ESKOM assurance data analytics system – 6-Year contract: paye questionnaire and independent contractor declaration pack

Closing date: 15 October 2026 at 10:00 (SAST).

Compulsory site visit or clarification meeting: details (date, time, venue) are stated in the Tender Data. Attendance is compulsory; failure to attend results in disqualification.

Tender validity period: as stated in the Tender Data; tenderers must hold tenders valid for acceptance within that period and extend if requested.

Tenderers must attend compulsory site visits or clarification meetings as stipulated; failure results in disqualification. Details are in the Tender Data.

All communication must be directed to the Eskom Representative only, in writing, in English. Queries to any other Eskom official are not permitted.

Clarification requests must be submitted in writing to the Eskom Representative, allowing reasonable time for response before closing.

Eskom will publish all clarification requests (without identifying the tenderer) and responses on the platform where the tender was advertised.

Submission address and tender box: as stated in the Tender Data.

Submission method: paper only, at the address and tender box stated in the Tender Data. Facsimile or email accepted only if the Tender Data expressly allows it.

• Submit one complete original tender in paper form plus one complete copy of the original, also in paper form. Missing either results in disqualification.
• Package the original and copy as separate envelopes marked "ORIGINAL" and "COPY". If an electronic copy is requested, package it separately and mark "ELECTRONIC COPY".
• Seal the separate packages together in an outer package marked "Confidential". On the outside of each package and the outer package, state: the Eskom submission address, the Invitation to Tender number, the tenderer's name, physical address, email address, and the contact telephone number of the authorised signatory.
• Complete the tender in ink, in English. Corrections must be initialled by all signatories; correction fluid or tape is not permitted.
• The original tender must be signed by a person duly authorised to bind the tenderer.
• Submit the Acknowledgement Form with the tender, stating whether the tender covers the whole or part of the works/services/supply.
• Submit all mandatory tender returnables by the closing date and time. Documents required for contract award must be submitted before award. All returnables must be fully completed and valid for the entire tender validity period.
• If an agent submits on behalf of a principal, include an authenticated copy of the authority to act as agent.
• Late tenders are not accepted. Proof of posting or courier delivery is not proof of delivery. Eskom is not responsible for misplacement or premature opening if the outer package is not sealed or the address/reference is incorrect.
• Eskom employees may not deposit a tender on a tenderer's behalf.
• Tenderers must check the Eskom Tender Bulletin and NT e-Tender Portal regularly for addenda and clarifications.

Evaluation stages:

1. Basic compliance check against the requirements in the Enquiry. Failure renders the tender non-responsive.
2. Mandatory returnables check — missing mandatory documents or information by the deadline leads to disqualification.
3. Functionality (if applicable) — scored against the stated criteria; must meet the minimum threshold in the Tender Data to proceed.
4. Financial analysis (if applicable) — Eskom assesses the financial risk of the tenderer; if risk is too high and no acceptable mitigating factors exist, the tenderer is not considered for award.
5. Price evaluation per the Tender Data, considering factors such as CPA, FOREX, commodity increases, discounts, NPV and forecasted invoicing rates.
6. Arithmetical error check on the highest-ranked tender. If figures and words disagree, the words prevail. Eskom corrects errors as specified; if the tenderer does not accept corrections, the tender is rejected.
7. Specific Goals scoring — if a tenderer fails to meet Specific Goals or submit supporting documentation by closing, it scores zero for Specific Goals within the 90/10 or 80/20 allocation, but is not otherwise disqualified.
8. Ranking — Eskom adds the Price and Specific Goals scores and ranks tenderers from highest to lowest.

Preference point system: 90/10 or 80/20 as stated in the Tender Data.

Objective criteria may be used only as permitted by PPPFA section 2(1)(f); functionality and B-BBEE scorecard elements may not be used as objective criteria.

Reverse e-auction may be used where indicated in the Enquiry; if used, the tender must not contain prices.

The tender is for the provision of an Assurance Data Analytics system that automates routine tasks, applies AI/ML to identify risks and patterns, and provides advanced analytics to enhance audit precision. The contract period is six (6) years, including maintenance and support.

