once-off R R

6. Training Once-off R R

7. Reporting and Close-Out Once-off R R

8. Support and Maintenance Monthly R R

Sub-Total R

VAT @ 15% R

GRAND TOTAL R

Complete below:

1. Delivery Address: MICT SETA Head office

Level 3 West wing, Gallagher House

19 Richards Drive, Halfway House

Midrand

2. Indicate Delivery period after order receipt...................

3. Is delivery period fixed? Yes/No

4. Is the price(s) fixed? Yes/No

5. Is the quote strictly to specification? Yes/No

I/We, the undersigned, agree that this bidding price shall remain binding on me/us and open for

acceptance for the period stipulated above.

Authorised Company Representative: _______________________________________________________

Capacity under which this quote is signed: __________________________________________________

Signature: __________________________________________________________________________________

Date: ______________________________________________________________________________________

RFQ/MICT/92/2025 | P a g e

8. EVALUATION CRITERIA

MICT SETA complies with the provisions of the Public Finance Management Act, Act No.

as amended; Treasury Regulations of 2005; the Preferential Procurement Policy Framework Act,

Act No. ; Preferential Procurement Regulations of 2022; and the MICT SETA Supply Chain

Management (SCM) Policy.

Price & Specific Goals.

(a) Compulsory Briefing Session

The virtual Briefing Session is a compulsory part of the acquisition process for all participating

Service Providers. Non-attendance of thereof will automatically disqualify any prospective

bidder.

Proof of compliance to (a)

Attendance register of the compulsory briefing session held on Microsoft Teams. Representatives

representative, and contact details on Microsoft Teams chat.

(b) OEM/ OSM Accreditation

be a letter from the OEM/ OSM that authorises the distributor to distribute the solution and

authorise resellers.

Proof of compliance to (b)

accreditation by the OEM / OSM or letter from the OEM / OSM that authorises the distributor to

distribute the GRC solution and authorise resellers and a letter from the distributor that authorises

(c) Bidders’ Resources Certification

include Technical Lead and Project Management resources with the following certifications:

RFQ/MICT/92/2025 | P a g e

Proof of compliance to (c)

o Project Manager – certified with any of the following certifications: PMP/ Prince 2/ CAPM/

IPMA/ APM PMQ. Expired certificates will not be considered.

o Technical Lead – Relevant technical certification of the proposed GRC System.

NOTE: Bidders should clearly indicate on their bids the Project Manager and the Technical Lead.

MICT SETA will not consider bids not clearly indicating the Project Manager and Technical Lead.

8.2. STAGE 1(B): TECHNICAL/ FUNCTIONALITY EVALUATION CRITERIA

considered for functionality evaluation. Bids submitted will be evaluated on technical/

functionality out of a maximum of 100 points. A threshold of 70 out of the 100 points has been

set.

Note: All bidders achieving less than the set threshold of 70 points will be declared non-

responsive. Assessment of evaluation of the technical/ functionality criteria will be based on the

table below:

Note: Bidders that do not meet the requirements of set technical/ functionality criteria will be

eliminated from further evaluation process.

FUNCTIONAL CRITERIA

NO. CATEGORY FUNCTIONAL EVALUATION CRITERIA MAX

POINTS

PROPOSAL of the proposed solution as detailed in the bid and summarised

minimum requirements, detailing how the bidder intends to

implement the following:

o Core GRC Functionality;

o Audit Module;

o Legal Module;

RFQ/MICT/92/2025 | P a g e

o Risk Module;

o Security; and

o Support and Maintenance.

Points on solution proposal will be allocated as follows [30]:

• Proposal that meets or exceeds all six (6) components of the

minimum requirements of the proposed solution = 30 points

• Proposal that does not meet all components of the minimum

requirements of the proposed solution/ not detailed = 0 points

compliance with the minimum requirements will be declared non-responsive.

AND supplied, implemented, configured, maintained, and supported a

LETTERS the services have been provided to determine the experience. The

the supplied, implemented, configured, maintained, and

supported a GRC System.

official of the bidder’s client, i.e. CEO, CFO, CIO, IT Manager, or

company, contact person, position, contact number, e-mail

address, project description, project outcome, and dates, i.e. start

and end date of the project.

letterhead, with contact details, project description and dated.

Award letters or purchase orders will not be accepted.

