Disaster Recovery and Business Continuity Services

The National Credit Regulator (NCR) is seeking a qualified and experienced service provider to establish and manage a backup, disaster recovery (DR) and business continuity (BC) solution for a three-year period. The appointment replaces the interim off-site DR contract, which expires on 31 October 2026. The NCR's production environment runs on six standalone, non-clustered Microsoft Hyper-V hosts with about 15 production virtual machines, plus two physical domain controllers and a file server. It includes Windows Server 2019 and 2025, Microsoft SQL Server, Sage 300 People, Microsoft Dynamics GP, IRAS, Microfile, Exchange, IIS web services and a Microsoft 365 E5 tenant for 250 users. The protected data volume is estimated at 50 to 100 TB, to be confirmed during discovery. Bidders may respond to Option A (public cloud Backup and DR as a Service) or Option B (DR on private hosting with dedicated infrastructure).

The core technical requirements are a recovery point objective (RPO) of one hour or less and a recovery time objective (RTO) of four hours or less for all in-scope workloads. Backups must be policy-driven, application-aware and immutable, with layered retention (daily, weekly, monthly and annual). The solution must include orchestrated failover and failback, at least four DR drills per year with post-drill reports, and an annual scenario-based test such as a ransomware or site failure. All NCR data must remain in South Africa in Tier 3 or Tier 4 data centres. Connectivity requires a 1 Gbps dedicated cross-connect with a 100 Mbps IPSec VPN as a redundant path. Security requirements include Zero Trust controls, MFA, privileged access management, micro-segmentation, a secure bastion, EDR on DR compute and 15 SSL VPN licences. Required certifications include POPIA compliance evidence, ISO 27001/27002:2022, ISO 22301:2019, ISO 27018:2019, ISO 29151:2017 and an NIST CSF control mapping. The successor must also meet security vetting requirements for directors and key personnel. Support must be provided 24x7x365 through an ITIL-aligned service desk with defined P1 to P4 response and resolution targets, a dedicated Project Manager and Infrastructure Architect, and monthly service reporting.

The project covers a 12-week phased implementation (discovery, design, build, pilot, migration, cutover and stabilisation), along with knowledge transfer and formal certification for at least two NCR engineers. It also includes maintaining runbooks reviewed quarterly, retaining legacy backup access for at least 12 months, and certified data sanitisation and handover at contract end. The NCR's internal immutable backup repository must be preserved and integrated. Evaluation uses an 80/20 price and specific-goals model. Functionality is scored out of 100, and bidders must reach at least 80% to proceed to price and specific-goals evaluation. Functionality criteria cover the technical solution, architecture, project plan, risk management, and project and engineering CVs. Bidders must also supply at least five contactable reference letters for backup or DR projects from the last five years. Note that the supporting documents contain some date and value inconsistencies, including a 31 August 2026 submission reference alongside a 20 November 2026 closing date and differing RTO figures in the acceptance criteria. Interested bidders should confirm the closing date, clarifications and the final Terms of Reference directly with the NCR at procurement@ncr.org.za before submitting.