Provision of mimecast email security services (2,000 mailbox licences) for 36 months – ARC/10/09/2026

Closing date: 06 October 2026 at 11:00 am. Tender documents available for purchase from 04 September 2026. No briefing session or site visit is stated.

Bidding procedure enquiries: Fisokuhle Dlamini, PURCO SA Procurement Officer, email [email protected], tel 011 545 0940 (also listed as 011 545 0965). Technical enquiries: Ms Elelwani Muhanelwa, ARC Supply Chain Management, email [email protected], tel 012 310 2509. Technical enquiries must be submitted in writing via the PURCO SA website under ARC/10/09/2026; only bidders who purchased the bid document receive responses. No other form of technical correspondence is accepted.

Submission is electronic only via the PURCO SA website at https://purcosa.co.za (log in with the account that purchased the document, go to 'My purchased tenders' and click 'Submit bid'). No physical, email or fax submissions are accepted. Late submissions are rejected. Draft submissions are not accepted; only final submissions are evaluated. The tender document must be purchased at a non-refundable fee of R1,150.00 (VAT included) from 04 September 2026. Bidders must submit the completed bid document on official company letterhead with detailed costing. All SBD forms must be completed and signed. The master bid document must be initialled, completed and signed in full. A resolution letter authorising the signatory must be submitted. For joint ventures/consortia, a signed and dated JV agreement must be submitted, indicating responsibilities and the lead partner. Proposals must remain valid for 180 days after submission. No interlineations, erasures or overwriting unless corrections are initialled by the signatory. Misrepresentation of facts leads to disqualification and contract cancellation.

All SBD (Standard Bidding Documents) must be completed and signed. The bidder must submit a signed and dated undertaking on company letterhead. Completed SBD 3.3 (Pricing Schedule – Firm Prices) must be submitted with the Excel Pricing Schedule (Annexure 1). Signed and dated Joint Venture Agreement if applicable. Resolution letter authorising the signatory must be submitted. Valid SARS Tax PIN, current CSD report, valid B-BBEE certificate or sworn affidavit, and OEM accreditation letter are also required.

Evaluation is in four phases; bidders must pass each to proceed. Phase 1 (Administrative Compliance): valid SARS Tax PIN, current CSD report showing tax compliant status, all SBD forms completed and signed, master bid document initialled and signed, valid B-BBEE certificate or sworn affidavit, resolution letter, and signed JV/sub-contracting agreement if applicable. Phase 2 (Mandatory Requirements): bidder must be an authorised Mimecast implementation partner with a valid OEM accreditation letter, and must submit a signed undertaking on company letterhead confirming understanding of the scope items (premium protection SKU, Engage professional, Advanced OEM support). Failure to meet any mandatory requirement disqualifies the bid. Phase 3 (Functionality): minimum score of 65% required to proceed; bids below this are disqualified and not evaluated further. Functionality criteria (total 100 points): Company Experience (50 points) – minimum three reference letters from clients for Mimecast services rendered in the last five years; references must be on company letterhead and include contact person, telephone/email, duration (start and end dates), description of service, and project value; missing any element means the reference is not accepted; completion letters/certificates, appointment/award letters and purchase orders are not accepted as references. Experience & Capacity (30 points) – CVs of Project Lead/Service Delivery, Account Manager and three Engineers with proven Mimecast implementation and administration experience; points scale from 1 (no relevant CV) to 5 (all five CVs submitted). Service Delivery & Support Plan (20 points) – documented support model, SLA commitments, escalation procedures, and service/account management approach; points scale from 1 (no documentation) to 5 (comprehensive model with defined SLAs, formal escalation, dedicated management, and 24x7 support). Phase 4 (Price & Specific Goals): 80 points for price, 20 points for specific goals under the 80/20 preference point system. Specific goals: Ownership by HDIs 51%+ (6 points), Ownership by Women 51%+ (4 points), Ownership by Youth 51%+ (4 points), Ownership by PwD 51%+ (2 points), B-BBEE status level 1-4 (2 points), Suppliers located in rural areas (CSD report verifies address) (2 points). Bidders must indicate how they claim points for each specific goal.

The ARC requires a suitably qualified service provider for Mimecast email security services for 36 months. Key deliverables: provision of 2000 Mimecast mailbox licences; 24/7 monitoring and incident response; monthly reporting and SLA tracking; integration with ARC systems including Entra ID and SIEM; product line items (SKU) – premium protection, Engage professional, and Advanced OEM support. Expected outcomes: project implementation for deployment of licences; security policies, configuration baselines and best-practice recommendations; monthly SLA reviews and reports; email security incident investigation and reporting including support for major security events; quarterly security posture review report; adherence to audit and governance requirements. The solution must protect against phishing, malware, ransomware, business email compromise (BEC), impersonation attacks and other email-borne threats, and ensure proactive threat detection, risk reduction, compliance and secure communications.

