Appointment of an ICT consultant for the ICT infrastructure revamp project

Enquiries:

• Department: SCM Department
• Email: [email protected]
• Telephone: 051 447 7771 ext. 2234

Submission:

• Method: email
• Submission email: [email protected]

Submission method: email only to [email protected]. Hand-delivered documents will not be accepted.

Closing time: 07 October 2026 at 11:00. Late submissions will not be considered.

Returnable documents (all must be completed and signed):

• SBD 4 (Declaration of Interest): discloses whether any director or shareholder is employed by the state or connected to anyone at PACOFS.
• SBD 6.1 (Preference Points Claim): claims B-BBEE preference points under the 80/20 system.
• Proof of CSD registration.
• Detailed company profile covering relevant experience, knowledge and directorships.
• Valid B-BBEE certificate or sworn affidavit (for EMEs/QSEs) to claim specific goals; non-submission will not disqualify the quotation.

Failure to submit the above documents leads to disqualification.

Evaluation is in three phases.

Phase 1 – Compulsory documents: CSD proof, signed SBD 4 and SBD 6.1, company profile, and B-BBEE certificate/affidavit. Missing any of these disqualifies the bid.

Phase 2 – Functionality (minimum qualifying score: 70/100):

• B1 Company Experience and Project Team (30 points): reference letters from previous clients for public-sector ICT infrastructure/cybersecurity assessments. Each valid letter (on client letterhead, with client name, service description, and contact person) earns 5 points, maximum 30.
• B2 Methodology and Project Understanding (25 points): method statement covering all five components – project objectives; scope and deliverables; supervision approach; tools and resources; quality control/assurance. Scoring: all 5 = 25, 4 = 20, 3 = 15, 2 = 10, 1 = 5, none = 0.
• B3 Qualification, Certification and Experience (25 points): certified copies of qualifications required. Minimum per role:
• ICT Project Manager / Lead Consultant: ICT degree, Azure Administrator, CCNP, Linux, MCSE or similar, project management experience, 5+ years ICT consulting, demonstrated infrastructure assessment experience.
• Cybersecurity Specialist: ICT degree and cybersecurity qualification, recognised certifications (e.g. CISSP, CISM, CEH, OSCP, CompTIA Security+), experience with ISO 27001/NIST/CIS, 5+ years ICT consulting.
• ICT Infrastructure Architect: ICT degree, project management certificate, enterprise network architecture, Azure Administrator, cloud infrastructure, Microsoft 365, infrastructure modernisation, 5+ years ICT consulting.
• ICT Governance / Risk Specialist: ICT degree, ITIL certificate, ICT governance, risk management, ICT audit, compliance, public-sector governance.
• B4 Work Plan (20 points): programme of works and project cash flow showing all five components – milestones, critical path, resource allocation, task dependency map, monthly cash flow. Scoring: all 5 = 20, 4 = 15, 3 = 10, 2 = 7, 1 = 5, none = 0. A Microsoft Project visual alone is not sufficient.

Bidders scoring below 70 are non-responsive and disqualified.

Phase 3 – Price and Specific Goals (80/20 system per PPR 2022):

• Price: 80 points
• Specific goals (as per SBD 6.1): 20 points

Total: 100 points.

The Performing Arts Centre of the Free State (PACOFS) requires a Professional Service Provider / ICT Consultant to support the ICT Infrastructure Revamp Project. The consultant must benchmark the current environment against ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, and POPIA.

Scope of work:

• IT Infrastructure Assessment: review servers (physical and virtual), storage, backup systems, data centre/server room; hardware lifecycle, capacity, redundancy, disaster recovery/business continuity; cloud infrastructure and services (configuration, cost-efficiency); software licensing, patch management, endpoint management.
• Network Assessment: review architecture, topology, segmentation (LAN, WAN, Wi-Fi, VPN, remote access); network hardware (routers, switches, firewalls, load balancers) configuration and lifecycle; bandwidth, performance, availability, redundancy; monitoring, logging, management tools; identify single points of failure and resilience gaps.
• Cybersecurity Assessment: vulnerability assessment of network, systems, applications, endpoints; identity and access management, privileged account management, authentication; perimeter and endpoint security (firewalls, anti-malware, EDR/XDR, email/web filtering); data protection, encryption, data loss prevention; security policies, procedures, incident response plan, user awareness; third-party/vendor access and supply-chain risk; non-intrusive penetration testing/controlled vulnerability scanning of defined scope, subject to written authorisation and signed rules-of-engagement.
• Recommendations and Reporting: consolidated findings report with risk ratings (critical/high/medium/low); prioritised remediation roadmap with timelines, effort, budget estimates; gap analysis against chosen frameworks; executive summary for management/board.
• Support with Follow-on RFQ: assist PACOFS in developing scope, technical specifications, evaluation criteria for a subsequent RFQ; provide budget ranges and delivery timelines; review draft RFQ documentation and provide written comment.

Key deliverables:

1. Inception report and project mobilisation plan
2. Finalised technical specifications, scope of work and bid/tender documentation for procurement phase
3. Vendor engagement support and bid evaluation assistance
4. Deployment oversight (hardware, network, fibre, cloud migration, security implementation)
5. Project close-out report

Bidders must submit a detailed methodology covering project objectives, scope of work and deliverables, supervision approach, tools and resources for the entire project life cycle, and quality control/assurance. The method statement must include all five components to score full marks (25 points). Scoring: all 5 = 25, 4 = 20, 3 = 15, 2 = 10, 1 = 5, none = 0.

