Identity governance and administration (iga) solution with 3-Year support – electoral commission

The Electoral Commission requires an Identity Management and Access Governance (IGA) solution. The proposed solution must integrate with Microsoft Identity Manager (MIM). The bidder must include a detailed Implementation Approach that will take the first 3-6 months for implementation, with the rest on-site and on-demand support and maintenance.

{"briefingSession":"{"date":null,"time":null,"venue":"ion of capability and capacity","is_compulsory":false}"}

A non-compulsory briefing session will be held on a date and time to be published on the VotaQuotes platform, at the Electoral Commission National Office in Centurion.

{"name":"DR site","email":null,"phone":"0010575205","department":"Auction 0010575205","address":"the Electoral Commission tender box situated in the foyer of the Electoral"}

Returnable Documents: 14.4.3 Completed Appendix B: Pricing Schedule., 14.4.4 Completed Appendix B1: Implementation and Customization Pricing Schedule., 14.4.5 A minimum of one (1) CV of a senior resource, detailing product and consulting, experience, IGA expertise in general and qualifications as per Appendix D: CV, Failure to complete and submit this technical bid response sheet as part of the bid submission shall lead to disqualification.

The following supporting documents must be submitted as part of the written submission: experience, IGA expertise, qualifications as per Appendix D: CV, and the technical bid response sheet. Failure to submit these will lead to disqualification.

Bidders must submit all required documentation via the Votaquotes platform and deliver supporting documents before the closing date and time. Mandatory submissions include: Appendix A (Technical Bid Response Sheet), Appendix B (Pricing Schedule), Appendix B1 (Implementation and Customization Pricing Schedule), Appendix C (Reference Table with at least two contactable references), Appendix D (CV of at least one senior resource), and an OEM reseller authorization letter (or distributor authorization with OEM proof). Bidders must have at least 5 years' experience in providing, implementing, and supporting IGA solutions. The bidder must be authorized to sell the product. Failure to submit any required document will invalidate the bid. The IEC reserves the right to cancel the bid or not award it. Awarding is subject to due diligence audits and entering into a service level agreement (SLA).

The Electoral Commission seeks to acquire an Identity Governance and Administration (IGA)

solution to integrate with SAP Authentication, Active Directory, custom built security layer

called Global via REST Application Programme Interfaces (APIs), Microsoft Exchange,

Microsoft M365 and Azure AD (Entra ID) and its ICT business systems. The solution must be

accompanied by professional services that include defining and/or refining policies,

implementation, migration from current to new environments and change management. The

solution must also include a 3-years’ support and maintenance plan that allows the IEC to

access patches and software updates. The Electoral Commission also has a cold-failover

Disaster Recovery (DR) site, and an instance of the solution is also required at DR.

The Electoral Commission has invested extensively in ICT technologies, which provide a

platform to effectively support and enable its business processes and to meet its goal of

providing a free and fair election process in an open and transparent environment. The

Electoral Commission’s ICT Department intends to continue running a highly efficient and

stable ICT environment making full use of industry standards, best practices and disciplines

based upon stable and reliable technologies.

NB!! Bidders must place a bid on the Votaquotes (e-Procurement) system and then

provide all the required documentation before the due dates as specified in this

document and on the Votaquotes web site.

2 Background Information

With POPIA prioritizing and mandating data privacy, limiting and monitoring access to only

those that need it is not only a crucial security measure, but one that is becoming critical to

staying in compliance. It is expected that Identity Governance and Administration (IGA)

solution should not only help ensure that access to sensitive information like voters’ roll data is

strictly controlled, it should also enable the IEC to prove through reports that access to

sensitive information including employee records, voters’ details etc. is strictly controlled.

Identity and Access Management is currently handled across multiple software products. New

permanent employees joining the Electoral Commission are initiated into the environment

through SAP. Once new employees have been created successfully, the electronic identities

are then added to both the Electoral Commission’s Active Directory (AD) and a custom

2 | P a g e

Electoral Applications security layer called Global, through Microsoft Identity Manager (MIM),

access to systems is provided based on the user’s organizational profile. Management of the

Identity as well as Access Control from this point forward are handled separately in SAP,

Active Directory and Global.

Consultants and contractors are initiated through a separate application called Turnaround. A

similar process as with permanent employees above is then followed thereafter.

The Electoral Commission’s business is cyclical in the sense that during a major event like the

imminent Local Government Elections (LGE) 2026, the Electoral Commission hires a great

number of temporary employees in different capacities. It is important to manage the identities

being created for these people to ensure that they only access what they are hired for. When

they leave at the end of the elections, it is important that all their rights in terms of

authorizations and authentication are terminated as well. The same employee may be

employed in the future under a different role.

This bid seeks to acquire an Identity Governance and Administration (IGA) solution and

services to automate the activities to manage user access from cradle to grave and to ensure

that the IEC is compliant to its policies and other legislative requirements including the

Protection of Personal Information Act (POPIA).

3 Technical Specifications

The technical specification for the required solution is as specified below. It must be noted that

the technical specifications below are the minimum requirements; submissions will be

accepted only where it meets or surpasses the specification for the required solutions.

3.1 Functional Requirements

In order to assess where security risks are and how to counter them, full visibility of all users

and systems that make up the corporation is required. This includes employees, consultants,

contractors, systems and applications.

3.1.1 General Functional Requirements

The Electoral Commission seeks a solution that offers holistic management of all users and

systems involved across the organization including SAP, Active Directory, Microsoft 365 and

Azure AD (Entra ID) and custom-built Electoral Applications.

3 | P a g e

Access Governance should be automated and provide a proactive solution to the following:

3.1.1.1 Employees leaving the enterprise should have all access rights including

authorizations removed promptly.