The bidder must provide a documented Support Model, SLA commitments, escalation procedures, and service/account management approach for the proposed Mimecast solution. The support model must include operating procedures, service level agreement (SLA), escalation matrix and incident management process, service and account management approach, and support operating hours with 24x7 capability where applicable. The proposal must describe the methodology for execution, including breakdown of complete specification with associated costs. The ARC may request amplification of any unclear matter in writing; failure to supply may lead to rejection.

Company Experience (50 points): minimum three reference letters from clients where Mimecast services were rendered within the last five years. References must be signed by clients on company letterhead and include contact person, telephone/email, duration (start and end dates), description of service, and project value. Missing any element means the reference is not accepted. Points: 5 completed projects in 5 years = 5 points; 4 projects = 4 points; 3 projects = 3 points; 2 projects = 2 points; 1 project = 1 point. Completion letters/certificates, appointment/award letters and purchase orders are not accepted. ARC reserves the right to verify references. Experience & Capacity (30 points): CVs of Project Lead/Service Delivery, Account Manager and three Engineers with proven Mimecast implementation and administration experience. Points: no relevant CV = 1; Project Lead/Service Delivery only = 2; plus Account Manager and one Engineer = 3; plus two Engineers = 4; plus three Engineers = 5.

The service provider must adhere to audit and governance requirements. ARC reserves the right to conduct site inspections of the premises of the recommended service provider and/or its clients at any time. The solution must ensure compliance with applicable ICT governance, cybersecurity, data protection and audit requirements. Monthly SLA reviews and reports, quarterly security posture review reports, and email security incident investigation and reporting are required.

Bidders must complete the Excel Pricing Schedule (Annexure 1) and submit it with completed SBD 3.3 (Pricing Schedule – Firm Prices) under the Pricing Section on the Tender Box online system. Failure to submit SBD 3.3 with the pricing schedule leads to disqualification. Prices must be in South African Rand and inclusive of VAT. Prices must include all costs related to execution of services. No price changes allowed after tender submission, including subsequent VAT registration. Bid price must cover the full project duration including escalations. Tenderers must indicate the basis of charging, detail any outsourced services, and reflect service discounts offered throughout the contract. The contract is valid for 36 months from date of award.

Pricing must be submitted on the Excel Pricing Schedule (Annexure 1) together with completed SBD 3.3 (Pricing Schedule – Firm Prices); failure to submit both leads to disqualification. All prices in South African Rand and inclusive of VAT. Prices must include all costs related to execution of services. No price changes allowed after tender submission, including subsequent VAT registration. Bid price must cover the full project duration including escalations. Tenderers must indicate the basis of charging, detail any outsourced services, and reflect service discounts offered throughout the contract. Payment: ARC undertakes to pay valid claims within 30 days upon presentation of substantiated claim and required reports; no payment for outstanding work until submitted. PURCO SA service fee: 2% of the total value of each invoice issued by the supplier, payable to PURCO SA within 30 days of statement date; interest at 2% per month on overdue amounts. Monthly sales report to PURCO SA by the 10th working day of each month; discrepancies must be investigated within 7 working days. Bidders must be in good financial standing with no negative credit listings.

Phase 1 administrative compliance requires: valid current SARS Tax PIN; current Central Supplier Database (CSD) report showing tax compliant status; all SBD forms completed and signed; master bid document initialled and signed in full; valid B-BBEE certificate or sworn affidavit (for EMEs and QSEs); resolution letter authorising signatory; signed JV/sub-contracting agreement if applicable. Tax compliance: bidders must be tax compliant for the entire contract term; those making taxable supplies over R1 million in any 12-month period must register as VAT vendors within one month of award; SARS Tax Status PIN or CSD number must be provided. Bidders must not be persons in the service of the state, nor companies/close corporations with directors/members in the service of the state. Sub-contracting: not allowed to sub-contract more than 25% of contract value to an enterprise without equal or higher B-BBEE status, unless the sub-contractor is an EME with capability. SBD 5 (National Industrial Participation Programme) must be signed and submitted; applies to contracts with imported content; successful bidders with contracts over R10 million must report to the DTI. SBD 4 (Declaration of Interest) discloses any state employment or relationships with procuring institution; false declarations lead to disqualification. SBD 9 (Certificate of Independent Bid Determination) certifies no collusion or price disclosure. SBD 7 (Contract Form) will be required from the successful bidder.

applicable, to both PURCO SA and the Member. PURCO SA shall thereafter invoice and collect the service

fee from the supplier based on the total invoice value, which is payable to PURCO SA within 30 days of the

date of the statement. Failure to pay the service fee will be in breach of this agreement and may result in

the termination of this agreement. The supplier will be liable for interest on all overdue accounts exceeding

30 days at a rate of 2% per month.

