CALL FOR PROPOSALS: APPOINTMENT OF A MANAGED IT SERVICE PROVIDER

CALL FOR PROPOSALS: APPOINTMENT OF A MANAGED IT SERVICE PROVIDER

Reference: MDT/IT/2026/01
Procuring organisation: Masifundise Development Trust (MDT)
Date of issue: 13 November 2026
Closing date: 30 November 2026
Shortlisting and Interviews: End of January 2027

 

1. Background and Purpose

Masifundise Development Trust (MDT) invites suitably qualified and experienced IT service providers to submit proposals for the provision of comprehensive, fully managed IT services for the organisation from 2027 onwards. MDT is a non-profit organisation working with small-scale fishing communities and advancing food sovereignty and social, economic, climate and environmental justice. Reliable IT systems, secure information management and responsive technical support are essential to the organisation’s operational continuity, accountability and compliance responsibilities.

MDT currently receives IT support from a provider under a monthly retainer. MDT intends to appoint a new service provider to take over responsibility for managing and supporting its IT environment, including all existing support functions, together with appropriate improvements to cybersecurity, data protection, disaster recovery, service-level management and IT governance.

MDT currently uses Microsoft Office and Outlook applications, while its IT arrangements reportedly cover staff devices, Pastel and EasyFile, hosting and DNS, security monitoring, backups and archives, and emergency after-hours support. A full move to Microsoft 365 has been proposed but has not been confirmed. Respondents must explain how these functions will be maintained during any handover.

The appointed provider will be expected to deliver a reliable, integrated and cost-effective IT service that meets MDT’s day-to-day operational requirements while strengthening information security, compliance and business continuity.

The purpose of this procurement is to identify a service provider capable of taking overall responsibility for MDT’s IT requirements, providing proactive and responsive support, and recommending proportionate improvements appropriate to a non-profit organisation with approximately 10–15 users.

2. Scope of Services

The appointed service provider will be responsible for the ongoing management, maintenance, support and improvement of MDT’s IT environment.

Respondents must submit a proposal covering the full range of core services outlined below. Any services that cannot be provided directly must be clearly identified, together with the proposed arrangements, responsibilities and costs for delivering them through third parties.

 

2.1 Day-to-Day IT Support and Infrastructure Management

The provider must deliver comprehensive IT support, including:

• Desktop, laptop, email, printer and device troubleshooting. This includes audio/visual peripherals (microphones, speakers and headsets), hardware fault diagnosis, and support for agreed repairs or upgrades.
• Support for current Microsoft Office and Outlook applications, including email accounts and access, and any future platform approved by MDT.
• Pastel accounting software support, including liaison with the relevant software provider where necessary. Support must also extend to SARS EasyFile, including updates, licensing issues and troubleshooting.
• Mobile device support and endpoint security. This includes support for field-based and remote staff.
• Network and firewall monitoring and oversight.
• Website monitoring and technical troubleshooting. The service must also cover DNS administration, domain renewals and escalations, and liaison with internet service providers.
• System health monitoring and routine maintenance.
• Operating system and software updates and patch management.
• User account creation, changes, access permissions and termination of access when staff leave.
• Secure shared-folder permissions and access management.
• Remote and, where required, on-site technical support. Channels should include an agreed telephone or messaging option (such as WhatsApp), with a clear route for logging and tracking requests.
• After-hours support arrangements for urgent incidents. Specify urgent and overnight arrangements, response times and any additional charges.
• Identification, investigation and resolution of recurring technical problems.

The provider must take a proactive approach to maintaining systems, identifying potential risks and reducing disruptions to staff.

