Enterprise Backup and Cyber Recovery Solution (5 Years)

National Treasury has issued bid NT013-2026 for the appointment of a service provider to procure, deploy, and support a backup solution for a five-year period. The solution must protect the department's production and disaster recovery environments, including 480 TB of backup capacity at each site, 1,686 Microsoft 365 Exchange Online mailboxes, and 2,490 Microsoft Entra ID objects such as users, groups, and associated configuration. The scope covers daily, weekly, monthly, and annual backup cycles with defined retention periods, replication from the production site to the disaster recovery site, and a monthly immutable cloud repository for long-term retention. Recovery objectives are tiered by system criticality, and the solution must support orchestrated multi-tier recovery, isolated cyber-recovery environments for validating clean restore points, and quarterly backup testing.

The tender sets non-negotiable mandatory requirements that go well beyond standard backup. Bidders must be formally accredited partners or resellers of the proposed OEM with a local South African support presence, and the OEM platform must be supported by a published analyst report. The backup data store must be natively immutable and protected by two-person authorisation, the management plane must run independently of the production Windows and hypervisor estate, and the platform must include built-in ransomware detection that works without restoring data. Further requirements cover API-first architecture with RBAC, native integration with Microsoft Defender, Sentinel, and ITSM/SIEM tooling, and Instant Live Mount recovery. For Microsoft 365, the solution must provide an air-gapped copy outside the department's tenant, granular recovery, and per-user licensing. For identity protection, it must back up Entra ID beyond the native 30-day recycle bin, perform forest-level Active Directory recovery into a clean room, manage BitLocker recovery keys independently, and provide hybrid identity reconciliation. Governance requirements include enforced MFA, quorum controls for high-risk actions, tamper-resistant time sources, a documented implementation methodology, a skills-transfer programme, premium support with severity-based SLAs, and a fully itemised, capacity-based commercial model.

Evaluation is staged. Bids must first meet all mandatory requirements, then demonstrate legislative compliance, including tax clearance, CSD registration, and SBD forms. Technical functionality is scored through an online presentation covering architecture, backup and recovery, disaster recovery, security, management and reporting, scalability, implementation, and support, with a minimum threshold of 70 points. Remaining bids are evaluated on an 80/20 price and specific-goals basis, where points are awarded for black, women, youth, and disabled ownership. Pricing must be a fixed total cost inclusive of VAT, valid for 90 days, with a cost breakdown. The closing date is 30 November 2026 at 11:00 AM, and submissions must be made via the eTenders portal. The bid offers significant value for a national department, combining long-term data protection, rapid ransomware recovery, and protection of identity infrastructure. Interested bidders should review the Terms of Reference, Special Conditions of Contract, and the OEM accreditation evidence requirements carefully before committing resources.