The system must be supplied, implemented, and supported for the full contract duration.

The successful tenderer may be required to provide cataloguing information per item after award and must label all materials delivered to Eskom in line with Eskom's labelling specifications. Where cataloguing is required, the Pricing Schedule must include a line item for cataloguing, which Eskom will pay for.

Tenderers must provide proof satisfactory to Eskom that safety, health, environmental and quality (SHEQ) systems, policies and capabilities are in place by the deadline in the Enquiry. All SHEQ costs and personnel must be reflected in the tender.

Tenderers must include all duties, taxes (including VAT), and levies in rates and prices. Prices must be fixed for the contract duration unless otherwise provided. Prices must be stated in South African Rand unless instructed otherwise.

Pricing format: rates and prices must be stated in South African Rand unless instructed otherwise. Prices must be fixed for the contract duration and are not subject to adjustment except as provided in the Enquiry.

Include in all rates, prices, and the tendered total all duties, taxes (including VAT), and other levies payable by the tenderer if successful, as applicable 14 days prior to closing.

Submit prices in Rands in accordance with the exchange rate and base date stipulated in the Invitation to Tender.

Insurance: Eskom's insurance (if any) may not cover the full requirements of the contract; tenderers should seek qualified advice.

Performance security: if a performance bond or demand guarantee is required, the tenderer must select at least two (2) financial institutions from the list of Eskom-approved financial institutions.

Eskom will not compensate tenderers for any costs incurred in preparing or submitting the tender, including testing or negotiation costs.

Eligibility: tenderer must comply with the eligibility criteria in the Tender Data and must not be under any restriction to do business with Eskom or State-Owned Companies. Ineligible tenderers are disqualified.

Legislation: comply with National Treasury instructions, CIDB regulations (for construction works), PPPFA Regulations, Amended B-BBEE Codes, COIDA, OHS Act, and Eskom's SHEQ requirements.

SHEQ: provide proof satisfactory to Eskom that safety, health, environmental and quality systems, policies and capabilities are in place by the deadline in the Enquiry. All SHEQ costs and personnel must be reflected in the tender.

CIDB: if CIDB grading is stipulated in the Tender Data, the tenderer must be registered with the CIDB at closing or be capable of being registered within 21 working days from closing.

Contract Skills Development Goals (CSDG): if awarded a contract of 12 months or more and either (a) the contract is R5 million or more (professional service or service contract) or (b) the CIDB grading is grade 7 or higher (engineering/construction works), the contractor must achieve the CSDG as per the CIDB standard.

Contract Participation Goals (CPG): for construction works contracts in GB and CE classes, with minimum project duration of 6 months, and where at least 25% of the main contract is expected to be subcontracted in CE, EB, GB, or ME classes, the contractor must achieve CPG relating to engagement of targeted enterprises.

B-BBEE: misrepresentation or falsification of any B-BBEE certificate/affidavit, or evidence of fronting, will be reported to the B-BBEE Commission and may lead to disqualification.

Returnable forms: the Acknowledgement Form must be completed and submitted. Any other mandatory returnables listed in the Tender Data must be submitted by closing.

Tenderers must comply with the OHS Act, COIDA, and Eskom's SHEQ requirements. Proof of SHEQ systems, policies and capabilities must be provided to Eskom's satisfaction. All costs and personnel associated with SHEQ must be included in the tender.

Eskom may accept or reject any variation, deviation, or alternative tender, cancel the tender at any time, and is not liable for losses or damages from participation. Tenderers must include all duties, taxes, and levies in prices, provide fixed rates, and state prices in South African Rand unless otherwise instructed. Eskom will correct arithmetical errors as specified; tenderers must accept corrections or be rejected. Successful tenderer must sign the Form of Agreement.