2.2 Cybersecurity and Endpoint Protection

The provider must implement and maintain appropriate cybersecurity measures, including:

• Endpoint protection and security monitoring.
• Vulnerability identification, assessment and remediation.
• Automated or scheduled patch management.
• Firewall oversight and network security.
• Secure configuration of devices, accounts and systems.
• Multi-factor authentication and appropriate access controls, where supported.
• Monitoring for suspicious activity and potential security incidents.
• Security incident response procedures, including escalation and reporting. Staff must be given a clear contact and reporting process for suspicious activity or suspected breaches.
• Recommendations for improving security in line with MDT’s operational needs and available resources.
• Documentation of security risks, corrective actions and outstanding vulnerabilities. Incident-response arrangements must be reviewed or tested at least annually, with findings and follow-up actions recorded.

Respondents must identify the security tools and technologies included in their proposed service and disclose any additional licence or subscription costs. Existing measures are reported to include Panda Cloud Endpoint (grant-supported) and a Titan Firewall; bidders must assess their suitability, ownership, licensing and any proposed replacement costs rather than assume these products must be retained.

 

2.3 Data Backup, Recovery and Disaster Recovery

The provider must establish, manage and monitor a reliable backup and recovery arrangement covering MDT’s relevant organisational information.

This must include:

• Regular backups of organisational email, files and other agreed information, regardless of the email or cloud platform in use.
• Backup of relevant desktop, laptop and endpoint data. This includes scheduled backups of staff laptops and any dedicated finance workstation.
• Off-site backup storage and appropriate retention arrangements.
• Protection of backups against unauthorised access, alteration or deletion.
• Monitoring of backup completion and prompt investigation of failed backups.
• Restoration of individual emails, files, folders and other relevant information.
• Periodic restoration testing, with documented results. State the test frequency and provide evidence that selected files or systems were successfully restored.
• Documented disaster recovery procedures.
• Defined recovery time and recovery point targets, agreed with MDT.
• Clear escalation procedures in the event of data loss, system failure or a cyber incident.

The provider must explain the extent to which its backup arrangements are independent of MDT’s primary systems and email or cloud environment.

Respondents must identify the proposed backup solution, storage limits, retention periods, licensing costs and any exclusions. Backup solutions compatible with the current or proposed email and cloud platforms, including iDrive Cloud Backup or equivalents, may be proposed where appropriate. MDT has been advised that its current arrangements include iDrive-managed backup storage, NAS archives and a dedicated Xeon desktop, with backups maintained since 2020 and some archives dating to 2016. Bidders must verify what remains accessible and recoverable and confirm retention, security and ownership.

2.4 Email, Productivity and Software Management

The provider must support MDT’s existing Microsoft Office and Outlook applications and assess Microsoft 365, Google Workspace/Gmail, Proton and other suitable email, productivity or collaboration alternatives. The service must include:

• User accounts, access rights and licence allocation.
• Email and collaboration services.
• Shared files, folders and permissions.
• Software installation, configuration and troubleshooting.
• Licence management, renewal tracking and optimisation.
• Integration between relevant systems and applications.
• Identification of underutilised or overlapping software licences.
• Recommendations comparing continued use of existing tools with a potential migration to an alternative platform.

All proposed software, subscriptions, dependencies and ongoing costs must be clearly disclosed. Respondents must compare security, reliability, compatibility, data protection, migration requirements and costs when recommending a platform.

The incumbent reports that MDT has access to a Microsoft Office Basic Grant. Respondents must verify the current licence entitlements and, only where justified, cost optional higher-tier capabilities such as extended audit-log retention, Intune device management, advanced monitoring, insider-risk controls, Compliance Manager, sensitivity labels, encryption and data-loss prevention. Proposals must distinguish existing features from paid upgrades and specify actual licence-dependent limits, implementation costs and recurring fees. A reported Microsoft grant does not confirm that MDT is already operating on Microsoft 365; this must be verified before proposing an upgrade.

2.5 IT Service Desk, SLA Management and Reporting

The provider must operate a centralised system for recording, managing and reporting IT support requests and incidents.

