Accredited provider for online learnership programme – basic law certification (12 months)

Documented mandatory security and data protection requirements for the service provider handling RAF information:

• Physical security: lockable transport containers, secure storage cabinets, fire suppression systems, and premises with controlled access, surveillance cameras and 24/7 monitoring.
• Document handling: protocols for safe handling, transport and storage; lockable containers; detailed record‑keeping of location, access history and retention schedule.
• Access control: only authorised personnel may retrieve or view documents; identity verification of requesters; regular review of permissions.
• Record keeping of retrieval: log date, time, requester identity and reason for each access.
• Cybersecurity: firewalls, intrusion detection systems, encryption for data at rest and in transit, regular patching and updates, strong authentication.
• Data protection (POPIA compliance): safeguard personal/sensitive data, immediate breach reporting to RAF, confidentiality obligations for agents/sub‑contractors, data protection agreements where required.
• Incident response: documented plan, timely reporting of security incidents to RAF.
• Sub‑contractor oversight: same security and data protection standards must be imposed on any subcontractors; provider remains liable for their compliance.
• Audit rights: RAF may audit and monitor compliance; provider must cooperate with audits.