The service provider must maintain physical security of records, with controlled access points, surveillance cameras, and 24/7 monitoring. Storage facilities must be protected against unauthorised access. Any real, attempted, or suspected breach of physical security must be reported to the RAF, including providing CCTV footage, police report, and linked alarm system records.
Access to documents and records must be controlled, with only authorised personnel permitted to handle, view, or transport them. Access monitoring and control procedures must be in place.
Network security: digital storage systems must have firewalls, intrusion detection, and encryption.
Access control: grant access on a need-to-know basis, use strong authentication, regularly review and update permissions.
Data protection obligations: handle personal and sensitive data in compliance with applicable laws; safeguard against unauthorised access, disclosure, alteration, destruction; inform RAF immediately of data breaches; impose confidentiality obligations on agents, subcontractors, or third parties; comply with legislative and regulatory frameworks; third-party service providers handling PII must be screened/vetted and sign a data protection agreement; RAF may conduct security screening or vetting of company directors and resources.
Cybersecurity standards: robust measures against malware, phishing, unauthorised access; encryption for data in transit and at rest; regular updates and patching.
Incident reporting: documented incident response plan; report security incidents or data breaches to RAF promptly.
Subcontractors: must adhere to same data protection and cybersecurity standards; service provider responsible for their compliance.
Audit and monitoring: RAF reserves right to audit and monitor compliance; service provider must cooperate with audits or assessments.