3.1.1.2 Enterprise-wide transparency of access rights.

3.1.1.3 Implementation of the ‘Least privilege’ principle.

3.1.1.4 Monitoring anomalous combinations of accumulated access rights.

3.1.1.5 Control access to systems by the relevant authority through an approval mechanism.

3.1.1.6 Segregation of Duties (SoD) – role management to ensure that the player and referee

situation is avoided. The principle of SoD is based on shared responsibilities of a key

process that disperses the critical functions of that process to more than one person

or department.

The proposed solution should be automated and provide proactive solutions to the following:

3.1.1.7 Identity Life cycle management – maintain user’s identities, their relationships with

the organization and their attributes during the entire process from creation to

eventual archiving.

3.1.1.8 Access management – enabling users, or others acting on behalf of a user, to

request access rights through a business-friendly user interface. Also maintain the link

between identities and access rights to be able to tell who can access what and who

is responsible to maintain access right. This includes maintaining and curating the

entitlements catalogue to describe the types of accounts, roles, group memberships

and other entitlements.-.

3.1.1.9 Business Management – maintain rules that govern assignment and removal of

rights, providing visibility of access rights for selection in access requests, approval

processes, dependencies and incompatibilities between access rights.

3.1.1.10 Governance – requiring people like managers and auditors to review and certify

the access rights that users have on a periodic basis

4 | P a g e

3.1.1.11 Auditing – evaluate business rules and controls against the current state of

identities and access rights, providing means of generating alerts in case of

exceptions and allowing orderly remediation. This intelligence, detection and response

need to be in real-time.

3.1.1.12 Reporting and Analytics – provide a mechanism to report on and deliver

deeper insights into the data stored in the tool.

3.1.1.13 Implementation of the ‘Least privilege’ principle. This requires an

understanding of the organizational roles, their requirements and their designing

mechanism to ensure that they can accomplish their job by using least privilege

3.1.1.14 Segregation of duties (SoD) principle - is an internal control designed to

prevent error and fraud by ensuring that at least two individuals are responsible for the

separate parts of any task

3.1.1.15 Monitoring anomalous combinations of accumulated access rights.

3.1.1.16 User ID Creation/Modification/Deletion: Creation and Modification of Users

data automatically based on event and/or workflow or script

3.1.1.17 User ID Lock/Unlock based on event: Locking and Unlocking of Users manually

or automatically based on event or workflow

3.1.1.18 Mass Locking / Unlocking users and bulk changes – ability to lock users as a

batch, say the end of a major election event.

3.1.1.19 Availability of a large collection of recommended practices, use case blueprints

and “Quick Start” standardized deployments to assist in streamlining deployments

3.1.1.20 It is required that the solution should be able to learn from existing systems and

configurations to build access control profiles for different user groups, for example:

Role

1. Chairperson
2. Commissioner
3. Chief Electoral Officer
4. Deputy Chief Electoral Officer
5. Senior Manager
6. Provincial Electoral Officer

5 | P a g e

Role

7. Manager
8. Deputy Manager
9. Assistant Manager
10. Senior Administrative Officer
11. Administrative Officer
12. Assistant Administrative Officer
13. Senior Administrative Clerk
14. Administrative Clerk
15. Messenger
16. Housekeeper
17. Driver
18. Assistant Project Coordinator
19. Provincial Expansion Staff
20. Provincial Office Expansion Staff
21. Municipal Electoral Officer
22. Municipal Field Coordinator
23. Election Provincial Coordinator (EPC)
24. Intern
25. Regional Supervisor Assistant Manager
26. Regonal Supervisor Senior Administrative Officer
27. Outreach Project Coordinators
28. Parttime EPC
29. Assistant Administrative Clerk
30. Receptionist National Office
31. Deputy Municipal Electoral Officer
32. Cleaner
33. Provincial Conflict Resolution Coordinator
34. Municipal Area Coordinator
35. Data Capturer Special Votes Applications
36. Trainer
37. Municipal Outreach Coordinator

3.1.1.21 At the moment applications within the Electoral Commission support to an extent

centralised Identity Management through Global. The successful bidder will integrate

Global which supports REST APIs to the new solution to ensure centralized

management of access rights via the IGA solution. The Electoral Commission will also

accept a solution that replaces Global.

3.1.1.22 The specific questions that this project wants to find answers for are the

following:

3.1.1.22.1 Who has access?

3.1.1.22.2 What do they have access to?

6 | P a g e

3.1.1.22.3 What does that access secure?

3.1.1.22.4 Who approved that access?

3.1.1.22.5 When was the access granted?

3.1.1.22.6 Is the access necessary?

3.1.1.22.7 What is the business impact / Risk?

3.1.1.22.8 How is the access being used?

3.1.1.22.9 Was the access reviewed, and when was it reviewed?

3.1.1.22.10 For how long is the access required?

3.1.1.23 Changes to the system should be configuration based as opposed to code base.

As an example, a workflow change must be configuration based instead of having to

change the code on the solution.

3.1.2 Integration Requirements

The proposed solution must be able to fully and seamlessly integrate with existing Electoral

Commission systems and environments.

As an absolute minimum specification, it is required that the proposed system or solution

offers integration to the following using industry standard protocols:

3.1.2.1 Global – custom built security layer using REST APIs. The solution must also provide

REST APIs for Global to integrate with it. The Electoral Commission will accept a

solution that replaces Global.

3.1.2.2 Microsoft Identity Manager (MIM). The Electoral Commission will accept a solution

that replaces MIM in terms of integrating SAP and Active Directory.