Tenderers must hold their tenders valid for acceptance within the validity period and extend if requested. They must treat all procurement matters as confidential and use documents only for preparing the tender. They must comply with relevant legislation including NT instructions, CIDB regulations, PPPFA, B-BBEE Codes, COIDA, OHS Act, and Eskom SHEQ requirements. Proof of SHEQ systems must be provided. CIDB grading may be required. Contract Skills Development Goals and Contract Participation Goals apply as specified. Tenderers must not make alterations to documents except to correct errors, initialed by signatories. Alternative tenders only if permitted and with a main tender. Proof of authority required for agents. Security for performance must be selected from Eskom-approved financial institutions.

Tenderers must comply with eligibility criteria stated in the Tender Data and must not be under any restriction to do business with Eskom or State-Owned Companies. Ineligible tenderers will be disqualified.

Eskom will determine basic compliance, evaluate functionality if applicable, assess financial risk, evaluate price per Tender Data, check for arithmetical errors, score Specific Goals, and rank tenders by combined price and Specific Goals scores. Objective criteria may be used only as per PPPFA section 2(1)(f). Reverse e-auction may be used where indicated.

Mandatory security attestations and certificates:

• Cloud services storing/processing financial information: valid SOC 1 Type II report.
• Cloud services storing/processing PII or IP: valid SOC 2 Type II report.
• On-premises systems: valid ISO 27001 certificate.
• Cloud services: valid ISO 27017 and ISO 27018 certificates.
• SOC reports must be for the bidding service provider, not for sub-organisations hosting the service.

Security testing and acceptance:

• SAST, DAST, vulnerability assessment and penetration testing must be conducted before deployment to production.
• All critical, high and medium vulnerabilities must be resolved before production.
• Test result summaries must be submitted to Eskom's Cybersecurity team for review and acceptance.

Compliance and notifications:

• Compliance with POPIA and GDPR is required.
• Cyber security breaches must be reported to Eskom within 24 hours.
• Significant changes to business, platform or hosting provider must be reported within one month.

Scope: Provision of an Assurance Data Analytics system that automates routine tasks, applies AI/ML to identify risks and patterns, and provides advanced analytics to enhance audit precision. Contract period: six (6) years, including maintenance and support.

Security requirements for cloud services and on-premises systems:

• Integration with Eskom identity providers (MS Active Directory, Entra ID) supporting SAML 2.0, OAuth 2.0 and OAuth 2.1 for MFA and SSO.
• Privileged Access Management (PAM) integration (e.g. CyberArk) for secure management, rotation, monitoring and auditing of privileged accounts.
• Role-based access control (RBAC) mechanism.
• Encryption: data at rest using minimum AES-256; data in transit using minimum TLS 1.3; data integrity using SHA-256.
• Audit trails, logs, user administration and activity logs enabled, encrypted and securely kept with limited access.
• Masking of sensitive information (PII) in non-production environments.
• Incremental daily backups, encrypted and stored offsite for mission-critical systems.
• Real-time data replication to a DR site in a different region for critical systems.
• Disaster Recovery Plan (DRP) defined and tested annually; results shared with Eskom Cybersecurity team.
• Backup restore plan and procedure defined and tested annually; results shared.
• Patch management process defined; updates tested in non-production before production deployment.
• Database placed within Eskom LAN/BIN (on-prem) or partner private network (cloud) behind perimeter firewall.
• Database security management tools for compliance, encryption, key management, access controls, data masking, activity monitoring and auditing.
• DDoS protection for all services.
• Web Application Firewall (WAF) for internet-facing applications.
• Support for enterprise service bus (ESB), APIs and iPaaS platforms for security, logging and monitoring.
• e-Discovery capability for cloud services.
• SIEM integration (Syslog, Windows event logging, SNMP, API).

Mandatory security certifications and attestations:

• SOC 1 Type II and SOC 2 Type II reports for cloud services (as applicable).
• ISO 27001 for on-premises systems.
• ISO 27017 and ISO 27018 for cloud services.
• Compliance with POPIA and GDPR.

Cloud services include SaaS, PaaS, IaaS, FaaS, DaaS, iPaaS, SECaaS and DRaaS. On-premises systems are those hosted on Eskom's corporate LAN or BIN, excluding OT/PCN networks. SOC attestation reports apply only to cloud services. SOC 1 Type II is mandatory for cloud services storing/processing financial information. SOC 2 Type II is mandatory for cloud services storing/processing PII and IP. SOC reports must be for the bidding service provider, not for sub-organisations hosting the service. The CSP must notify Eskom within 24 hours of any cyber security breach, and within one month of significant changes to business, platform or hosting provider.