Points on reference letters indicate that they supplied,

implemented, configured, maintained, and supported a GRC

System in the past will be allocated as follows [10]:

• Five (05) or more signed reference letters from different clients,

with five (05) years’ experience or more = 10 points

RFQ/MICT/92/2025 | P a g e

• Four (04) signed reference letters from different clients, with five

(05) years’ experience or more = 08 points

• Three (03) signed reference letters from different clients, with

five (05) years’ experience or more = 06 points

• Two (02) signed reference letters from different clients, with five

(05) years’ experience or more = 04 points

• One (01) signed reference letter from a client, with five (05)

years’ experience or more = 02 points

• No signed reference letter = 0 points

NOTE: Reference lists or award letters will not be considered for point allocation.

letters of the main bidder. MICT SETA reserves the right to contact references prior

to award. Bidders with no track record of rendering similar services will be

deemed non-responsive.

IMPLEMENTA per the ToR in executing the project and support services. The

TION PLAN Project Implementation Plan and Methodology should include the

following:

o Project Plan activities clearly defined with timelines.

o Resources to be allocated for the project.

o Processes for onboarding of users.

Points on the implementation plan will be allocated as follows [10]:

• Detailed implementation plan that meets all three (03)

requirements = 10 points

• Detailed implementation plan that meets only two (02)

requirements = 05 points

• Detailed implementation plan that meets only one (01)

requirement = 03 points

• No implementation plan submitted/ implementation plan that

is not detailed = 0 points

PLAN audiences:

o User training;

RFQ/MICT/92/2025 | P a g e

o Audit Unit;

o Risk and Compliance Unit;

o Legal and Compliance Unit; and

o First-line ICT support team.

reference guides, and online help.

Points on training plan will be allocated as follows [05]:

• Training Plan that includes all five (05) elements = 05 points

• Training Plan that includes four (04) elements = 04 points

• Training Plan that includes three (03) elements = 03 points

• Training Plan that includes two (02) elements = 02 points

• Training Plan that includes one (01) element = 01 point

• No Training Plan submitted = 0 points

brief/summary).

OF THE the experience in managing the GRC system implementation,

PROJECT support, and maintenance or similar services/ projects. CV/ profile

MANAGER should clearly indicate the projects, project duration, and names

of clients.

Points on submission of profile/ CV of the PM will be allocated as

follows [05]:

• More than 05 years’ project management experience in

managing the GRC system implementation, support, and

maintenance or similar services/ projects = 05 points

• 04 to 05 years’ project management experience in managing

GRC system implementation, support, and maintenance, or

similar services/ projects = 03 points

• 02 to 03 years’ project management experience in managing

GRC system implementation, support, and maintenance, or

similar services/ projects = 01 point

RFQ/MICT/92/2025 | P a g e

• Less than 02 years’ project management experience in

managing the GRC system implementation, support, and

maintenance, or similar services/ projects = 0 points

indicating the details of the Project Manager will not be evaluated.

OF THE experience in leading the implementation of the GRC system or

TECHNICAL ICT systems. CV/ profile should clearly indicate the projects, project

LEAD duration, and names of clients.

Points on profile/ CV of the Technical Lead will be allocated as

follows [05]:

• More than 05 years’ experience in leading the implementation

of the GRC system or ICT systems = 05 points

• 04 to 05 years’ experience in leading the implementation of the

GRC system or ICT systems = 03 points

• 02 to 03 years’ experience in leading the implementation of the

GRC system or ICT systems = 01 point

• Less than 02 years’ experience in leading the implementation

of the GRC system or ICT systems = 0 points

indicating the details of the Technical Lead will not be evaluated.

N PLAN of the proposed GRC System into ILMS and ERP. The plan should

cater for the following at a minimum:

• Integration Architecture and Design

o Proposed architecture diagram (system interactions, data

flow).

o Middleware, APIs, and connectors to be used.

o Data mapping (what data is shared, field mapping between

systems).

o Authentication and user identity management approach

(e.g., SSO, Active Directory).

• Data Management

o Data formats and standards.

RFQ/MICT/92/2025 | P a g e

o Frequency of data exchange (real-time, batch,

scheduled).

o Data validation rules.

o Error handling and reconciliation processes.

• Security and Compliance

o Data protection measures (encryption in transit and at

rest).

o Access controls and user permissions.

o Compliance with POPIA, ISO standards, and government

IT security policies.

o Audit trail and logging requirements.

