{"text_format":"3","workbook":"xlsx","n_sheets":1,"sheets":["Vendor Evaluation Criteria"],"read":"whole","date_system":"1900"}

{"sheet":"Vendor Evaluation Criteria","index":0,"n_rows":78,"n_cols":8,"rows_kept":78,"merged":[[0,0,0,2],[6,2,6,4],[8,0,8,2],[10,1,11,1],[12,1,13,1],[16,1,18,1],[19,1,20,1],[24,1,25,1],[27,1,28,1],[35,0,35,2],[49,0,49,2],[56,1,58,1],[60,0,60,2],[63,1,64,1],[66,1,68,1],[70,1,71,1],[72,1,73,1],[74,1,77,1]]}
["Evaluation Criteria"]
[{"$nulls":3},"Rating",null,"Configurable"]
[{"$nulls":3},"Requirement Not Met",null,"Yes"]
[{"$nulls":3},"Requirement Partially Met",null,"No"]
[{"$nulls":3},"Requirement Met"]
[]
["REF.",null,"TECHNICAL SPECIFICATION"]
[null,"Requirement","Requirement Detail","Priority","Requirement Status","If the Requirement is Not Met or Partially Met, Can It Be Configurable? \nYes or No","Detail Information to Support Your Requirement Statement \nIf Partially Met or Not Met, How Do You Propose To Meet the Requirement?","REFERENCE TO FORMAL PROPOSAL\n(Section, par., page-#, Annexure, etc.)"]
["Business Requirements"]
["Req. No","Requirement","Description"]
["BR01","Process Modelling","The BPM Solution must support the mapping, modelling, design, and documentation of business processes using recognised modelling notations such as BPMN 2.0, enabling the organisation to accurately understand and document end to end business processes.","Must-Have"]
["BR02",null,"The BPM Solution must enable rapid creation of process models using business notations BPMN 2.0 or ISO/IEC 19510:2013 (OMG standards), with all models and supporting documentation stored within a centralised repository","Must-Have"]
["BR03","Process Collaboration Features","The BPM solution must have the ability for multiple users to create, review, and edit models simultaneously, enabling input from stakeholders, analysts, and IT","Must-Have"]
["BR04",null,"The BPM Solution must provide full visibility of customer interactions by supporting customer journey mapping, external process views, and the definition and management of customer touchpoints.","Must-Have"]
["BR05","Model Types","The BPM solution must have the ability to make available, but not limited to various common model types, related to the full spectrum of the Enterprise i.e., business, information, data, application and technology models..","Value-Add"]
["BR06","Process Analysis and Simulations","The BPM Solution must provide process simulation capabilities, allowing the organisation to perform “what‑if” scenario analysis and assess the potential impact of process changes prior to implementation.","Must-Have"]
["BR07","Process Analytics","The BPM Solution must support systematic analysis of business processes to assess and evaluate process effectiveness, efficiency, and performance.","Must-Have"]
["BR08",null,"The BPM Solution must enable the integration of real‑world and conceptual data to present key performance indicators (KPIs) through consolidated, context‑sensitive dashboards to support data‑driven decision‑making.","Must-Have"]
["BR09",null,"The BPM Solution must provide reporting capabilities, including one‑click reports that clearly demonstrate business‑to‑IT alignment where not only Business Processes are modelled in the system","Must-Have"]
["BR10","Process Diagnostics","The BPM Solution must be able to connect to existing line‑of‑business (LOB) systems (which are developed in various technologies) to extract real‑time or near real‑time data, providing an objective view of how business processes are executed.","Value-Add"]
["BR11",null,"The BPM Solution must allow users to design, document, manage, analyse, and optimise business‑critical processes within a single, integrated platform.","Value-Add"]
["BR12","Process Intelligence","The BPM Solution must support process intelligence capabilities, including the use of process mining, analytics, and artificial intelligence (AI), to identify bottlenecks, process deviations, risks, and opportunities for continuous improvement.","Value-Add"]
["BR13","Governance. Risk and Compliance","The BPM Solution must support governance, risk, and compliance (GRC) by enabling the mapping of business risks, controls, and regulatory requirements to specific process steps to support compliance management.","Must-Have"]
["BR14","Process orchestration","The BPM solution must have the ability to extend the process diagnostic capabilities across different processes with advanced analytics capabilities and decision management capabilities. It must have the capability to design and manage the interdependencies between different processes.","Value-Add"]
["BR15","Version Control and Repository","The solution must have a central repository to manage, store, and track changes to process models (current vs. future state).","Must-Have"]
["BR16",null,"The solution must support version control for all software components and configuration artefacts, including historical version tracking, change auditability, and controlled access to modifications.","Value-Add"]
["BR17","Detailed Documentation ","The solution must have support for defining process metadata, data objects, and system requirements within the diagram. ","Must-Have"]
["BR18","Reporting ","Ability to publish and share models in various formats (PDF, HTML) for documentation purposes.","Must-Have"]
["BR19",null,"The BPM solution must support BPMN XML import/export, EPC import/export.","Must-Have"]
["BR20","Model Quality Assurance","The BPM must have the ability to allow a process to be taken through a review and approval workflow process based on user-defined workflow and role access rules.","Must-Have"]
["BR21","Process Levelling","The BPM must have the ability to define processes clearly and in a simplified and user-friendly manner at all levels, starting at Enterprise right down to workflow level.","Must-Have"]
["BR22","Model Integration","The BPM must have the ability to integrate all model types at all levels where required based on organisational requirements.","Value-Add"]
["BR23","Model Method Definitions","The BPM must have the ability to allow for the defining of model and object method definitions as required based on organisational requirements.","Must-Have"]