3.1.2.3 Privileged Access Management (PAM) solution including M365

3.1.2.4 Microsoft .Net (ASP.Net Web Applications and Windows Services)

3.1.2.5 Microsoft Active Directory

3.1.2.6 Microsoft SQL Server

7 | P a g e

3.1.2.7 Microsoft Exchange

3.1.2.8 PowerBI Reporting Engine

3.1.2.9 SAP Portal and SAP ECC

3.1.2.10 Sap grc

3.1.2.11 Microsoft 365

3.1.2.12 Azure AD (Entra ID)

3.1.2.13 ManageEngine Service Desk Plus

3.1.2.14 About 30 – 50 bespoke applications. For the purposes of adjudication, bidders

should work on 30 applications which are .Net based.

3.1.2.15 Oracle database

3.1.3 Operating Environment

3.1.3.1 The bidder must propose an instance of the solution at Production site (National

Office) and an instance of the solution at Disaster Recovery (DR) site. The DR site is

a Cold-Failover facility of the Production site. Only one environment runs at any one

time.

3.1.3.2 The solution must be able to run on a VMWare VSphere v8 or later virtualized

environment and work within a Windows environment.

3.1.3.3 The solution must be able to accommodate in the region of 1500 to 2000 users.

3.1.3.4 The bidder must include the architecture of the proposed solution with their

submission. The architecture must also show a DR instance.

3.1.3.5 The proposed solution must accommodate internal Employees, Consultants,

Contractors, Systems, Applications, Service /System Accounts, and external users

such as Voters, Political Party Members and other 3rd party users.

8 | P a g e

3.1.3.6 The solution proposed must be complete. All aspects required to run the solution are

part of this proposal as per requirements above. The Commission will provide

infrastructure requirements including Server Hardware, Networks, Firewalls, etc.

3.1.3.7 The solution can be deployed on a Windows 2022 Server Environment or later.

3.1.3.8 The proposed solution must work on Endpoints (Desktops and Laptops) running

Windows 11 and later.

3.1.3.9 The Electoral Commission is also utilizing some Cloud applications including M365

and Azure Active Directory (AD). The bidder must describe how the solution caters for

this, focusing on M365 and Azure AD (Entra ID).

3.1.4 Regulatory Environment

3.1.4.1 The proposed solution must assist the Commission to meet the requirements of the

Protection of Personal Information (POPI) Act and European Global Data Protection

Regulation (GDPR). The bidder is to describe how the solution will assist the IEC to

achieve this.

3.1.5 Auditability

3.1.5.1 The proposed solution must ensure that the organization has the ability to effectively

govern authorization, certification and authentication. There must be an audit trail for

all additions, modifications and deletions. Non-reputable audit logs for all objects,

events and actions such as the following are kept:

3.1.5.1.1 Identities

3.1.5.1.2 Contexts

3.1.5.1.3 Accounts

3.1.5.1.4 Resources

3.1.5.1.5 Surveys

3.1.5.1.6 Resource Assignments

3.1.5.1.7 Orphan Objects

3.1.5.1.8 Account usage

3.1.5.1.9 Data Quality

9 | P a g e

3.1.5.1.10 Systems

3.1.5.2 The proposed system’s auditing engine must allow for customized reporting and

configurable dashboards, audit history reporting and audit exportable reports

3.1.5.3 The proposed system must provide an auditor a role on the system for independent

audit reporting

3.1.6 Governance

3.1.6.1 The proposed system must be configured to provide access governance to itself as a

connected system

3.1.6.2 The proposed system must be able to perform periodic attestation for identities or

accounts to review membership or assignments.

3.1.6.3 A manager or resource owner must be able to perform attestation surveys.

3.1.6.4 The proposed solution allows for the monitoring and reporting of anomalous

combinations of accumulated access rights.

3.1.6.5 The proposed system must be able to manage password policies and enforcement for

connected systems including:

3.1.6.5.1 Policy management

3.1.6.5.2 Policy enforcement

3.1.6.5.3 Enrolment

3.1.6.5.4 Authenticated and unauthenticated password resets

3.1.7 User Life-Cycle Management

3.1.7.1 The proposed solution must have tools to manage the end-to-end process of

requesting access through a business-friendly user interface by end-users with

approval workflows.

10 | P a g e

3.1.7.2 The proposed solution must allow for Self-Registration of Users based on workflow

verifying user identity from Backend systems.

3.1.7.3 The proposed solution must allow for the creation and modification of Users data

manually or automatically based on event and/or workflow or script. The IGA platform

must be able to read employee records from HR authoritative system (SAP HR).

3.1.7.4 The proposed solution must be able to on-board consultants and contractors as well.

Consultants and Contractors can be on-boarded with a term period. Consultants and

Contractors are captured on a web-based system that runs on SQL Server database.

The proposed solution has the flexibility to extend / reduce consultant / contractor’s

identity’s validity period with workflow approval processes

3.1.7.5 The proposed solution must be able to integrate to ManageEngine ServiceDesk Plus

(ITSM) to unify identity processes (like onboarding/offboarding, access requests) into

IT service workflows, streamlining service delivery, improving user experience with

single portals, automating provisioning, and strengthening security/compliance by

linking access decisions to formal service requests and audits, creating a holistic view

from initial request to fulfilled access

3.1.7.6 The proposed solution must provide user birth right access in relevant downstream

systems.

3.1.7.7 The proposed solution must be able to apply master data changes from authoritative

sources (SAP Authorizations) to all connected downstream systems. This allows for

automatic provisioning / de-provisioning to downstream systems based on some

workflow outcomes.

3.1.7.8 The proposed solution must be able to cater for the on-boarding of technical identities

(privileged identities used for system access or services access). These technical

identities are assigned to primary identities.

3.1.7.9 The proposed solution must be able to automatically transfer ownership for technical

identities whose primary owner has been terminated or disabled.

