Maintenance, servicing, and repair of security systems for raf durban office (6-Month contract)

Scope: Maintain, service, and repair security systems at the RAF Durban Office on a month-to-month basis for up to six months.

Core Security Requirements for Handling RAF Documents and Data:

• Securely manage RAF’s confidential, private, personal, or sensitive information (files, data, documents) in compliance with RAF policies and POPIA.

Document Handling and Transportation:

• Implement protocols for secure handling and transport of files to/from your premises.
• Use lockable containers or packaging to prevent loss, theft, or damage during transit.
• Maintain accurate records of each document, including location, access history, and retention schedule.

Document Retrieval and Handling:

• Use secure protocols for retrieval, including identity verification of requesters.
• Maintain detailed records of all retrieval activities (date, time, requester identity, reason).
• Store physical documents in lockable cabinets to prevent unauthorised access or tampering.
• Restrict access to authorised personnel only, with controlled and monitored procedures.
• Equip premises with fire suppression systems (e.g., CO2 fire extinguishers).

Physical and Facility Security:

• Secure perimeter with controlled access and/or surveillance systems.
• Install secure doors, locks, and alarms to prevent unauthorised access.
• Implement 24/7 security monitoring and surveillance cameras.
• Report any real, attempted, or suspected physical security breaches to RAF, including CCTV footage, police reports, and alarm records.

Access Control and Monitoring:

• Control and monitor access to documents and storage facilities.
• Grant access on a need-to-know basis.
• Use strong authentication methods for systems and data access.
• Regularly review and update access permissions.

Network and Cybersecurity:

• Implement firewalls, intrusion detection, and encryption for digital document storage systems.
• Use encryption for data in transit and at rest, complying with industry standards.
• Regularly update and patch systems, software, and applications to address vulnerabilities.

Data Protection Obligations:

• Handle and process personal/sensitive data in compliance with POPIA and other applicable laws.
• Safeguard data against unauthorised access, disclosure, alteration, or destruction.
• Immediately inform RAF of any data breaches or security incidents.
• Impose confidentiality obligations on agents, subcontractors, or third parties handling records.
• Ensure third-party service providers handling PII are vetted and sign data protection agreements.
• RAF reserves the right to conduct security screening or vetting of company directors and resources.

Incident Reporting and Response:

• Maintain a documented incident response plan for data breaches.
• Report security incidents or data breaches to RAF promptly.

Subcontractors and Third-Party Oversight:

• Ensure subcontractors adhere to the same data protection and cybersecurity standards.
• Take responsibility for subcontractor or third-party compliance.

Audit and Monitoring:

• RAF reserves the right to audit and monitor compliance with these security measures.
• Cooperate with RAF audits or assessments.

Mandatory Compliance:

• Full compliance with the Protection of Personal Information Act (POPIA).
• Adherence to RAF’s data protection and cybersecurity standards as outlined in technical specifications.
• Third-party service providers handling PII must be vetted and required to sign data protection agreements.
• RAF reserves the right to conduct security screening or vetting of company directors and resources.