Minimum experience: 5 years' demonstrable experience in ICT infrastructure assessment projects of comparable scope (cloud migration, networking, cybersecurity, data centre/fibre).

Key personnel minimum requirements per role:

• ICT Project Manager / Lead Consultant: ICT degree, Azure Administrator, CCNP, Linux, MCSE or similar, project management experience, 5+ years ICT consulting, demonstrated infrastructure assessment experience.
• Cybersecurity Specialist: ICT degree and cybersecurity/information security qualification, recognised certifications (e.g. CISSP, CISM, CEH, OSCP, CompTIA Security+), experience with ISO 27001/NIST/CIS, cybersecurity assessment experience, 5+ years ICT consulting.
• ICT Infrastructure Architect: ICT degree, project management certificate, enterprise network architecture, Azure Administrator, cloud infrastructure, Microsoft 365, infrastructure modernisation, 5+ years ICT consulting.
• ICT Governance / Risk Specialist: ICT degree, ITIL certificate, ICT governance, risk management, ICT audit, compliance, public-sector governance.

Certified copies of qualifications and full CVs for each named team member must be attached. Additional specialists may be proposed.

The methodology must demonstrate relevance and suitability of tools and processes to ensure quality control and assurance in all phases of the project. This is part of the functionality evaluation (B2, 25 points).

Pricing schedule (Annexure A) must be completed with unit, quantity, unit price and total for each deliverable: IT Infrastructure Assessment, Network Assessment, Cybersecurity Assessment (incl. vulnerability scan/penetration test), Consolidated Report & Remediation Roadmap, Executive Presentation, Support with Follow-on RFQ Development, Other/Disbursements. Prices in ZAR, VAT-exclusive and VAT-inclusive, all-inclusive of travel, tools/licensing and disbursements.

Pricing must be in South African Rand (ZAR), quoted VAT-exclusive and VAT-inclusive, and all-inclusive of travel, tools/licensing and disbursements unless otherwise stated.

Pricing schedule (Annexure A) must be completed for:

• IT Infrastructure Assessment
• Network Assessment
• Cybersecurity Assessment (incl. vulnerability scan / penetration test)
• Consolidated Report & Remediation Roadmap
• Executive Presentation
• Support with Follow-on RFQ Development
• Other / Disbursements (specify)
• Subtotal (excl. VAT), VAT, Total (incl. VAT)

Quotations must remain valid for 30 days from the closing date.

Mandatory eligibility:

• Registered and active on the Central Supplier Database (CSD).
• Valid Tax Compliance Status PIN / Tax Clearance Certificate.
• Company registration documents (CIPC).
• Valid B-BBEE certificate or sworn affidavit (for EMEs/QSEs).
• Professional body membership: IITPSA for ICT practitioners and/or PMSA or PMI for project management professionals. Proof must be a valid membership certificate or letter of good standing current as at closing date.
• Minimum 5 years' demonstrable experience in ICT infrastructure assessment projects of comparable scope (cloud migration, networking, cybersecurity, data centre/fibre).
• Relevant professional certifications for proposed team members (CISSP, CISM, CEH, OSCP, CompTIA Security+, ISO/IEC 27001, Cisco/network certifications).
• At least 3 contactable references from similar projects completed in the past 5 years.
• Proof of current professional indemnity insurance and cyber liability insurance, showing insured party's name (matching bidding entity), insurer, indemnity limit, cover type, and validity extending through the engagement period.
• Signed confidentiality / non-disclosure undertaking.
• Technical proposal addressing scope, methodology, tools and project plan.
• CVs and certifications of proposed team members.

Tax compliance: if the recommended bidder is non-tax compliant, they get 7 days to rectify; otherwise bid is disqualified.

CSD verification (per National Treasury Instruction No. 4A of 2016/2017) covers business registration, directorship/membership, bank account holder, in-service-of-the-State status, tax compliance, identity number, and tender default/restriction status.

No award to bidders on National Treasury's Register of Tender Defaulters or List of Restricted Suppliers; PACOFS may withdraw an award or cancel a contract if the bidder is blacklisted.

Contract period: 1 year service level agreement.

Quotations must remain valid for 30 days from closing date.

PACOFS reserves the right not to appoint any service provider, not to accept the lowest price or any bid, and to accept the bid it deems in its best interest.

No award to bidders on National Treasury's Register of Tender Defaulters or List of Restricted Suppliers; PACOFS may withdraw an award or cancel a contract if the bidder is blacklisted.

Mandatory requirements: CSD registration, professional body membership (IITPSA/PMSA/PMI), 5 years' experience, relevant certifications, tax compliance PIN, CIPC registration, B-BBEE certificate/affidavit, 3 references, professional indemnity and cyber liability insurance, signed confidentiality undertaking, technical proposal, and CVs/certifications of team members.

Enquiries: SCM Department, [email protected], 051 447 7771 ext. 2234. Submission by email to [email protected], closing 07 October 2026 at 11:00. Late submissions not considered.