11 | P a g e

3.1.7.10 The proposed solution must be able to cater for the following identity changes

and correctly applies the relevant identity assignment properties and access, such as,

but not limited to:

3.1.7.10.1 Employee Job Role changes

3.1.7.10.2 Employee Leave of Absence

3.1.7.10.3 Employee Return from Leave

3.1.7.10.4 Maternity / Paternity Leave

3.1.7.10.5 Employee’s promotion

3.1.7.10.6 Employee’s lateral move from one province or department to another

3.1.7.11 The proposed solution must be able to revoke all system access on appropriate

date when:

3.1.7.11.1 An employee employment is terminated in, or no longer in SAP HR

3.1.7.11.2 Consultant / Contractor record reached end of contract date.

3.1.7.12 The proposed solution must be able to allow for the Locking and Unlocking of

Users manually or automatically based on event or workflow

3.1.7.13 The proposed solution must be able to support the implementation of the Least

Privilege Principle. The bidder is to describe how the solution implements this principle

3.1.7.14 The proposed solution must learn from the existing systems and configurations

and build profiles for the different user roles including MEOs, PEOs, EPCs etc.

3.1.7.15 The IEC hires a lot of temporary staff during major elections events. Some of

these people need to be provisioned on the network. The bidder is to describe how

the solution deals with bulk provisioning and de-provisioning of accounts.

3.1.7.16 The proposed solution must deal with orphaned accounts who by some reason

or the other have been terminated in SAP or Turnaround but not in AD and or

Exchange (for example). The integration to Turnaround will be via SOAP / REST web

services or SQL Server Database integration. The bidder is to describe how the

solution will deal with such accounts.

12 | P a g e

3.1.7.17 The proposed solution must support workflow escalation based on configurable

response time windows on a per workflow basis function

3.1.8 Access Management

3.1.8.1 The proposed system must provide a catalogue of user requestable services

3.1.8.2 The proposed solution must allow users to request additional access to approved

business systems from a service catalogue via a self-service portal

3.1.8.3 The proposed system must give managers and system owners the ability to approve,

reassign, delegate and deny access.

3.1.8.4 The proposed system must log all requests for auditing purposes including

Segregation of Duty violations. Audit logs are maintained and are available for

evaluation for all IGA processes.

3.1.8.5 The proposed system must allow managers and system owners additional access on

behalf of another identity to business applications on the service catalogue

3.1.8.6 The proposed solution must cater for delegation of authority (temporary assignment of

elevated access rights to subordinates / managers) based on business rules. The

delegation of authority is configured for a pre-defined period.

3.1.8.7 The proposed system must allow for Segregation of Duty (e.g. conflicting access

rights) validation to be performed for each request initiated by the request access

process including delegation of authority requests.

3.1.8.8 The proposed system must ensure that existing access can be transferred to another

user if necessary

3.1.8.9 The proposed solution must be able to disable, delete or archive all relevant accounts

based on some business rules.

3.1.8.10 The proposed solution must cater for the temporary access disablement for

users on extended leave. In such situations, the solution shall support the removal of

some access but not all, e.g. access to email shall remain.

13 | P a g e

3.1.8.11 The proposed system must be able to perform automated and manual

provisioning and de-provisioning tasks.

3.1.9 Business Management

3.1.9.1 The proposed system must allow for the definition and enforcement of context

assignments (policies used for identities in the same business situation) and

Segregation of Duty policies.

3.1.9.2 The proposed system must allow for the adjustment of roles and maintenance of

policies as the need arises.

3.1.9.3 The proposed system must allow for application of policies to identities and the

provisioning of identity based on the assigned role.

3.1.9.4 The proposed solution must allow for the monitoring and reporting of anomalous

combinations of accumulated access rights.

3.1.9.5 The proposed system must allow for the evaluation of policy conformance upon

identity changes and reports on violations.

3.1.10 Identity Security Breach

3.1.10.1 The proposed system must allow for an authorised user to instantly suspend all

accounts associated with an identity and also allows for the authorised user to

reactivate the suspended identity (and all relevant accounts) with workflow approvals.

3.1.10.2 The proposed system must provide audited trail for emergency lockout capability

3.1.10.3 The proposed solution must provide an Application Programme Interface (API)

for integration into a FortiSIEM including a SIEM event-based lockout capability.

3.1.11 Reports

3.1.11.1 The proposed solution must support out of the box audit reports. The bidder is to

list such supported reports.

3.1.11.2 The proposed solution must support scheduled report generation.

14 | P a g e

3.1.11.3 The proposed solution must provide a built-in query tool for ad-hoc reporting.

3.1.11.4 The proposed solution must produce a report detailing the following for any

resource

3.1.11.4.1 Who has access?

3.1.11.4.2 what does that access secure?

3.1.11.4.3 Who approved that access?

3.1.11.4.4 When was the access granted?

3.1.11.4.5 How is the access being used?

3.1.11.5 The proposed solution must produce reports of active users that are not

accessing systems (potential users that could have left the organization)

3.1.11.6 The proposed solution must produce reports of accounts without owners

3.1.11.7 The proposed solution must produce reports as to who is assigned what roles

and vice versa at any point of time

3.1.11.8 The bidder must indicate the reporting engines supported by the IGA solution being

proposed.

3.1.12 Implementation Services

3.1.12.1 The bidder must include services of documenting/updating policies and

standards, assigning ownership, and mapping policies to key business areas,

objectives and controls.

3.1.12.2 The IEC currently does not have an integrated solution. However, there are bits

and pieces of information everywhere. The services to be provided must include an in-

depth analysis of the current environment and migration from current to the new

proposed environment. The bidder must state the name of the tool if a tool will be

used for migration.

15 | P a g e

3.1.12.3 The bidder must include a detailed Implementation Approach that will take the

Commission from where we are currently (new beginning) to the new environment

with a list of deliverables. This includes the following:

3.1.12.3.1 an ideal project team’s (bidder) composition, skills and organization

including the time estimates of the required time for each member such as

full time / part time (staffing plan).

