In this section8 sections
What tenders ask for, and what you receive
We read the requirement sections of recent Malaysian public-sector tenders and requests for quotation, for portals, inventory systems and field-work systems. The same requirements came up again and again: maintenance and support, training and knowledge transfer, source code handover, tested backups, manuals, and measurable response times. Security testing, bilingual documentation and accessibility appeared too. The table shows how we meet each one, and what you can file as evidence.
Maintenance and support
- What we deliver
- A care plan with a response target
- Evidence you receive
- The signed care schedule and a monthly response log
Training and knowledge transfer
- What we deliver
- A session for each role and a recorded walkthrough
- Evidence you receive
- The attendance list, the recording and the user manual
Source code handover
- What we deliver
- The code in your repository and every account in your name
- Evidence you receive
- A handover checklist signed by both sides
Tested backups and recovery
- What we deliver
- Daily backups and a restore test each month
- Evidence you receive
- The restore test record
Manuals and documentation
- What we deliver
- A user manual and an admin guide, in Bahasa Malaysia or English
- Evidence you receive
- Versioned documents, updated when the system changes
Measurable response times
- What we deliver
- Next working day, 8 or 4 working hours
- Evidence you receive
- Response times in the monthly log
Security testing
- What we deliver
- An automated scan; an independent penetration test on request
- Evidence you receive
- The scan report, and the tester’s report when one is commissioned
Accessibility
- What we deliver
- Design to WCAG 2.2 level AA, checked before launch
- Evidence you receive
- An accessibility report and statement
Bilingual content
- What we deliver
- Bahasa Malaysia and English versions
- Evidence you receive
- Both versions live, with a language switch
Personal data
- What we deliver
- A PDPA pack
- Evidence you receive
- The privacy notice in both languages, a data inventory and a breach contact
| Requirement | What we deliver | Evidence you receive |
|---|---|---|
| Maintenance and support | A care plan with a response target | The signed care schedule and a monthly response log |
| Training and knowledge transfer | A session for each role and a recorded walkthrough | The attendance list, the recording and the user manual |
| Source code handover | The code in your repository and every account in your name | A handover checklist signed by both sides |
| Tested backups and recovery | Daily backups and a restore test each month | The restore test record |
| Manuals and documentation | A user manual and an admin guide, in Bahasa Malaysia or English | Versioned documents, updated when the system changes |
| Measurable response times | Next working day, 8 or 4 working hours | Response times in the monthly log |
| Security testing | An automated scan; an independent penetration test on request | The scan report, and the tester’s report when one is commissioned |
| Accessibility | Design to WCAG 2.2 level AA, checked before launch | An accessibility report and statement |
| Bilingual content | Bahasa Malaysia and English versions | Both versions live, with a language switch |
| Personal data | A PDPA pack | The privacy notice in both languages, a data inventory and a breach contact |
Training and documentation
Training sessions for each role, a user manual and an admin guide, and a recorded walkthrough your team can replay. The manual follows the tasks each role actually performs, with screenshots from your own system rather than a generic guide. When the system changes, the manual changes with it, and the version number tells everyone which one is current.
Handover: the code and the accounts are yours
You own everything we build for you: the code, the content, the domain, the hosting account and every third-party account opened for the project. At handover we go through a written checklist together: repositories, domains, hosting, email and outside services, each confirmed in your organisation’s name with at least two people holding access. There is no lock-in. If you move to another provider, everything goes with you and we help with the handover.
Backups you can prove
A backup that has never been restored is a hope, not a control. Daily backups, and a restore test each month with a written record you can show an auditor. The record shows what was restored, where, how long it took and who checked it, which is the evidence auditors and IT security teams ask for.
Response targets
Ordinary care comes with our normal response time. For corporate and government work, a response target is written into the agreement, at the level you choose:
Standard
- First response
- Next working day
- Used for
- For questions, changes and non-urgent faults.
Priority
- First response
- Within 8 working hours
- Used for
- For faults that affect staff or customers but have a workaround.
Critical
- First response
- Within 4 working hours
- Used for
- For a critical fault: the site or system is down or data is at risk.
| Level | First response | Used for |
|---|---|---|
| Standard | Next working day | For questions, changes and non-urgent faults. |
| Priority | Within 8 working hours | For faults that affect staff or customers but have a workaround. |
| Critical | Within 4 working hours | For a critical fault: the site or system is down or data is at risk. |
Targets are for a first response by a person who can act on the fault. Resolution depends on the fault, and we report progress until it is fixed. The level is chosen per project and priced with its care plan.
Accessibility and Bahasa Malaysia
The public-sector portal circular PPPA Bilangan 1 Tahun 2025 encourages agencies to follow WCAG for accessibility, and public-sector websites are expected in Bahasa Malaysia and English. We design to WCAG 2.2 level AA and hand over an accessibility report: automated checks plus keyboard and screen-reader checks of the main journeys. Websites and notices in Bahasa Malaysia and English; user guides in either language.
Language versions are built properly rather than machine-translated: each has its own address, menu, forms and emails, and a switch that keeps visitors on the same page. Details on multi-language websites.
Security, hosting and personal data
An automated security scan before launch and after major changes, with the report handed over. A penetration test by an independent specialist can be arranged on request and is quoted separately. Hosting in a Malaysian data centre when your policy requires it, quoted with the care plan.
A PDPA pack: the privacy notice in Bahasa Malaysia and English, consent records, a list of the personal data the system holds and where, and a named contact for a breach. The rules behind each item are explained in our Malaysian website compliance checklist.
What to send us
The tender or request document, the requirement list, the closing date, how proposals are evaluated, and who will use the system. Send it to us and we will reply with the questions we need answered, then a quotation that answers each requirement in turn.