Mandatory security requirements for cloud services and on-premises systems: SOC 1 and SOC 2 Type II attestation reports for cloud services storing financial, PII or IP data; ISO 27001 for on-premises systems; ISO 27017 and ISO 27018 for cloud services; integration with Eskom identity providers (SAML 2.0, OAuth 2.0/2.1, MFA, SSO); privileged access management (PAM) integration; role-based access control (RBAC); encryption standards (AES-256, TLS 1.3, SHA-256); audit logging; data masking; backup and disaster recovery plans; patch management; security testing (SAST, DAST, vulnerability assessment, penetration testing); compliance with GDPR and POPIA; breach notification within 24 hours; notification of significant changes; database placement behind firewall; database security management tools; DDoS protection; web application firewall; support for ESB/API/iPaaS; e-Discovery capability; SIEM integration.

The document is the Eskom eTendering System Suppliers Help Manual (Annexure L), dated 28 August 2023, revision 3.0. It explains how suppliers register and upload tender documents electronically via the eTendering portal, replacing physical submission at Eskom tender offices. It does not contain the tender specification for the Assurance Data Analytics system.

For system problems, contact the buyer responsible for the published tender. No specific contact details are provided in this document.

Submission is electronic via the Eskom eTendering system at https://eTendering.eskom.co.za. Bidders must register on the system and verify their email address; a CSD number is required for access. Upload documents under the correct category (Technical, Commercial, Finance, etc.). Finalise the submission before the closing time by clicking 'Finalize Submission' and then 'Finalise and Close Submission'. Individual file size must not exceed 50MB; total size of all files must not exceed 900MB. After finalising, an email confirmation with the submission ID is sent; keep this email for future reference.

The document does not specify evaluation criteria, scoring split, or minimum qualifying scores. Bidders must have a CSD number and register on the eTendering system to participate.

The document is a help manual for the Eskom eTendering system, not the tender specification. It describes how suppliers upload tender documents electronically, replacing physical submission at Eskom tender offices. No technical requirements for the Assurance Data Analytics system are provided in this document.

Bidders must have a Central Supplier Database (CSD) number to access the eTendering system. Bidders must register on the eTendering system and verify their email address.

The document is the PAYE Questionnaire for Service Contracts to the Eskom Group of Companies, used to determine the tax classification of contractors for PAYE withholding purposes.

Returnable documents:

• PAYE Questionnaire (Annexure K) must be completed and signed.
• Sign the appendices directed by the answers to the questionnaire.
• Submit the completed pack, including the signed summary sheet and signed affidavits, to Eskom.
• Copy Group Tax on the email: [email protected]
• Failure to sign required affidavits or declarations may result in PAYE being withheld from payments.

The PAYE Questionnaire determines the contractor's tax classification for PAYE withholding purposes.

• For companies/CCs/trusts (Evaluation Pack A): answer questions on residence, number of employees, connected persons, income concentration, place of control and supervision, and dominant impression.
• For individuals (Evaluation Pack B): answer questions on service vs people, residence, employees, place and control, and dominant impression.
• Based on the answers, sign the relevant appendices (e.g., Appendix 1, 2, 3, 4, 5, 6, 7, 8, 9) as directed.
• If the contractor is classified as a Personal Service Provider (PSP) or Dependent Contractor, PAYE will be withheld from payments.
• Labour brokers must provide a valid IRP30 exemption certificate or PAYE will be withheld.

The document is the PAYE Questionnaire for Service Contracts to the Eskom Group of Companies.

• Applies from 1 March 2025 to 28 February 2026.
• Determines whether a contractor is an Independent Contractor, Personal Service Provider, Labour Broker, or Dependent Contractor for tax purposes.
• Applies to contractors supplying services or labour to Eskom Holdings SOC Ltd and its subsidiaries.