3.1.12.3.2 Detailed Project Plan.

3.1.12.4 The bidder must include a Quality Assurance plan that will be followed in the

project implementation.

3.1.12.5 The bidder must include a change management plan that will assist the IEC to

transition from the current environment to the new IGA environment.

3.1.12.6 It is envisaged that the project will run over a period of 8-9 months starting in

February 2027. The first 3 – 6 months are for implementation, and the rest will be on-

site and on demand Support and Maintenance one member of the team. There should

also be OEM/Systems Integration (SI) Support, whichever is applicable during the

support period for 1st, 2nd and 3rd years

3.1.12.7 The bidder must include a Risk Management plan including a list of typical risks

for a project of this nature and typical mitigation interventions.

3.1.12.8 The bidder must include methods to be used to formulate, execute and evaluate

a comprehensive test plan to ensure that all development is complete and functional.

4 Planning Assumptions

The Electoral Commission has made the following assumptions:

4.1 The Electoral Commission will provide technical resources for all IEC’s designated work

including setup and configuration of own systems and databases.

4.2 Wherever the need arises the successful bidder shall do initial equipment configuration

of operating systems and environmental specific requirements.

4.3 The delivery of the software licenses and implementation services required must be

completed within the days as stipulated in the delivery and implementation schedule

16 | P a g e

below

4.4 The bidder’s change control management process must be flexible enough to align with

the Electoral Commission’s change management processes.

4.5 The recommended service provider shall provide all relevant details needed to ensure

successful operations capability within the organization.

5 General Auction Conditions

The following standard auction conditions must be adhered to and complied with, failing of

which the bid will be disqualified.

5.1 Bidders must place bids online on the Electoral Commission’s eProcurement website by

not later than the stipulated closing date and time on the auction.

5.2 Bidders must complete and submit Appendix A: Technical Bid Response Sheet to

demonstrate compliance with the technical bid requirements.

5.3 The bidder must provide a technical description of the solution being proposed including

the architecture and how the solution will work, including the product codes, description,

licensing framework, server and client components details, data sheets etc. The

description should include elaborations as to how the solution meets the requirements in

Section 3 (Technical Requirements) above including how the solution addresses POPIA,

Least Privilege Principle, Segregation of Duty, bulk provisioning and de-provisioning,

orphaned accounts, Customer Identity and Access Management (report), migration

approach including tools, implementation approach including a project plan, Staffing

Plan, Risk Management approach, Test and Quality Assurance approach, and Change

management approach.

17 | P a g e

5.4 The bidder must be authorized to sell the product supplied.

5.5 An OEM letter of proof of the reseller agreement/authorization must accompany the

written documentation for this bid

5.6 Should the reseller authorization be from a distributor, then a proof of authorization

authorizing the distributor to resell and/or to authorize others by the OEM must be

submitted together with the reseller authorization from the distributor.

5.7 The bidder must provide at least three (3) references of past services of a similar nature

(supply and implementation of an IGA solution) that the bidder provided or was involved

in. Reference details must include the following: customer name, contact person, contact

details (telephone, email, physical address) and service description. The bidder must use

Appendix C: Reference Table as a guideline for references and should include the

following:

5.7.1 Similar product as IGA product.

5.7.2 Similar service as the supply of IGA services as per technical specification

(section 3)

5.7.3 Service size in terms of the number of users.

5.7.4 Service size in terms of the implementation duration.

5.7.5 Similar services are those services, which include supply of IGA services as per

the technical requirement

5.8 Bidder must indicate the level of experience in providing and implementing IGA

solutions. The Electoral Commission prefers to work with bidders that have at least five

(5) years’ experience in providing, implementing and supporting IGA solutions. Bidders

must include a profile or a letter on a letterhead detailing their work with IGA solutions.

5.9 Bidders must have the technical resources required to deliver and support these

services. This includes an ideal project team’s (Contractor) composition, skills and

organization. The submission must also include the time estimates for each member

such as full time / part time (a staffing plan). A minimum of one (1) CV of a senior

resource, detailing product and consulting experience, IGA expertise in general and

18 | P a g e

qualifications, must be submitted together with the bid before closing date and time. The

bidder must use Appendix D: CV Guideline as guideline.

5.10 Awarding of the auction to any successful bidder shall be subject to the Electoral

Commission’s due diligence audit requirements, where applicable.

5.11 No payment shall be made until full and final delivery has taken place and the product

has been confirmed and delivered in accordance with the specifications.

5.12 Delivery of the required product shall only be accepted by the Electoral Commission on

the basis of presentation of the service provider’s own delivery note. Such notes shall not

be substituted by another service provider’s delivery notes.

5.13 The Electoral Commission reserves the right and discretion to cancel and not award this

bid based on any reason including operational or financial.

5.14 Awarding the bid to a successful bidder is subject to the bidder entering into a service

level agreement (SLA) with the Electoral Commission that will formalize and regulate the

final deliverables and associated processes and procedures.

The bidder must include a detailed Implementation Approach, a Quality Assurance plan, a change management plan, a Risk Management plan, and describe the architecture and how the solution will work, including product codes, description, migration approach, implementation approach with project plan, staffing plan, test and QA approach, and change management approach.

Bidders must provide reference details including customer name, contact person, and contact details for similar IGA services. Bidders must have at least five years' experience in providing, implementing, and supporting IGA solutions, and must submit profiles or letters on letterhead detailing their work with IGA solutions. Technical resources and qualifications must be submitted before closing date and time.

The following quality control conditions must be adhered to and complied with, failing which

the bid may be disqualified.

6.1 The bidder takes responsibility for the completeness and quality of their bid submission.

6.2 The bidder must undertake and warrant that the switches hardware is new, in good

condition and in line with the tender specifications.

