Tender Summary: Provision of (Veeam) Cloud Backup Solution for Microsoft 365 Managed Service

Objectives

The primary objective is to procure a twelve-month managed cloud backup solution tailored for Microsoft 365 workloads. The institution aims to establish a resilient Backup-as-a-Service (BaaS) framework that guarantees comprehensive data protection, rapid disaster recovery, and uninterrupted business operations across its digital ecosystem.

Scope of Work

The successful supplier will deliver a fully managed, enterprise-grade backup service encompassing the following:

• End-to-end installation, configuration, and lifecycle management of the backup platform.
• Continuous twenty-four-hour, seven-day production support throughout the twelve-month contract term.
• Comprehensive protection of Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams data.
• Deployment of an all-inclusive subscription licensing model featuring unlimited storage capacity and retention periods.
• Provision of advanced search, bulk recovery, and self-service restoration portals.

Technical Requirements

Bidders must submit a solution that satisfies rigorous functional, security, and compliance standards:

• Data Coverage & Recovery: Granular backup of mailboxes, calendars, sites, document libraries, user files, and Teams metadata. Must support point-in-time restores, bulk operations, and native file exports (PST, MSG, XML, HTML, ZIP).
• Security & Compliance: Implementation of immutable backups to prevent accidental or malicious alteration/deletion. Data must be secured with 256-bit TLS encryption in transit and at rest. The platform must maintain ISO/IEC 27001, HIPAA, SOX, SOC2, and NIST certifications.
• Authentication & Access Control: Seamless integration with Microsoft EntraID, supplemented by non-Tenant login fallbacks. Deployment of Role-Based Access Control (RBAC) for delegated restores and strict Network Access Restrictions via IP filtering.
• Operational Capabilities: Unlimited customizable backup schedules, automated zero-downtime patching, embedded Microsoft Backup Service for accelerated recovery, and built-in audit/analytics dashboards. Must support both API-driven and Microsoft Backup Storage-based protection architectures.
• Licensing & Exit Strategy: Per-user subscription pricing with real-time consumption visibility. Must qualify under Microsoft Azure Consumption Commitment (MACC) guidelines. Requires a documented, cost-free data extraction pathway for offboarding, including migration to alternative storage and sustained access to vendor search/restore utilities.
• Resilience & Testing: Geo-redundant architecture with secondary regional disk replication and scheduled independent penetration testing.

Skills & Qualifications Requirements

Suppliers must demonstrate validated expertise and official manufacturer alignment through mandatory credentials:

• Current Veeam Platinum Partner Certificate explicitly authorizing supply, implementation, and support of Veeam Backup for Microsoft 365.
• Dedicated project personnel consisting of at least one certified Veeam Engineer/Consultant and one certified Veeam Architect. Documentation of certifications must be provided.
• Two verifiable reference letters confirming successful Microsoft 365 or equivalent cloud backup deployments executed within the preceding five years.

Notes on Specialized Terms

• Backup-as-a-Service (BaaS): A cloud outsourcing model where a third-party vendor manages backup infrastructure, software licensing, and recovery workflows, removing the burden of on-premises hardware maintenance.
• Immutable Backups: WORM (Write Once, Read Many) storage configurations that lock data against modification or deletion for a fixed duration, providing critical defense against ransomware encryption and insider sabotage.
• Microsoft Azure Consumption Commitment (MACC): A Microsoft commercial initiative allowing certified partners to offer discounted cloud services in exchange for committing to minimum Azure resource consumption thresholds.
• Microsoft EntraID: Microsoft’s cloud-native identity and access management platform (formerly Azure Active Directory), utilized here for centralized authentication and secure session management.
• Role-Based Access Control (RBAC): A security methodology that grants system permissions strictly according to predefined user roles, ensuring minimal privilege exposure during restore and administrative tasks.