The service must include:

• A centralised register of support requests and incidents.
• Defined incident categories and priority levels.
• Agreed response and resolution targets. Targets must distinguish urgent, high-priority and routine requests and state escalation steps for missed targets.
• A clear process for logging requests and tracking progress.
• Notifications and escalation of overdue or unresolved incidents.
• Records of incidents, actions taken, resolutions and recurring problems.
• Monitoring of performance against the agreed service-level agreement (SLA).
• Monthly reporting to MDT management on service performance, outstanding issues, security incidents and recurring problems. Reports should also show support activity or service consumption and recurring causes of downtime.
• Audit trails and records suitable for management oversight, audit requirements and funder reporting.

Respondents must propose a practical and accessible system for managing IT requests. Existing Microsoft tools, suitable alternatives or a dedicated service management platform may be considered.

The proposed approach must be proportionate to MDT’s size and must not create unnecessary administrative work for staff.

For comparison only, MDT’s incumbent reports 78 service points per month, allocated to device support (21), finance systems (4), hosting and DNS (6), security (15), backups (20) and after-hours support (12), described as equivalent to 117 support hours. This is the incumbent’s service model, not verified time spent or a mandatory pricing basis. The incumbent also reports that major drive failures may consume an additional 10–12 points. Bidders may use points, hours or another model but must define included capacity, usage reporting, exclusions and charges for major incidents or excess support.

2.6 POPIA Compliance and Information Governance

The provider must assist MDT in strengthening its IT-related information security and data protection practices in support of the Protection of Personal Information Act (POPIA).

The proposed service must include:

• An assessment of IT-related information security risks and control gaps.
• Access control and permissions management.
• Secure handling and storage of personal information.
• Appropriate data retention and secure deletion arrangements.
• Documented backup, restoration and incident response procedures.
• Processes for reporting and escalating security incidents and potential personal information breaches.
• Appropriate controls for provider and third-party access to MDT systems and information.
• Maintenance of relevant security documentation and risk registers.
• Evidence of implemented controls for management review and audit purposes. Evidence should include backup and restoration results, security alerts, material finance-system issues, device or asset records, and corrective actions for management, board and audit review.
• Annual cybersecurity and information protection awareness training for staff.
• Recommendations for improving policies, procedures and technical controls.

The provider must distinguish between controls it can implement technically, organisational policies and procedures that MDT must approve or maintain, and matters requiring management action or specialist advice.

The appointment of an IT provider does not transfer MDT’s legal responsibilities under POPIA. The provider must support MDT in meeting its obligations and clearly identify the limits of the services offered.

2.7 Vendor and Third-Party IT Management

The provider must assist MDT in maintaining oversight of its IT-related vendors and third-party service arrangements.

This must include:

• A central register of relevant IT vendors and service agreements.
• Tracking of contracts, software licences, subscriptions and renewal dates.
• Monitoring of third-party service performance where relevant.
• Identification of vendor access and information security risks.
• Confidentiality and data protection requirements for third parties.
• Documentation of risks, mitigation measures and corrective actions.
• Reporting of relevant vendor issues and risks to MDT management.
• Support with vendor coordination and escalation when problems arise.

The proposed solution should use existing tools where practical and avoid introducing expensive standalone systems unless there is a clear operational justification.

2.8 Staff Training and User Awareness

The provider must offer appropriate guidance and training to MDT staff on the safe and effective use of IT systems.

This should include:

• Annual cybersecurity and POPIA awareness training.
• Guidance on phishing, passwords, suspicious emails and device security. This must include practical examples of AI-generated impersonation, suspicious attachments, fraudulent supplier or payment requests, and remote-working risks.
• Safe handling of organisational and personal information.
• Induction guidance for new staff.
• Refresher training when significant risks or system changes arise.
• Records of training delivered and staff participation. Provide attendance records and a short summary of the training completed.

Respondents must specify the training included in their monthly service fee and identify any additional charges.