2.1.2 Monthly sales report

listings. In addition, bidders must be in good legal standing, with no current or pending legal actions or

disputes involving PURCO SA or any of its Members. Furthermore, in the event of any dispute or differing

interpretation between the Bid Document, the Letter of Award, and the Lease Agreement, the Bid

2.4 Terms of engagement

 The successful bidder shall not take more than three (3) months from date of Bid award unless

otherwise indicated and agreed between the successful Bidder and the ARC.

 The Service Provider shall be available for consultation with the ARC representative.

 The Service Provider shall manage as confidential all data, information and insights gained in execution

of work for the ARC.

 ARC retains the right to negotiate with the successful Bidder for partial execution of the proposal.

 ARC retains the right to enter into non-exclusive agreements with Service Providers that do not restrict

procurement of goods and services from other Service Providers.

 ARC retains the right to require the Service Provider to obtain permission in writing from the ARC prior to

the replacement of individuals proposed for execution of this Bid.

 Service Providers to accept professional liability for services rendered, including those rendered under

sub-contract to the service provider.

2.5 Bid documents

In exceptional circumstances, the ARC may solicit the Bidder’s consent to an extension of the period of

validity. The request and the responses thereto shall be made in writing.

2.14 Arc liability

a. The contractor and the DTI will determine the NIP obligation;

b. The contractor and the DTI will sign the NIP obligation agreement;

c. The contractor will submit a performance guarantee to the DTI;

d. The contractor will submit a business concept for consideration and

approval by the DTI;

e. Upon approval of the business concept by the DTI, the contractor will submit

detailed business plans outlining the business concepts;

f. The contractor will implement the business plans; and

g. The contractor will submit bi-annual progress reports on approved plans to

the DTI.

4.2 The NIP obligation agreement is between the DTI and the successful bidder

(contractor) and, therefore, does not involve the purchasing institution.

ARC reserves the right to conduct site inspections of the premises of the recommended service provider and/or its clients at any time. ARC may enter into non-exclusive agreements with service providers. Service providers must accept professional liability for services rendered, including sub-contracted work. For joint ventures/consortia, all documentation must be signed as per the proxy on the JV/consortium agreement. Sub-contracting is limited to 25% of contract value to an enterprise without equal or higher B-BBEE status, unless the sub-contractor is an EME with capability. Proposals must remain valid for 180 days; shorter validity may be rejected. Bidders must remain tax compliant for the entire contract term. ARC undertakes to pay valid claims within 30 days. POPIA compliance is required for processing personal information.

Bidders must submit the complete bid document with all additional required information. All SBD forms must be completed and signed. A resolution letter authorising the signatory must be submitted. For joint ventures/consortia, a signed and dated JV agreement must be submitted, indicating responsibilities and lead partner. The bidder must submit a signed and dated undertaking on company letterhead confirming understanding of the scope items (premium protection SKU, Engage professional, Advanced OEM support). Failure to meet any mandatory requirement disqualifies the bid. Bidders must not remove any page from the original tender document. The bid offer must be on official company letterhead with detailed costing. All pricing in South African Rand. No price adjustments after tender closure.

The proposal is evaluated under the 80/20 preference point system in line with the Preferential Procurement Policy Framework Act. Phase 3 (Functionality) has a minimum qualifying score of 65%; bids below this are disqualified and not evaluated further on price or B-BBEE. Functionality criteria (total 100 points): Company Experience (50 points) – reference letters; Experience & Capacity (30 points) – team CVs; Service Delivery & Support Plan (20 points) – support model, SLA, escalation, account management. Phase 4: 80 points for price, 20 points for specific goals. Specific goals: Ownership by HDIs 51%+ (6 points), Ownership by Women 51%+ (4 points), Ownership by Youth 51%+ (4 points), Ownership by PwD 51%+ (2 points), B-BBEE status level 1-4 (2 points), Suppliers located in rural areas (2 points, verified via CSD report). Bidders must indicate how they claim points for each specific goal.