Regional OpenCRVS Technical Support Services for Pacific Countries — Statistical Innovation and Capacity Building in the Pacific Islands

Noumea, New Caledonia, 29/09/2026 Statistical Innovation and Capacity Building in the Pacific Islands (PACSTAT) REQUEST FOR EXPRESSIONS OF INTEREST (CONSULTING SERVICES) GRANT NUMBER E633-P3, P168182 Assignment Title: Regional OpenCRVS Technical Support Services for Pacific Countries Reference No.: FJ-SPC-572068-CS-CQS / REOI26-10665 The Pacific Community (www.spc.int) has received financing in the amount of USD 6.0 million equivalent from the World Bank toward the cost of the Statistical Innovation and Capacity Building in the Pacific Islands Project, and it intends to apply part of the proceeds for consulting services. SPC now invites eligible consulting firms to express their interest in providing consultancy services for the assignment entitled “Regional OpenCRVS Technical Support Services for Pacific Countries”. The assignment is expected to start in December 2026 for an initial period of 3 months, followed by ongoing annual services, subject to funding. The detailed Terms of Reference (TOR) are available with this Request for Expressions of Interest. Interested consulting firms should submit information demonstrating their qualifications and relevant experience. The consulting firm will be selected using the Consultant Qualifications Selection (CQS) method, in accordance with the World Bank Procurement Regulations for IPF Borrowers: Stage 1: Expressions of Interest submitted will be evaluated against the required experience and minimum qualification requirements set out in section 8.0 of the Terms of Reference. Stage 2: The firm ranked highest from the EOI evaluation will be invited to submit a combined technical and financial proposal under an RFP process. The attention of interested consulting firms is drawn to paragraphs 3.13, 3.15, and 3.16 of the World Bank Procurement Regulations for IPF Borrowers (Seventh Edition, September 2025) (“the Regulations”), which set out the World Bank’s policy on Conflict of Interest applicable to consulting services: The World Bank Procurement Regulations for IPF Borrowers – Seventh Edition, September 2025 Further information can be obtained at the address below by e-mail. Expressions of interest must be delivered in a written form to the address below by e-mail no later than 13/10/2026 by 23:45 Noumea Time (GMT+11) . Att : SPC Procurement Unit email : procurement@spc.int Reference : FJ-SPC-572068-CS-CQS-REOI26-10665 TERMS OF REFERENCE FIRM / CONSULTING SERVICES Regional OpenCRVS Technical Support Services (Pacific CRVS Programme) Assignment Title: Regional OpenCRVS Technical Support Services for Pacific Countries Location Remote, with virtual engagement with SPC and participating Pacific countries Planned Duration Initial period 1 December 2026 to 28 February 2027, followed by an annual service from 1 March 2027, subject to funding Expected Starting Date 1 December 2026 Reference No FJ-SPC-572068-CS-CQS / REOI26-10665 1.0 Background: The Pacific Community (SPC) has received financing from the World Bank under the Statistical Innovation and Capacity Building in the Pacific Islands Project (PacStat) to support strengthened statistical systems and related data services in the Pacific. This assignment will be financed under PacStat Phase 1 Additional Financing and is expected to be completed by February 2027. SPC’s Statistics for Development Division supports Pacific Island Countries and Territories to strengthen official statistics, including the availability and use of administrative and demographic data for evidence-based planning, policy and reporting. Civil Registration and Vital Statistics (CRVS) systems are an important part of this work, as they record vital events such as births, deaths, marriages, divorces and adoptions and generate data for planning, monitoring and decision-making. OpenCRVS is an open-source digital public good designed to support civil registration in low-resource settings. SPC, with funding from Bloomberg Philanthropies, has been working with OpenCRVS and Pacific countries to strengthen digital CRVS systems, with implementation or planned deployment in countries including Niue, Cook Islands, Tonga, Tuvalu and Kiribati. SPC also operates a regional Mortality Coding Portal built on the same platform. A review of OpenCRVS support options has identified the need for a sustainable regional technical support arrangement. Current arrangements differ across countries, including hosting environments, infrastructure providers, configuration partners and support practices. The approach adopted is a single regional provider contracted to SPC to deliver combined Level 2 technical support and Level 3 expert technical support across participating configurations. Participating countries retain self-service and first-contact support. SPC retains coordination, contract management and service oversight. OpenCRVS provides core platform support, which is funded by OpenCRVS and is not part of this assignment. The assignment covers up to six configurations: five participating countries and the SPC Mortality Coding Portal. An extension beyond the end of February 2027 is subject to a funding proposal to Bloomberg Philanthropies. The funding is expected to be confirmed at the end of 2026. 