Contractors must complete the PAYE Questionnaire and sign the required appendices.

• Non-resident contractors must sign Appendix 9 and submit the pack to Eskom Group Tax.
• Labour brokers must provide a valid IRP30 exemption certificate.
• Failure to sign required affidavits or declarations may result in PAYE being withheld from payments.

This document is a service-level agreement (SLA) between Eskom Holdings SOC Limited (Eskom) and the Service Provider. It defines the formal working relationship, service descriptions, roles and responsibilities, service levels, support availability, and service performance management for the Asset Tracking Solution. The SLA is effective upon signature of the main contract and must be read together with the main contract.

Bidders must sign the Service Level Agreement (SLA) as part of the main contract. The SLA references the Eskom Information Security Policy (32-85) as normative. No other eligibility criteria (e.g., CSD registration, tax clearance, B-BBEE level) are stated in the provided document.

The SLA defines the service levels for the Asset Tracking Solution, which is to be provided, supported, and maintained by the Service Provider. The solution must include:

• Device Management: Persistent BIOS asset tracking technology verified and activated on endpoint devices.
• Geotechnology: Track and trace, set physical locations, build geofences, and create alerts if devices move out of predetermined locations.
• Asset Administration: Interface to maintain accurate asset inventory and user information throughout the device lifecycle.
• Integration: Integrate with Asset Register and user information systems via a cloud-based management portal, recording complete asset event history for live auditing.
• Intelligence: Produce advanced forensics artifacts (including AI) for stolen devices authorized for forensic analysis.
• Theft Recovery: Assist in criminal investigations, remote locating, locking, sanitising, and recovering stolen laptops.
• User permissions and controls: Robust permission features for different access levels.
• Alerts/notifications for unauthorised changes.
• Data & Device Security: Protect Eskom's intellectual property, remote access to safeguard data, delete/purge end-of-life data, and provide audit logs/certificates as proof.
• All supplier software must integrate with Eskom/Eskom supplier tools via industry standard APIs.
• The solution will be pre-installed on the motherboard of every Eskom device.

Training: Service Provider provides training at implementation, covering solution features and navigation. Hard-copy or electronic manuals available on request.

Hours of service: Solution fully operational 24x7. Interruptions during working days require 5 working days' prior written notice and Eskom's written approval. Support may be requested on public holidays and weekends.

Service portal: Online secure portal providing SLA and management dashboard with executive summary reports.

Service desk: All solution-related issues logged with Service Provider's service desk. ITSM system must update end users via email on call updates.

Request fulfilment: 90% of request tickets acknowledged within 30 minutes; 90% resolved within 5 working days.

Incident management: 95% of incident tickets acknowledged within 30 minutes; 95% responded to within 1 hour; 95% resolved within 8 hours. SMS notifications for outages to three Eskom nominated people within 30 minutes; email notifications to business group immediately and hourly updates.

Problem management: 95% of problem tickets responded to within 8 hours; 95% have recommended resolution within 5 working days.

Change management: All changes affecting the solution discussed and approved in writing by Eskom before implementation.

Asset Track and Trace Accuracy: Quarterly audits/tests, sample at least 1% of fleet, accuracy at least 95%. Investigation initiated within 3 days if device cannot be tracked. Repeat audit findings attract penalty of 5% of service bill.

Access to Eskom premises: Site-specific safety induction and PPE required. Service Provider to provide own PPE. Work in user's absence only with user confirmation and Eskom Group IT awareness.

KPIs: Detailed KPI table with targets for response, resolution, requests, device tracking, alerts, recovery, forensic analysis, availability, change management, and customer satisfaction. Weightings: High, Medium, Low.

Service performance management: Starts 3 months from service commencement. Monthly reports by 5th working day. Eskom may change service levels with 60 days' notice. Monthly service-level review meetings. Biannual SLA reviews. Customer satisfaction survey twice a year.

Penalties: If KPI failed, penalty based on weighting: High = 5% of service bill, Medium = 3%, Low = none. Multiple KPI failures capped at 10% of service bill. Penalties recovered as credit note against monthly billable schedule.

No specific requirements found