6.3 The bidder will have the primary responsibility of ensuring that the proposed equipment

complies with the required specification in terms of functionality and technical

specification including quantity and quality.

6.4 The Electoral Commission may also call on bidders to make presentations in order for

the Electoral Commission to ensure full compliance with all its requirements and as part

of the bid evaluation process prior to the conclusion of the adjudication of the bid. Any

such request for presentations shall only be for clarification purposes in support of

mandatory requirements that must be adhered to as part of the written submission

19 | P a g e

requirements of this bid. Failure to submit mandatory requirements shall not be rectified

by the call for presentations. Any restrictions or conditions associated with any elements

of the service offering/s must be detailed. The Electoral Commission reserves the right to

reject conditions which are considered unfavourable to its business or unacceptable.

6.5 The bidder and/or OEM must provide the associated support and maintenance for the

duration of the warranty period. The support and maintenance must include all services

as per product code.

6.6 The submission of a bid implies acceptance of the terms specified in the provisions laid

down in the bid specifications, the procurement and, where applicable, additional

documents.

6.7 Bidders are expected to examine carefully and respect all instructions and standard

formats contained in these specifications.

6.8 A bid that does not contain all the required information and documentation will be

disqualified.

6.9 The Electoral Commission will issue an official purchase order to the successful bidder

before any services can be delivered.

6.10 Awarding of the bid to the successful bidder will be subject to the Electoral Commission’s

due diligence audit requirements, where applicable.

6.11 Although the Electoral Commission will only deal with the principal service provider, if a

bidder plans to sub-contract any of the services in this bid, they are required to attach

copies of sub-contracting agreements in their bid response documentation. The bidder

must also familiarize themselves with Supply Chain Management (SCM) regulations with

respect to subcontracting.

6.12 Notwithstanding any shortcomings in these specifications, service providers must ensure

that the proposed solution will form a workable and complete solution.

6.13 The Electoral Commission reserves the right and discretion to amend the quantities or

cancel or not award this bid based on any reason including operational or financial

requirements.

20 | P a g e

7 Supplier Performance

7.1 Contracting of any service provider to render goods and/or services to the Electoral

Commission are subject to the fulfilment of the Electoral Commission’s due diligence

audit requirements.

7.2 An essential component of the Electoral Commission’s due diligence audit requirements

may involve site visits to potential suppliers/contractors as well as inspection of various

key documents underpinning the establishment of the companies involved in bids of the

Electoral Commission. This also includes confirmation of capability and capacity

requirements to execute the services specified in such bids.

7.3 Upon notification of the Electoral Commission’s intention to award a contract, the

successful bidder may be required to enter into a service level agreement (SLA/contract)

with the Electoral Commission.

7.4 The purpose of the SLA (if applicable other than what the Electoral Commission’s

standard purchase orders provide for) is to set performance criteria within the key

requirements of this request for quotation, namely quantity, quality, and delivery.

7.5 The SLA may contain elements such as supplier progress milestones, delivery

schedules, quality checkpoints and invoicing procedures.

7.6 The Electoral Commission reserves the right to reject any services delivered not

conforming to the bid specification.

7.7 Where previously agreed delivery schedules are not met by a supplier, the Electoral

Commission shall have the right to appoint an alternative supplier to make good the

shortfall in supply. Any additional costs incurred by the Electoral Commission in

obtaining such corrective services or products from another source will be for the

account of the defaulting supplier.

8 Pricing Requirements

Completion of the detailed pricing schedule by responding to each item is compulsory. Failure

to complete and submit this detailed pricing schedule as part of the bid submission shall lead

to disqualification.

21 | P a g e

8.1 The total bid price must be submitted online on the eProcurement (Votaquotes) portal.

8.2 The total bid price must be submitted online on the eProcurement (Votaquotes) portal.

The bidder must complete and submit Appendix B: Pricing Schedule. The bid price on

the Appendix B: Pricing Schedule must be the same as the bid price submitted online. If

there is a discrepancy between the Pricing Schedule bid price and the online submitted

bid price, the online submitted bid price will be used for adjudication.

8.3 The bidder must also complete and submit Appendix B1: Implementation and

Customization Pricing Schedule.

8.4 All costs associated with the hardware, software licensing, implementation services and

associated support must be included in the total bid price. The total bid price must be

inclusive of all factors which may contribute the cost of fulfilling the bid, factors such as:

a) Software licensing costs.

b) Delivery costs to the Electoral Commission’s national office in Centurion, Gauteng,

South Africa.

c) Support, Maintenance and Licenses Costs for 36 months

d) Installation and Configuration Services.

8.5 Bid prices must be VAT inclusive and must be firm for a period of 180 days.

8.6 The Electoral Commission reserves the right to adjust costs by excluding some cost

factors.

8.7 All costs associated with the solution must be captured on the pricing schedule - no

additional costs will be entertained.

8.8 The solution must be a complete solution.

9 Adjudication and Award of Contract

9.1 Bidders are advised to refer to the Appendix E: Bid Evaluation Criteria to ensure that

they have addressed all critical bid requirements.

9.2 The bid will be awarded to a bidder whose solution successfully conforms to

specifications and is able to deliver the services, and in terms of the provisions of the

Preferential Procurement Policy Framework Act, 2000 and specifically the Preferential

22 | P a g e

Procurement Regulations, 2022.

9.3 The Electoral Commission will issue a formal purchase order before any services can be

delivered It should be noted that the Electoral Commission seeks to gain the best

solution technically and financially and will select from the results of the bid a solution it

deems to give the best investment.

9.4 Awarding the bid to a successful bidder is subject to the bidder entering into a service

level agreement (SLA) with the Electoral Commission that will formalize and regulate the

final deliverables and associated processes and procedures.

