CFEC-Afrique Digital System Overhaul

LOT 1 — contract

CFEC-Afrique digital programme. Revised 9 October 2026.
Supersedes the contract annexes of the same date and the preliminary-works quotation of 2 October 2026.
Four things changed in this revision, all at CFEC-Afrique's instruction:
1. Workstation fleet management added as the sixteenth area. The omission was ours — R-07 is Critical and gates L1 in CFEC-Afrique's own §39.1 table.
2. CFEC-09 approved. The fifteen areas move into Lot 1 from L3, L4, L6, L7 and L13 under TDR v7.1 and its Lot Execution Packs.
3. The corporate website is supplied built, with text, by CFEC-Afrique. Our line changes from building it to fixing and implementing it, and the effort falls accordingly.
4. All pass-through costs are now listed, in three classes — §7.
One field is blank and only CFEC-Afrique's supplier can fill it: the day rate, §6.2. Everything else is complete.
1. Scope — sixteen areas

Each line is a deliverable, not an activity.
1.1 Infrastructure and platform
# Deliverable Handed over
1 Domain transfer to Namecheap Domain under CFEC-Afrique's own registrar account; transfer auth code regenerated after completion
2 DNS The complete zone recreated and verified before the nameserver switch; independent of hosting (ADR-03); CAA and DMARC published
3 Enterprise e-mail Eleven launch mailboxes on the platform host, outbound through a reputable relay, SPF, DKIM, DMARC; the two existing mailboxes migrated with folders, dates, read state, headers and attachments preserved
4 VPS provisioning Nodes per §10.1 at the Lot 1 count, provisioned, documented, under the firm's own account
5 Server hardening A baseline measured against CIS benchmarks, enforced and verified by an automated check — not a checklist
6 Certificates One per apex plus a wildcard per product domain, automated issuance and renewal; the internal CA for device certificates
7 Nextcloud Installed, TLS, storage, users, group permissions with documented inheritance, controlled external sharing, backups
8 Baseline ERPNext Instance installed, secured, backed up, restored once from backup, one company creatable. Installation only — the accounting configuration is Lot 7

1.2 Public presence
# Deliverable Handed over
9 Corporate website — fix and implement The site supplied built by CFEC-Afrique, text included, corrected, deployed on the firm's own domain and hosting, TLS, backups. See the assumption at §8.1
10 SEO — initial setup Technical SEO, metadata, sitemap, Search Console, analytics, with the agreed exclusions applied before first indexing. Ranking is not a deliverable — §8.2

1.3 Application modules
# Deliverable Handed over
11 Tender module, rebuilt on Frappe Reads a real published notice end to end; §25.2 catalogue contract satisfied; existing data converted and reconciled; broker boundary enforced by a test. No financial posting before Lot 7
12 Recruitment module Application and document flows, careers-page integration, consent and retention, authorised-reviewer access, candidate communications, handoff to HR at Lot 13. Any screening is a decision aid; a named person decides

1.4 Workstation fleet management
R-07 gates Lot 1, Lot 2 and Lot 5. Lot 1 delivers the directory, the join and the policy baseline. Keycloak federation is Lot 2; content-aware DLP is Lot 5.
# Deliverable Handed over
13 Workstation inventory Windows edition, Office licence and local-administrator status per machine. Prerequisite for everything below and for the purchase list
14 Directory Two writable Samba AD domain controllers — one in the Ouagadougou office so logons and policy survive an Internet outage, one at the German secondary. SYSVOL replication handled
15 Domain join Every eligible machine joined. Windows Home cannot join a domain, so the Pro upgrades precede this
16 Group Policy baseline Password policy, firewall, application control, and the USB layers of §37.3: default deny on removable storage, approved hardware IDs only, BitLocker To Go required
17 BitLocker Enabled, recovery keys escrowed in the directory rather than on the machine
18 Endpoint telemetry Wazuh agent on every managed device; removable-storage and Plug-and-Play events collected and alerting
19 Local administrator rights removed From every user account. A user holding them bypasses every control above

A limit stated now rather than discovered later. Group Policy is allow-or-deny. It can refuse an unapproved USB key; it cannot inspect what is copied onto an approved one. That needs content-aware endpoint DLP, which is Lot 5. Lot 1 delivers control of the device, not of the content.
1.5 Documentation, control and handover
# Deliverable Handed over
20 Architecture and implementation documentation What was installed, where, how configured, how to rebuild. Written as the work is done
21 Security and ownership register Every account, domain, certificate, key, repository and pipeline in CFEC-Afrique's name, the firm holding credentials and recovery
22 Inventory of subscriptions, licences and accounts Each item with owner, renewal date and cost
23 Testing Each acceptance criterion of §2 run and evidenced, not described
24 Technical handover A member of the firm rebuilds a component from the documentation, unaided

2. Acceptance

A description of a future test is not evidence that a test passed.
2.1 The four gates, retained in full
Gate Passes when
SPF, DKIM, DMARC All three published and valid; DMARC aggregate reports arriving and readable
Certificate grade The agreed grade reached on an external test, and renewal observed to renew
Password SSH disabled Verified by automated check
Full restore completed A restore performed and timed, the restored system verified working

2.2 Per-deliverable
# Passes when
1–2 Domain resolves from the new registrar; zone served independently of the host; CAA published; mail flow never interrupted
3 Eleven mailboxes send and receive; migration reconciles by message count and volume; deliverability verified to the three major providers
5 The CIS baseline check runs green and is re-runnable by the firm
7 Permission inheritance demonstrated; external sharing controlled and logged; repository restored from backup
8 Instance reachable, backed up, restored once; a company can be created; a test fails if a production posting is attempted before Lot 7
9–10 Site live on the firm's domain and hosting; SEO baseline measured; exclusions in place before indexing
11 A real notice read end to end; conversion reconciles; a test fails if posting is attempted outside the broker
12 An application travels end to end; retention deletion observed; no path by which a score alone changes a candidate's status
13–19 Both controllers replicate, and the Ouagadougou one authenticates with the Internet link down; every eligible machine joined; an unapproved USB key refused and an approved one accepted, both observed; BitLocker keys retrievable from the directory; removable-storage events in the SIEM; no account holds local administrator rights
20, 24 Someone from the firm rebuilds a component from the documentation without our help
21–22 Every entry has an owner; recovery exercised without us; totals reconcile