Objectives

The primary objective of this tender is to appoint a qualified service provider to deliver subscription services for an automated Governance, Risk, and Compliance (GRC) solution for a period of twelve (12) months. The project aims to enhance MICT SETA's data management, reporting accuracy, transparency, accountability, and compliance through the implementation of an integrated GRC system that streamlines risk, legal, and audit processes.

Scope

The scope of the project includes:

• Provision of a comprehensive GRC subscription service for 12 months.
• Implementation of an automated, integrated GRC platform compatible with existing systems such as ILMS and ERP.
• Support for multi-department structures and offline operation capabilities.
• Integration with current platforms, data migration, and secure data handover at contract end.
• Hosting options (cloud-based or on MICT SETA infrastructure) with high availability and disaster recovery.
• Provision of training, support, and maintenance services.
• Ensuring compliance with relevant standards and regulations (e.g., POPIA, ISO).

Technical Requirements

The technical specifications include:

• Support for multi-entry and multi-department configurations.
• Integration capabilities with ILMS, ERP, and other existing platforms via APIs, middleware, and connectors.
• Automated workflows for audits, risk management, legal compliance, and incident reporting.
• Notification, escalation, and action-tracking functionalities aligned with global audit standards.
• Risk register, control assessments, and key indicator tracking (KRIs, KPIs, KCIs).
• Security features such as data encryption (in transit and at rest), role-based access, and regular security audits.
• Hosting in a cloud environment with disaster recovery and high availability.
• Data migration plan supporting secure transfer and verification of existing data.
• Support for compliance reporting, export functionalities, and audit trail maintenance.

Skills Requirements

The bidder must demonstrate:

• Proven experience in implementing, configuring, maintaining, and supporting GRC systems, with reference letters from previous clients within RSA.
• Certifications for key personnel, including project managers (PMP, Prince2, CAPM, IPMA, APM PMQ) and technical leads relevant to GRC solutions.
• Capability to provide comprehensive training materials (manuals, quick guides, online help) and deliver training to various user groups, including ICT support teams and audit, risk, and legal units.
• Expertise in system integration, data migration, and secure data handling.
• Ability to develop detailed project implementation, integration, and data migration plans, with clear timelines and resource allocation.
• Demonstrated understanding of security standards and compliance requirements such as POPIA and ISO standards.