2.0 Objective of the assignment To provide a regional OpenCRVS technical support arrangement for participating Pacific countries and the SPC Mortality Coding Portal, so that these systems remain available, secure, supported on current software versions and operable by the registration offices that depend on them. The provider will deliver combined Level 2 and Level 3 support, take responsibility for version currency and security patching, operate the ticketing and knowledge management function through which the service runs, and work with country first-contact support and with SPC to maintain a consistent standard of service across all configurations. Any support arrangement beyond 28 February 2027, including a possible extension or follow-on contract, would be subject to confirmation of future funding, satisfactory performance, and participating country requirements. 3.0 Scope of Services The provider will deliver regional OpenCRVS technical support focused on combined Level 2 technical support and Level 3 expert technical support. Country-level self-service and first-contact support remains with participating countries. SPC provides regional coordination, contract and relationship management, and service oversight. The provider operates the ticketing and knowledge management function; the records it holds are owned by the participating countries. The support levels are defined as follows: Level Description Typical work Sits with L0 Self-service • Guides, FAQs and quick-reference materials • Multi-tenant knowledge base, reflecting each country’s own configuration Country, content maintained regionally L1 First contact, in-country • Receiving and logging queries through the channels users actually use • Password resets and account unlocks • User administration — creating, amending and deactivating accounts • Access approvals by the National System Admin, with named backup cover • Distinguishing user error from system fault • "How do I" guidance and reinforcement of training • Escalating to L2 with enough detail to act on Country L2 Technical support • Investigating and reproducing reported faults • User roles and permissions • Facility lists and administrative structures • Validation rule queries • Access and connectivity problems • Triage and prioritisation of incoming issues Regional L3 Expert technical • Configuration changes and deployment • Version upgrades and release management • Security patching • SMTP, API and integration issues • Monitoring, alerting and log analysis • Backup verification and restore testing • Liaison with each country’s infrastructure provider Regional L4 Core platform • Defects in the OpenCRVS core product • Core security patches • New releases and supported-version policy • Receiving product suggestions raised by countries OpenCRVS The following table outlines details of what is to be delivered for combined Level 2 technical support and Level 3 expert technical support: Scope area Provider responsibilities Key outputs Mobilisation and transition Receive configuration handover for each participating configuration; produce and agree a baseline record for each; agree and implement access arrangements including break-glass provision; stand up ticketing and knowledge base; install monitoring and alerting; brief country first-contact personnel. Time-boxed and completed within the initial period. Baseline records signed off by incumbent and provider; access schedules; ticketing and knowledge base live; monitoring live; transition completion report. Incident management Receive, classify, triage, investigate and resolve incidents escalated from country first-contact support and from monitoring, against the service levels at Section 5.0. Manage major incidents and communicate status to SPC and affected countries. Resolved incidents, ticket records, major incident reports, monthly service-level performance reporting. Problem management Identify recurring incidents and underlying causes; propagate preventive fixes across configurations where the same cause is present; maintain known-error records. Root cause records, known-error register, preventive actions applied and recorded. Releases, upgrades and patching Plan and deliver upgrades twice yearly across all configurations, including configuration work, regression testing, user acceptance support, deployment and rollback planning. Apply security patches out of cycle without waiting for the next scheduled upgrade. Apply hotfixes where relevant to a configuration, subject to smoke testing rather than full acceptance testing. Release plans and records, upgrade completion reports, patch records, version state register. Version currency Maintain every configuration on a version supported by OpenCRVS throughout the contractual arrangement. Report version state for every configuration at each service review. Common version alignment across configurations is not required. Version state register, upgrade schedule, exception