Supply of adobe creative cloud (all apps) licenses with strict data security and compliance requirements

Evaluation is based on compliance with the following: - Open to all natural or juristic persons, except those listed in the Register for Tender Defaulters or the List of Restricted Suppliers. - Bidders, their directors, trustees, shareholders, or controlling parties must disclose any state employment or relationships with RAF officials. - Bids must be submitted independently, without consultation or agreement with competitors (excluding joint ventures/consortia). - Full compliance with the Constitution of South Africa, Competition Act No. 89 of 1998, and Prevention and Combating of Corrupt Activities Act No. 12 of 2004 is required.

Mandatory compliance requirements: - Complete and submit the Declaration of Interest (SBD4 form) with the bid. - Disclose if the bidder or any director/trustee/shareholder/partner is employed by the state. If yes, provide full names, ID numbers, and state employee numbers. - Disclose if the bidder or any connected person has a relationship with anyone employed by the Road Accident Fund. If yes, provide particulars. - Disclose if the bidder or any director/trustee/shareholder/partner has an interest in any other related enterprise bidding for this contract. If yes, provide particulars. - Certify that the bid was prepared independently without collusion, price-fixing, or market allocation agreements with competitors. - Certify that no prior consultations or arrangements were made with procuring institution officials, except for clarification requests. - Acknowledge that false declarations may lead to bid rejection, Competition Commission penalties, NPA criminal investigation, or a 10-year public sector restriction under the Prevention and Combating of Corrupt Activities Act. - Bidders listed in the Register for Tender Defaulters or the List of Restricted Suppliers will be automatically disqualified.

Evaluation will assess the service provider's ability to meet the following criteria: Secure premises with controlled access and surveillance systems; secure document transportation systems (e.g., lockable containers); compliance with POPIA and RAF-specific data protection requirements; cybersecurity measures including encryption for data in transit and at rest; documented incident response plan for data breaches; ability to maintain detailed records of document storage, access history, and retrieval activities; willingness to undergo RAF security vetting of directors and resources.

Scope: Supply Adobe Creative Cloud (All Apps) licenses for a 12-month period. Security and compliance requirements: Implement technical and organisational measures to handle RAF’s confidential, personal, or sensitive information (files, data, documents).

Document Handling and Transportation:

• Use lockable containers or packaging to prevent loss, theft, or damage during transport.
• Maintain accurate records of document storage, location, access history, and retention schedules.

Document Retrieval and Handling:

• Use secure protocols for retrieval, including identity verification of requesters.
• Maintain detailed records of all retrieval activities (date, time, requester identity, reason).
• Store physical documents in lockable cabinets to prevent unauthorised access or tampering.
• Restrict access to authorised personnel only, with controlled and monitored access policies.

Physical Security:

• Secure premises with controlled access, surveillance systems, secure doors, locks, and alarms.
• Implement fire suppression systems (e.g., CO2 fire extinguishers) to protect documents.
• Report any real, attempted, or suspected security breaches to RAF, including CCTV footage, police reports, and alarm records.

Digital Security:

• Use firewalls, intrusion detection, and encryption for digital document storage systems.
• Grant access on a need-to-know basis with strong authentication methods.
• Regularly review and update access permissions.

Data Protection:

• Handle and process personal/sensitive data in compliance with POPIA and other applicable laws.
• Safeguard data against unauthorised access, disclosure, alteration, or destruction.
• Immediately inform RAF of any data breaches or security incidents.
• Impose confidentiality obligations on agents, subcontractors, or third parties handling records.
• Screen or vet third-party service providers for data protection policies and require signed data protection agreements.

Cybersecurity:

• Implement robust measures against cyber threats (malware, phishing, unauthorised access).
• Use encryption for data in transit and at rest, complying with industry standards.
• Regularly update and patch systems, software, and applications to address vulnerabilities.

Incident Reporting and Response:

• Maintain a documented incident response plan for prompt breach mitigation.
• Report security incidents or data breaches to RAF in a timely manner.

Subcontractors and Third-Party Oversight:

• Ensure subcontractors adhere to the same data protection and cybersecurity standards.
• Assume responsibility for subcontractor or third-party compliance.

Audit and Monitoring:

• Cooperate with RAF audits or assessments to evaluate compliance with security standards.

Mandatory compliance with the Protection of Personal Information Act (POPIA). Data protection and cybersecurity standards must align with legislative and regulatory frameworks. RAF reserves the right to conduct security screening or vetting for company directors and resources provided.