10 Delivery and Implementation Timeframe

10.1 The successful bidder will be required to implement the solution over a period of 8

months from beginning of the project

10.2 The services will be delivered at the Electoral Commission’s National office in Centurion

7.1 Contracting of any service provider to render goods and/or services to the Electoral

Commission are subject to the fulfilment of the Electoral Commission’s due diligence

audit requirements.

7.2 An essential component of the Electoral Commission’s due diligence audit requirements

may involve site visits to potential suppliers/contractors as well as inspection of various

key documents underpinning the establishment of the companies involved in bids of the

c) Support, Maintenance and Licenses Costs for 36 months

d) Installation and Configuration Services.

8.5 Bid prices must be VAT inclusive and must be firm for a period of 180 days.

8.6 The Electoral Commission reserves the right to adjust costs by excluding some cost

factors.

8.7 All costs associated with the solution must be captured on the pricing schedule - no

additional costs will be entertained.

8.8 The solution must be a complete solution.

6. The proposed solution integrates with Microsoft Identity Manager 3.1.2.2

(Mim)

8. 3.1.3.8 The proposed solution works on Desktops and laptops running

Windows 11

9. 3.1.2.6 The proposed solution integrates to Microsoft SQL Server as an

external Database

10. The proposed solution integrates with SAP Portal, SAP ECC and 3.1.2.9

Sap grc 3.1.2.10

11. The proposed solution works with Microsoft AD as a repository of 3.1.2.5

12. 3.1.2.7 The proposed solution integrates with Microsoft Exchange to send

email messages

14. The proposed solution can integrate with Global custom-built 3.1.2.1

application using REST APIs and provides REST APIs for Global to

integrate with it. The Electoral Commission will also accept a

27 | P a g e

such as full time / part time (a staffing plan). A minimum of one (1) CV of a senior

qualifications, must be submitted together with the bid before closing date and time. The

bidder must use Appendix D: CV Guideline as guideline.

which the bid will be disqualified.

5.1 Bidders must place bids online on the Electoral Commission’s eProcurement website by

not later than the stipulated closing date and time on the auction.

5.2 Bidders must complete and submit Appendix A: Technical Bid Response Sheet to

demonstrate compliance with the technical bid requirements.

5.3 The bidder must provide a technical description of the solution being proposed including

the architecture and how the solution will work, including the product codes, description,

licensing framework, server and client components details, data sheets etc. The

description should include elaborations as to how the solution meets the requirements in

Section 3 (Technical Requirements) above including how the solution addresses POPIA,

to complete and submit this detailed pricing schedule as part of the bid submission shall lead

to disqualification.

21 | P a g e

8.1 The total bid price must be submitted online on the eProcurement (Votaquotes) portal.

8.2 The total bid price must be submitted online on the eProcurement (Votaquotes) portal.

The bidder must complete and submit Appendix B: Pricing Schedule. The bid price on

the Appendix B: Pricing Schedule must be the same as the bid price submitted online. If

there is a discrepancy between the Pricing Schedule bid price and the online submitted

bid price, the online submitted bid price will be used for adjudication.

8.3 The bidder must also complete and submit Appendix B1: Implementation and

9.1 Bidders are advised to refer to the Appendix E: Bid Evaluation Criteria to ensure that

they have addressed all critical bid requirements.

9.2 The bid will be awarded to a bidder whose solution successfully conforms to

specifications and is able to deliver the services, and in terms of the provisions of the

Preferential Procurement Policy Framework Act, 2000 and specifically the Preferential

22 | P a g e

Procurement Regulations, 2022.

9.3 The Electoral Commission will issue a formal purchase order before any services can be

delivered It should be noted that the Electoral Commission seeks to gain the best

solution technically and financially and will select from the results of the bid a solution it

deems to give the best investment.

9.4 Awarding the bid to a successful bidder is subject to the bidder entering into a service

level agreement (SLA) with the Electoral Commission that will formalize and regulate the

final deliverables and associated processes and procedures.

openness, and transparency in the procurement process.

11.2 All questions and the official responses will be published on the public VotaQuotes

website (www.votaquotes.elections.org.za) where the bid is advertised.

11.3 Bidders are responsible for regularly monitoring the platform for any updates,

clarifications, or additional information published during the bidding period.

11.4 No telephonic, email, or other forms of communication regarding bid enquiries will

be accepted or responded to.

11.5 An enquiry cut-off date applies to all bids. The final date and time for submitting

enquiries is published on the VotaQuotes platform under the specific bid listing.

23 | P a g e

12.1 A non-compulsory briefing session will be held on a date and time to be published on

https://votaquotes.elections.org.za

14.1 All bids must be submitted online on eProcurement (Votaquotes) portal.

14.2 All written supporting documentation must be submitted as stipulated on the bid

requirement.

14.3 Submissions received after the closing date and time will lead to bids being disqualified

and not considered.

14.4 The following supporting documents must be submitted as part of the written

submissions. Failure to submit these will lead to the bid being disqualified:

14.4.1 Completed technical specifications in accordance with the requirements in Appendix A:

and time.

25 | P a g e

16 Appendix A: Technical Bid Response Sheet

3.1.9.2 The proposed system must allow for the adjustment of roles and maintenance of

policies as the need arises.

3.1.9.3 The proposed system must allow for application of policies to identities and the

provisioning of identity based on the assigned role.

3.1.9.4 The proposed solution must allow for the monitoring and reporting of anomalous

combinations of accumulated access rights.

3.1.9.5 The proposed system must allow for the evaluation of policy conformance upon

identity changes and reports on violations.

3.1.10 Identity Security Breach

3.1.10.1 The proposed system must allow for an authorised user to instantly suspend all

accounts associated with an identity and also allows for the authorised user to

reactivate the suspended identity (and all relevant accounts) with workflow approvals.