reporting where a configuration is at risk. Preventive maintenance and monitoring Operate monitoring and alerting across all production configurations with alerts acknowledged within the support window; verify backups monthly for each configuration; complete a documented restore test for each configuration twice yearly; perform certificate, dependency and log checks. Monitoring records, backup verification records, restore test reports, maintenance notes. Ticketing and knowledge management Operate a multi-tenant ticketing system and knowledge base with a regional view and a separate view for each configuration; maintain troubleshooting notes, procedures and configuration documentation. Records, content and reporting are owned by participating countries and exportable in full at any time and on exit. Ticket register, knowledge base, configuration documentation, export on request. First-contact support for the Mortality Coding Portal Provide first-contact support for the SPC Mortality Coding Portal, which has no country registration office behind it, in addition to Level 2 and Level 3 support for that configuration. Portal support records within the ticket register. Support to country first-contact personnel Provide light coaching to nominated country first-contact personnel so that they understand their role and can raise tickets to the agreed template and standard. Report on ticket quality at service review. Coaching sessions delivered, ticket template, ticket quality reporting. Information security and access Maintain confidentiality, data protection, access control and privileged remote access safeguards. Operate break-glass access under country approval with full logging. Apply data minimisation as specified at Section 7.0. Access records and logs, security controls evidence, incident notifications. Service management and reporting Operate structured service management; provide monthly reporting; attend and support quarterly service review with SPC and participating countries; liaise with each country’s infrastructure provider. Monthly reports, quarterly service review packs, escalation and risk records. 3.1 Outside scope The following are outside the scope of this assignment. Configuration changes for enhancements and API integrations. No allocation of change days is included. Countries requiring configuration change may commission it from the provider at the day rates held under this arrangement. Countries are not obliged to do so and may commission configuration change elsewhere. The day rates are held to give countries a ready and pre-competed route, not to confer exclusivity on the provider. Infrastructure provision, hosting, availability and uptime, which remain with each country and its infrastructure provider. This includes the provision and retention of off-site backup copies as described at Section 7.4. End-user devices, local networks and connectivity. Delivery of end-user training, and new country implementations or data migration. Civil registration business analysis and regulatory advisory services. Level 4 core platform support, which is provided by OpenCRVS at its own cost and is not to be priced by bidders. See Section 5.3. 4.0 Expected Outcomes, Deliverables, and Timeline The service provider will be responsible for producing the following outputs during the assignment: Timeline Deliverable Description December 2026 Mobilisation and transition plan Confirmed workplan, participating configurations, communication and escalation arrangements, reporting templates and mobilisation actions. December 2026 Baseline record for each configuration Version state, configuration, integrations, environments, known defects and portal integration points, signed off by the incumbent partner and the incoming provider before 31 December 2026. December 2026 Service model, responsibility matrix and access arrangements Responsibility matrix covering SPC, provider, participating countries, infrastructure providers and OpenCRVS core support; access approval, break-glass, logging, monitoring, suspension and revocation arrangements for each configuration. December 2026 Ticketing, knowledge base and monitoring live Multi-tenant ticketing and knowledge base operating with regional and per-configuration views; monitoring and alerting installed across all production configurations. 1 January 2027 Stabilisation service commences Full support window live; critical and high severity carrying full targets; security patching at full standard. Monthly Monthly support report Incidents, service-level performance, open issues, escalations, risks, access and security matters, version state, and planned activities for the next period. Ongoing Incident and problem register Maintained register including severity, responsible party, dates, escalation history, resolution notes, closure confirmation and recurring problems requiring root-cause action. Ongoing Knowledge base and configuration documentation Troubleshooting notes, procedures, known-error records and per-configuration documentation, maintained to support regional learning and reduce reliance on individual supplier knowledge. Twice yearly