3. Technical and Operational Requirements

All proposed services must:

1. Be appropriate for an organisation with approximately 10–15 users.
2. Be compatible with MDT’s existing IT environment, subject to technical assessment.
3. Provide reliable, secure and responsive IT support.
4. Include proactive monitoring and routine maintenance.
5. Provide appropriate data protection, backup and recovery arrangements.
6. Minimise the administrative burden on MDT staff.
7. Provide clear reporting for management, auditors and funders.
8. Include transparent licensing, subscription and support arrangements.
9. Identify all third-party dependencies and subcontracted services.
10. Provide documentation, implementation, testing and handover where required.
11. Offer reasonable scalability as MDT’s needs evolve.
12. Protect MDT’s data, systems and access credentials throughout the contract and upon termination.

Respondents must identify any services that fall outside the proposed monthly retainer and explain why they are excluded.

4. Transition from the Existing IT Provider

A critical component of this appointment will be the orderly transfer of IT services from the current service provider to the successful bidder.

Respondents must provide a transition and onboarding plan that addresses:

• An initial assessment of MDT’s IT environment, systems, devices, licences and current support arrangements.
• Identification of existing risks, gaps, dependencies and outstanding technical issues.
• Coordination with the outgoing provider, where authorised and necessary.
• Secure transfer of administrative access, credentials, configuration records, system documentation and relevant data.
• Verification of backup arrangements and successful restoration testing.
• Confirmation of ownership and access arrangements for MDT’s data, domains, website, email, productivity and cloud services and other relevant services. This assessment must cover the reported dedicated Xeon desktop for Pastel and NAS backup system with 4 TB RAID drives, which the incumbent describes as supplied without separate hardware charges; establish legal ownership, access, data migration and any return or replacement obligations.
• Continuity of day-to-day support throughout the transition.
• Identification of any additional transition costs.
• A clear implementation schedule and allocation of responsibilities.
• A written handover report identifying completed activities and outstanding issues.

The provider must ensure that MDT retains appropriate administrative control and access to its own systems and information.

The transition plan must minimise disruption and avoid unnecessary duplication of costs during the handover period.

5. Proposal Requirements

Interested service providers must submit a written proposal containing the following:

1. Company profile and experience

• Company registration details and relevant qualifications.
• Overview of the organisation and its service offering.
• Experience providing managed IT services to non-profits or organisations of a similar size.
• Experience in cybersecurity, Microsoft Office/Outlook and alternative email or cloud platforms, backup and disaster recovery, POPIA-related controls and IT governance.
• Details of relevant technical staff and support capacity.
• References from at least two comparable clients, where available.

1. Technical proposal

• Understanding of MDT’s requirements and existing IT environment.
• Description of the full range of managed IT services offered.
• Recommended technical solutions and proposed tools. Include a comparison of Microsoft 365, Google Workspace/Gmail, Proton and any other suitable options, with a clear recommendation and reasons.
• Details of support arrangements, escalation procedures and service levels.
• Cybersecurity, backup, recovery and incident management arrangements.
• Proposed IT service desk and reporting system.
• Approach to POPIA-related IT controls and information governance.
• Approach to vendor management and staff training.
• Transition and implementation plan. Where a change of platform is proposed, include a migration plan, continuity measures and expected costs.
• Documentation, reporting and knowledge transfer arrangements.
• Clear identification of exclusions, limitations and third-party dependencies. Clearly identify which support, cybersecurity, backup, training and compliance services are included in the retainer versus optional or separately billed.

1. Financial proposal

The financial proposal must distinguish clearly between:

• Once-off assessment, onboarding and transition costs.
• Monthly managed IT service fees.
• Hardware and infrastructure costs, where applicable.
• Software licences and subscriptions.
• Backup storage and data retention costs.
• Cybersecurity and monitoring costs.
• Additional on-site or after-hours support charges.
• Training and compliance support costs.
• Optional services and future upgrades.
• Third-party and subcontractor costs.
• Any other costs excluded from the monthly fee. Examples to clarify include repair labour and parts, drive-failure recovery, out-of-hours call-outs, additional service points or hours, Microsoft 365 or alternative platform migrations and upgrades, monitoring and asset-audit packages, and third-party licence or hosting charges.