3.1.10.2 The proposed system must provide audited trail for emergency lockout capability

3.1.10.3 The proposed solution must provide an Application Programme Interface (API)

for integration into a FortiSIEM including a SIEM event-based lockout capability.

3.1.11 Reports

3.1.11.1 The proposed solution must support out of the box audit reports. The bidder is to

list such supported reports.

3.1.11.2 The proposed solution must support scheduled report generation.

14 | P a g e

3.1.11.3 The proposed solution must provide a built-in query tool for ad-hoc reporting.

3.1.11.4 The proposed solution must produce a report detailing the following for any

resource

3.1.11.4.1 Who has access?

3.1.11.4.2 what does that access secure?

3.1.11.4.3 Who approved that access?

3.1.11.4.4 When was the access granted?

3.1.11.4.5 How is the access being used?

3.1.11.5 The proposed solution must produce reports of active users that are not

accessing systems (potential users that could have left the organization)

3.1.11.6 The proposed solution must produce reports of accounts without owners

3.1.11.7 The proposed solution must produce reports as to who is assigned what roles

and vice versa at any point of time

3.1.11.8 The bidder must indicate the reporting engines supported by the IGA solution being

proposed.

3.1.12 Implementation Services

3.1.12.1 The bidder must include services of documenting/updating policies and

standards, assigning ownership, and mapping policies to key business areas,

objectives and controls.

3.1.12.2 The IEC currently does not have an integrated solution. However, there are bits

and pieces of information everywhere. The services to be provided must include an in-

depth analysis of the current environment and migration from current to the new

proposed environment. The bidder must state the name of the tool if a tool will be

used for migration.

15 | P a g e

3.1.12.3 The bidder must include a detailed Implementation Approach that will take the

Commission from where we are currently (new beginning) to the new environment

with a list of deliverables. This includes the following:

3.1.12.3.1 an ideal project team’s (bidder) composition, skills and organization

including the time estimates of the required time for each member such as

full time / part time (staffing plan).

3.1.12.3.2 Detailed Project Plan.

3.1.12.4 The bidder must include a Quality Assurance plan that will be followed in the

project implementation.

3.1.12.5 The bidder must include a change management plan that will assist the IEC to

transition from the current environment to the new IGA environment.

3.1.12.6 It is envisaged that the project will run over a period of 8-9 months starting in

February 2027. The first 3 – 6 months are for implementation, and the rest will be on-

site and on demand Support and Maintenance one member of the team. There should

also be OEM/Systems Integration (SI) Support, whichever is applicable during the

support period for 1st, 2nd and 3rd years

3.1.12.7 The bidder must include a Risk Management plan including a list of typical risks

for a project of this nature and typical mitigation interventions.

3.1.12.8 The bidder must include methods to be used to formulate, execute and evaluate

a comprehensive test plan to ensure that all development is complete and functional.

the bid may be disqualified.

6.1 The bidder takes responsibility for the completeness and quality of their bid submission.

6.2 The bidder must undertake and warrant that the switches hardware is new, in good

condition and in line with the tender specifications.

6.3 The bidder will have the primary responsibility of ensuring that the proposed equipment

complies with the required specification in terms of functionality and technical

specification including quantity and quality.

6.4 The Electoral Commission may also call on bidders to make presentations in order for

the Electoral Commission to ensure full compliance with all its requirements and as part

of the bid evaluation process prior to the conclusion of the adjudication of the bid. Any

such request for presentations shall only be for clarification purposes in support of

mandatory requirements that must be adhered to as part of the written submission

19 | P a g e

requirements of this bid. Failure to submit mandatory requirements shall not be rectified

by the call for presentations. Any restrictions or conditions associated with any elements

of the service offering/s must be detailed. The Electoral Commission reserves the right to

reject conditions which are considered unfavourable to its business or unacceptable.

6.5 The bidder and/or OEM must provide the associated support and maintenance for the

duration of the warranty period. The support and maintenance must include all services

as per product code.

6.6 The submission of a bid implies acceptance of the terms specified in the provisions laid

down in the bid specifications, the procurement and, where applicable, additional

documents.

6.7 Bidders are expected to examine carefully and respect all instructions and standard

formats contained in these specifications.

6.8 A bid that does not contain all the required information and documentation will be

disqualified.

6.9 The Electoral Commission will issue an official purchase order to the successful bidder

before any services can be delivered.

6.10 Awarding of the bid to the successful bidder will be subject to the Electoral Commission’s

due diligence audit requirements, where applicable.

6.11 Although the Electoral Commission will only deal with the principal service provider, if a

bidder plans to sub-contract any of the services in this bid, they are required to attach

copies of sub-contracting agreements in their bid response documentation. The bidder

must also familiarize themselves with Supply Chain Management (SCM) regulations with

respect to subcontracting.

6.12 Notwithstanding any shortcomings in these specifications, service providers must ensure

that the proposed solution will form a workable and complete solution.

6.13 The Electoral Commission reserves the right and discretion to amend the quantities or

cancel or not award this bid based on any reason including operational or financial

requirements.

20 | P a g e

The bidder must include a Risk Management plan including typical risks. The bidder's change control management process must align with the Electoral Commission's change management processes. The bidder must state the name of the tool if a tool will be used. The bidder must include a detailed Implementation Approach that will take the first 3-6 months for implementation, with the rest on-site and on-demand support and maintenance.

Bidders must complete and submit Appendix A: Technical Bid Response Sheet, demonstrating compliance with every technical requirement. Failure to complete and submit the response sheet leads to disqualification. Bidders must also submit supporting documentation and references as per Appendix C: Reference Table, including similar IGA product/service experience, service size in terms of users and implementation duration. The bidder must provide a minimum of one CV of a senior resource.