Upgrade cycle completion report Configuration work, regression and acceptance testing, deployment, rollback readiness, resulting version state for each configuration. Twice yearly Restore test report Documented restoration of each configuration from backup, the retention state confirmed, and any remediation required. As required Security patch and hotfix records Patches and hotfixes applied, configurations affected, testing performed, and where a hotfix was not applied, the reason. Quarterly Service review pack Performance against service levels, version state, ticket quality by configuration, risks, open actions and decisions required. End of each contract period Performance and transition report Services delivered, performance against service levels, unresolved risks, lessons learned, remaining actions and recommendations for continuation or transition. 5.0 Service Levels 5.1 Support window The support window is 20:00 to 03:00 UTC. Because participating countries straddle the international date line, the window operates across six shifts each week, opening on Sunday evening UTC and closing on Saturday morning UTC. This totals 42 desk hours a week. Shift Opens (UTC) Closes (UTC) 1 Sunday 20:00 Monday 03:00 2 Monday 20:00 Tuesday 03:00 3 Tuesday 20:00 Wednesday 03:00 4 Wednesday 20:00 Thursday 03:00 5 Thursday 20:00 Friday 03:00 6 Friday 20:00 Saturday 03:00 Bidders must state the weekly desk hours their proposal provides. A proposal offering fewer than six shifts does not meet this requirement, as it would leave the first working day of the week uncovered in Tonga, Tuvalu and Kiribati, or the last working day uncovered in the Cook Islands and Niue. At least one engineer must be on duty throughout the window, drawn from a pool of at least two engineers trained and authorised to hold the desk, cross-trained across both shift segments and across all configurations, with named escalation to a service manager and to Level 3 expertise. Bidders must describe how leave and unplanned absence are covered. Incidents may be raised at any time. Where an incident is raised outside the support window, the response clock starts at the opening of the next shift. 5.2 Severity levels and targets Severity Description Response Resolution or workaround Critical Service unavailable, registration blocked, or major incident affecting operational use in one or more configurations. Within 1 working hour Within 8 working hours, or an agreed workaround and recovery plan High Major function impaired, significant operational impact, workaround available or partial service continuing. Within 4 working hours Within 2 working days Medium Limited impact, user or configuration issue, workaround available, or issue affecting a small number of users. Within 1 working day Within 5 working days Low / request Minor issue, service request, documentation query or non-urgent configuration matter. Within 2 working days At the next planned release or agreed workplan Working hours and working days are counted within the support window at Section 5.1. 5.3 Matters outside the provider’s control and core defect exemption Service levels apply to matters within the provider’s control. This includes configuration faults, access and permission problems, integration failures, release and upgrade activity, and the escalation and pursuit of infrastructure faults with the responsible party. Level 4 core platform support is provided by OpenCRVS, funded by OpenCRVS, and made available on equal terms to any provider appointed under this assignment. Requests are raised through the published OpenCRVS route and are triaged on priority alongside requests from all other implementations. It is offered as a service level objective and not as a contractual commitment. Bidders must not include any charge for Level 4 support and must not assume preferential access to it. Where investigation establishes that the root cause of an incident is a defect in the OpenCRVS core product, the provider’s resolution clock stops from the point at which the core defect is established and the request is raised. The evidence establishing the core defect must be recorded in the ticket. The provider’s obligation resumes when a fix or hotfix is made available, and the provider is required to apply it promptly to affected configurations, subject to smoke testing. Faults relating to country infrastructure, power, connectivity, local devices, external systems or country-controlled decisions are similarly outside the provider’s control and are managed through agreed escalation, with the provider responsible for pursuit and communication rather than for resolution. 