["BR24","Disaster Recovery","The tool BPM must have a built-in failover and fault tolerance in mind.","Value-Add"]
[]
["Non-Functional Requirements"]
["Req. No","Requirement","Description"]
["NF01","Availability","The implemented solution is available 99% of the time, 24/7.\nPlanned downtime should be conducted outside of working hours (07:00 – 17:00) ","Must-Have"]
["NF02","Interoperability","The implement solution can operate with other products or systems in the present and future without any restricted access or implementation complexities","Must-Have"]
["NF03","Performance","The implemented solution provides fast response times with high throughput, low utilisation of computer resources, high system availability, high bandwidth, and fast data transmission speeds.","Must-Have"]
["NF04","Platform compatibility","The implemented solution is compatible with the existing hardware, operating systems, and browser capabilities with the ability to extend to a cloud-based platform.","Must-Have"]
["NF05","Response time","The implemented solution’s response time to a request for a service is quick (not more than 5 seconds) during normal system operations.","Must-Have"]
["NF06 ","Product Usability","Provides easily understood, friendly interfaces with intuitive designs to facilitate user engagement. Possible Non-Functional.","Must-Have"]
["NF07 ","Scalability","Scales in record size and number of records as the organisation grows and it should have flexible, transparent pricing models (e.g., consumption-based rather than just user-based).  ","Must-Have"]
["NF08","Workflow Functionality","Built-in governance workflows to manage the lifecycle of architectural artifacts.","Value-Add"]
["NF09","Vendor Support & Partnership","Reliability, responsiveness, and partnership approach of the vendor (e.g., high net emotional footprint).","Must-Have"]
["NF10","Vendor lock-in risk","The service provider must demonstrate how the proposed solution mitigates vendor lock‑in. This includes the ability to export all customer data in open, machine‑readable formats, support for industry‑standard APIs, and clear migration processes that do not require reliance on proprietary software or specialised vendor intervention.","Value-Add"]
["NF11","Deployment Architecture","Flexibility for cloud-based (SaaS) or on-premises installation.","Must-Have"]
[]
["Integration Requirements"]
["Req. No","Requirement","Description"]
["IR01","User Information Systems","Integration of the solution with User Information Systems for access to employee related information","Must-Have"]
["IR02","Identity and Access Management Systems","Integration of the solution with identity and access management systems to enforce authentication and authorisation policies.","Must-Have"]
["IR03","Configuration Management Database (CMDB) Systems ","Integration of the solution with Configuration Management Database Systems where applicable.","Value-Add"]
["IR04","Exchange/Email Systems","Integration of the solution with Exchange/Email Systems for the sending and receiving of automated emails","Must-Have"]
["IR05","Workflow Functionality","Built-in governance workflows to manage the lifecycle of architectural artifacts.","Must-Have"]
["IR06","API & Connectors","The solution should integrate with existing IT landscape systems using APIs","Must-Have"]
["IR07",null,"The solution must be able to integrate with enterprise architecture frameworks.","Must-Have"]
["IR08",null,"The solution must support open API","Must-Have"]
[]
["Security Requirements"]
["Req. No","Requirement","Description"]
["SC01","Authentication","The substantiation of the identity of a person or entity related to the enterprise or system.","Must-Have"]
["SC02","Authentication and Authorisation","Enforcement of permitted capabilities for a person or entity whose identity has been established.","Must-Have"]
["SC03",null,"Single sign-on must be supported using protocols like SAML and authenticate using DBSA approved authentication system.","Must-Have"]
["SC04","Role-Based Access Control (RBAC)","Ability to implement Role-Based Access Control (RBAC) in managing user permissions to ensure proper stewardship of data and to ensure only authorised personnel can modify process models.","Must-Have"]
["SC05","Audit","The ability to provide comprehensive audit trails ","Must-Have"]
["SC06",null,"The ability to provide audit logs attesting that the systems have been used in accordance with security policies to maintain its integrity. Audit logs must be immutable, time stamped and stored to support regulatory compliance.","Must-Have"]
["SC07",null,"The ability to integrate logs with SIEM technology.","Must-Have"]
["SC08","Information Asset Protection","The protection of information assets from loss or unintended disclosure, and resources from unauthorised and unintended use.","Must-Have"]
["SC09","Session Management","Ensures that sessions are unique to each individual and cannot be guessed or shared.  ","Must-Have"]
["SC10",null,"Sessions are invalidated when no longer required and timed out during periods of inactivity.","Must-Have"]
["SC11","Secured Communications","Ensures that Transport Layer Security (TLS 1.2 and above) and Secure Sockets Layer (SSL) is used where sensitive data is transmitted. ","Must-Have"]
["SC12",null,"The BPM solution must support the latest TLS encryption protocol, cipher strength above 3DES, and SHA256 or above hashing algorithm.","Must-Have"]
["SC13","Security & Compliance","The BPM solution must comply with BPMN 2.0 (ISO/IEC 19510:2013) standard.","Must-Have"]
["SC14",null,"Compliance with data privacy regulations (e.g., POPIA) and secure, enterprise-ready hosting options (SaaS, On-Premises).","Must-Have"]
["SC15",null,"The service provider must ensure full South African data residency, meaning that all customer data stored, processed, and retained or backed up within South African data centres. In cases where the solution stores data outside of South Africa, the service provider must provide details of how the data is governed.","Must-Have"]
["SC16",null,"The service provider must provide incident detection and response procedures, including mandatory notification of any data breach in accordance with POPIA.","Must-Have"]