• Testing and Validation

o Unit testing (individual components).

o System integration testing (end-to-end process).

o User Acceptance Testing (UAT) by MICT SETA stakeholders.

o Performance and stress testing.

Points on submission of detailed integration plan will be allocated

as follows [25]:

• A detailed integration plan which covers all four (04) elements

= 25 points

• A detailed integration plan which covers only three (03)

elements = 18 points

• A detailed integration plan which covers only two (02)

elements = 12 points

• A detailed integration plan which covers only one (01)

elements = 06 points.

A detailed integration plan which covers none of the six (0)

elements = 0 points.

A detailed integration plan for the integration of the proposed GRC System into

detail. Non-compliance with the minimum requirements will be declared non-

responsive.

RFQ/MICT/92/2025 | P a g e

MIGRATION migration activities during system implementation and all data

PLAN handover activities at the end of the contract period. The following

o Data Migration Methodology and Approach;

o Data Quality Management and Validation;

o Risk Management and Business Continuity;

o Security, Privacy and Compliance; and

o Testing Strategy and Acceptance Management.

Points allocation of the data migration plan will be allocated as

follows [10]:

• A data migration plan which covers all five (05) of the elements

= 10 points

• A data migration plan which covers only four (04) of the

elements = 08 points

• A data migration plan which covers only three (03) of the

elements = 06 points

• A data migration plan which covers only two (02) of the

elements = 04 points

• A data migration plan which covers only one (01) of the

elements = 02 points.

• A data migration plan which covers none of the (0) elements =

0 points.

brief/summary).

TOTAL 100

MINIMUM THRESHOLD 70

Note: Bidders that do not meet the requirements of set technical/ functionality criteria will be

eliminated from further evaluation process.

RFQ/MICT/92/2025 | P a g e

8.3. STAGE 2: PRICE AND SPECIFIC GOALS

Only bidders or bid proposals received that have met the requirements of set technical/

functionality evaluation criteria will qualify for further evaluation on Price and Specific Goals

according to the 80/20 preference point system in terms of the Preferential Procurement

Regulations 2022, where 80 points will be for Price and 20 points will be for Specific Goals. Bid will

be awarded to the bidder scoring the highest points.

Specific Goal to be evaluated out of 20 Points:

Criteria Points

Enterprise which is at least 51% owned by historically disadvantaged 10

persons.

Enterprise which is at least 51% owned by historically disadvantaged 05

women.

Enterprise which is at least 51% owned by historically disadvantaged youth. 05

Total 20

** Enterprises that are not owned by historically disadvantaged persons will be allocated 0 points.

• Certified ID copies of the company’s directors as per the CIPC documents. (Certified copies

• CIPC Documents and/or share certificate (for companies with more than one (01) Director).

claim points for specific goals, will be interpreted to mean that preference points for specific goals are not

claimed

RFQ/MICT/92/2025 | P a g e

SBD 4

BIDDER’S DISCLOSURE

1. PURPOSE OF THE FORM

Any person (natural or juristic) may make an offer or offers in terms of this invitation to bid. In

line with the principles of transparency, accountability, impartiality, and ethics as enshrined

in the Constitution of the Republic of South Africa and further expressed in various pieces of

Where a person/s are listed in the Register for Tender Defaulters and / or the List of Restricted

Suppliers, that person will automatically be disqualified from the bid process.

2. Bidder’s declaration

2.1 Is the bidder, or any of its directors / trustees / shareholders / members / partners or any

person having a controlling interest1 in the enterprise,

employed by the state? YES/NO

2.1.1 If so, furnish particulars of the names, individual identity numbers, and, if applicable, state

employee numbers of sole proprietor/ directors / trustees / shareholders / members/

partners or any person having a controlling interest in the enterprise, in table below.

Full Name Identity Number Name of State institution

2.1.2. Do you, or any person connected with the bidder, have a relationship with any person

who is employed by the procuring institution? YES/NO

2.2.1 If so, furnish particulars:

................................................................................................

................................................................................................

1 the power, by one person or a group of persons holding the majority of the equity of an enterprise,

alternatively, the person/s having the deciding vote or power to influence or to direct the course and

decisions of the enterprise.

RFQ/MICT/92/2025 | P a g e

2.3 Does the bidder or any of its directors / trustees / shareholders / members / partners or

any person having a controlling interest in the enterprise have any interest in any other

related enterprise whether or not they are bidding for this contract? YES/NO

2.3.1 If so, furnish particulars:

........................................................................................

........................................................................................