5.4 Service credits and persistent failure Service credits are assessed quarterly against the quarterly charge and are earned on the proportion of critical and high severity targets met in the quarter, counting response and resolution targets together. Critical and high severity targets met in the quarter Credit against the quarterly charge 90 per cent or above None 80 to 89.9 per cent 5 per cent 70 to 79.9 per cent 10 per cent Below 70 per cent 15 per cent In addition, each of the following carries a credit of five per cent of the quarterly charge in its own right: a security patch not applied within the period agreed for it; a scheduled restore test not completed within the quarter in which it falls; a scheduled upgrade cycle not delivered within the agreed window; any shift within the support window left unstaffed. Credits from all sources aggregate and are capped at fifteen per cent of the quarterly charge in any quarter. Credits are not applied where the cause falls under Section 5.3, nor where delay results from a participating country declining or deferring an upgrade window, access approval or other decision within its control. Where the credit threshold at the fifteen per cent level is reached in two consecutive quarters, or where any of the four failures listed above occurs in two consecutive quarters, SPC may terminate the contract on thirty days’ written notice without cause and without liability for early termination charges. This provision exists because a capped credit regime alone is not a sufficient incentive on a contract of this size, and because the material remedy for sustained underperformance is exit rather than rebate. During the initial period, service credits apply to critical incident response only. All other measures are reported but not scored until the annual service commences. The persistent failure provision above applies from the commencement of the annual service. 6.0 Reporting Requirements The provider reports to the Programme Lead CRVS or designated SPC focal point. Reporting must be clear, concise and evidence-based, and must support contract oversight, service-level monitoring and risk management. Monthly support report covering incidents, service-level performance, open issues, escalations, risks, security and access matters, version state and planned activities. A maintained incident and problem register, available to SPC and to each country for its own configuration. Immediate notification to SPC and the affected country of any critical incident, suspected security incident, unauthorised access concern or major service disruption. A quarterly service review pack, and attendance at the service review, covering all configurations together. An end-of-period performance and transition report at the end of each contract period. 7.0 Working Arrangements This is a remote assignment. No travel is anticipated unless separately agreed in writing by SPC. The provider must be able to work effectively across Pacific time zones and within the support window at Section 5.1. 7.1 Roles Participating countries provide self-service and first-contact support. Each country nominates a first-contact role holder, who may be a registration officer or an information technology officer as the country prefers. The role is to be reachable during the country’s working day, to attempt documented first-contact steps, and to raise tickets to the agreed template and standard. SPC will secure these commitments through its agreement with each participating country. SPC coordinates country relationships, holds the contract, chairs the quarterly service review and approves the annual workplan. SPC does not operate a technical support tier. The provider delivers combined Level 2 and Level 3 support as set out at Section 3.0 and provides first-contact support for the Mortality Coding Portal. 7.2 Access and break-glass provision Country-approved access arrangements must be agreed for each configuration before service commencement, covering remote access requirements, approval pathways, access logging, monitoring, suspension and revocation. In addition, the provider must hold break-glass access to each configuration, enabling it to act where first-contact support is unavailable or unable to perform a required action. Break-glass provision comprises accounts at registrar and national system administrator level, and secure shell access where required. Use is subject to country approval, is recorded in the product audit trail, and generates logged alerts. Bidders should price on the basis that this provision will be in place. 7.3 Data protection and data minimisation Civil registration personal data must not be entered into ticket bodies, attachments, knowledge base articles or reporting. Incidents must reference records by identifier, and investigation requiring access to record content must take place within the country’s own environment. Where a request is raised to OpenCRVS core support, personal data must be removed or obscured from any log extract, screenshot or screen recording before submission, as core support requests are handled through a public channel. Ticket records, knowledge base content and reporting are owned by the participating countries. The provider must be able to export them in full, in a documented and reusable format, at any time on request and on expiry or termination of the contract. 