All prices must be quoted in South African rand (ZAR), with VAT status clearly indicated. Respondents must state the quotation validity period and identify any anticipated annual price increases.

Respondents must provide a clear total cost of ownership for the first year and an indication of recurring costs in subsequent years.

1. Service and contractual terms

Respondents must provide:

• A proposed service-level agreement.
• Response and resolution targets for different incident priorities.
• Support hours and emergency escalation arrangements.
• Contract duration, renewal and termination provisions.
• Data ownership and administrative access arrangements.
• Confidentiality and data protection commitments.
• Business continuity and disaster recovery commitments.
• Reporting frequency and service review arrangements.
• Data export, access and transition arrangements upon termination.
• Details of professional indemnity or relevant cybersecurity insurance, where held.
• Disclosure of subcontractors and third-party service providers.

6. Budget and Cost Efficiency

MDT is a resource-constrained non-profit organisation and seeks a dependable, sustainable IT service that balances operational requirements, risk management, compliance and affordability.

Respondents are requested to provide a comprehensive core managed-service quotation covering all essential services outlined in this document.

In addition, respondents may offer three service options:

• Option 1: Essential Managed Service — comprehensive day-to-day IT support, maintenance, security, backup and recovery, and essential reporting.
• Option 2: Enhanced Managed Service — the essential service plus enhanced security monitoring, automated service reporting, stronger backup arrangements and more extensive IT governance support.
• Option 3: Comprehensive Managed Service — the enhanced service plus more advanced automation, reporting, vendor risk management and additional governance support.

Each option must clearly specify the services included, limitations, once-off costs, monthly fees and total annual recurring costs.

The options must not be used to exclude essential services from the core managed-service quotation. Respondents must identify any additional costs associated with optional enhancements.

Respondents must compare continuing with existing Microsoft Office/Outlook applications against suitable alternatives, including Microsoft 365, Google Workspace/Gmail and Proton. Explain grant or non-profit discounts, migration costs, recurring fees and how duplicate subscriptions or unnecessary upgrades would be avoided.

MDT has not prescribed a final budget ceiling. Respondents should therefore submit transparent, value-for-money proposals that enable a fair assessment of service quality, risk reduction and total cost.

7. Procurement Conditions

• MDT is not obliged to accept the lowest or any proposal received.
• Respondents must disclose any actual or potential conflict of interest.
• All information provided by MDT must be treated as confidential and used solely for preparing the proposal.
• Any processing of personal information must comply with applicable data protection requirements.
• MDT may request additional information or clarification during the evaluation process. Interviews with shortlisted service providers are anticipated in January 2027.
• Any appointment will be subject to budget approval, an agreed scope of work and a written contract.
• Respondents must identify all subcontractors and third-party service providers involved in delivering the proposed service.
• The successful provider will be required to support an orderly transition and protect MDT’s systems and information throughout the appointment.
• All proposed services, exclusions, fees and responsibilities must be documented in the final service agreement.

 

8. Submission Details

Proposals must be submitted electronically to:

Email: vacancies@masifundise.org.za
Subject line: IT Managed Services Proposal – MDT/IT/2026/01
Closing date: 30 November 2026

9. Expected Outcome

Through this procurement, MDT intends to appoint a reliable, responsive and cost-effective managed IT service provider capable of taking overall responsibility for the organisation’s IT environment.

The successful provider will be expected to ensure continuity of existing services while strengthening cybersecurity, data protection, backup and recovery, service-level reporting and IT governance.

MDT seeks a constructive long-term working relationship with a provider that understands the needs and resource constraints of a non- profit organisation and can deliver appropriate technical support without unnecessary complexity or expenditure.

Issued by:
Masifundise Development Trust
Michelle Joshua
Operations Manager

 

Click here to get the FULL DOCUMENT