7.4 Backup, retention and recovery Backup arrangements comprise two layers, held by different parties. The application backup is automated within the OpenCRVS deployment. The provider is responsible for ensuring that it is configured and operating for every configuration, that the staging environment is restoring from it on a daily basis, and that retention is set to a value agreed with the country. A minimum retention of thirty days applies. Where a configuration is found on a shorter retention, the provider must raise this with the country and SPC and implement the agreed value. An off-site or separate-region copy of each configuration’s data must exist. Provision and retention of that copy sits with the participating country and its infrastructure provider and is outside the provider’s scope. The provider is responsible for confirming at baseline that the arrangement exists, recording its frequency and retention, reporting its status at each service review, and escalating to SPC and the country where it is absent or has lapsed. The provider must verify backups monthly for each configuration and complete a documented restore test for each configuration twice yearly. Verification means confirming that the backup has run, is complete and is within retention; restore testing means demonstrating that data can in fact be recovered from it. Bidders should note that participating configurations are not currently on OpenCRVS 2.1 or later, in which a deployment will not start unless its backup service is operating. On earlier versions a backup failure does not announce itself. The baseline record required at Section 4.0 must therefore establish, for each configuration, whether an automated backup is configured and running, the retention set, whether a daily staging restore is in place, and what off-site arrangement exists. These are to be treated as matters to be established rather than confirmed. Backup failure, whether of the application backup or of the off-site arrangement, must be notified to SPC and the affected country immediately in accordance with Section 6.0. 8.0 Expressions of Interest evaluation The consulting firm will be selected using the Consultant Qualifications Selection (CQS) method, in accordance with the World Bank Procurement Regulations for IPF Borrowers. The firms will be assessed based on their overall qualifications and experience relevant to the assignment. Minimum qualification criteria will be assessed on a pass/fail basis. Other factors will then be evaluated using the indicative criteria below. The firm ranked highest will be invited to submit a combined technical and financial proposal in a second stage. Minimum qualification: Be a legally registered firm, consortium or eligible organisation authorised to provide information technology support, software maintenance, digital public goods support or related technical services. At least five years of organisational, consortium or key personnel experience providing software support, application maintenance, digital government systems support, CRVS platform support or comparable technical services. Ability to operate a support desk across six shifts a week within the window at Section 5.1 of the Terms of Reference. Absence of conflict of interest. Bidders must disclose any joint venture, shared ownership, common control or subcontracting relationship with any other party bidding for this assignment. As part of the selection process and prior to contract award, consulting firms are required to declare the existence or absence of any conflict of interest by completing the Conflict-of-Interest Declaration Form available at the following link: Conflict of Interest Declaration. Scored criteria: Criteria Maximum Score Indicative Assessment Focus Technical capability 20 Depth of capability across OpenCRVS and related infrastructure, configuration, deployment, integrations, monitoring and release management; OpenCRVS accredited partner status is scored as a component of this criterion, with demonstrated equivalent OpenCRVS implementation or support experience also considered. Bidders holding accreditation should state it and give the date it was granted. 15 Completion of at least two comparable assignments within the last five years involving software support, government systems, CRVS or statistical systems, digital public goods, or multi-country remote technical support. 15 Key personnel including a Technical Lead with at least four years of relevant experience in software or application support, DevOps, systems integration or digital platform maintenance, and a Service Manager with at least three years of relevant experience in technical support or service delivery. 15 Strength of information security, confidentiality, access control and data protection for privileged remote access to civil registration data; ISO/IEC 27001 certification or equivalent, with full certification scoring higher than alignment alone 15 Ability to mobilise during December 2026 and complete transition by the end of December; credibility of the transition approach; ability to scale for further configurations. Country fit and regional experience 20 Pacific or small island experience; ability to operate across the date line; ability to work through country communication channels; approach to supporting and coaching country first-contact personnel; understanding of limited local technical capacity. Total 100