Supply, delivery, and installation of steel fire cabinets for the road accident fund (raf) with strict security and data protection compliance

Evaluation criteria are not explicitly detailed in the document. However, the following disqualification risks apply:

• Bidders listed in the Register for Tender Defaulters or the List of Restricted Suppliers will be automatically disqualified.
• Bids will be disqualified if the Declaration of Interest (SBD4) is found to be incomplete or false.
• Collusive bidding or improper consultations with competitors or officials will result in disqualification and potential legal action.

Bidders must complete and submit the Declaration of Interest form (SBD4) with the following mandatory disclosures:

• Confirm whether the bidder, its directors, trustees, shareholders, members, partners, or any person with controlling interest is employed by the state. If yes, provide full particulars (name, ID number, state employee number).
• Disclose any relationship between the bidder or connected persons and employees of the Road Accident Fund (RAF).
• Disclose any interest in related enterprises (bidding or not) held by the bidder or its directors/trustees/shareholders/members/partners.
• Certify that the bid was prepared independently, without collusion, and that no improper consultations or arrangements were made with competitors or RAF officials.
• Acknowledge that false or incomplete declarations may lead to bid rejection, reporting to the Competition Commission or National Prosecuting Authority (NPA), or a 10-year restriction from public sector business under the Prevention and Combating of Corrupt Activities Act No 12 of 2004.

Evaluation will focus on the following: - Capability to supply, deliver, and install steel fire cabinets. - Compliance with RAF’s technical, organisational, and security requirements, including POPIA. - Demonstrated experience in handling confidential/sensitive information and implementing robust security measures. - Management of subcontractors, ensuring their adherence to RAF’s security and data protection standards. - Willingness to subject company directors and resources to RAF security screening or vetting.

Scope: Supply, deliver, and install steel fire cabinets for the Road Accident Fund (RAF).

Security and Compliance Requirements: - Must comply with the Protection of Personal Information Act (POPIA) and RAF’s security policies. - Implement secure handling, transportation, and storage protocols for RAF’s confidential documents:

• Use lockable containers or packaging during transport to prevent loss, theft, or damage.
• Maintain accurate records of document storage, access history, and retention schedules.
• Store physical documents in lockable cabinets with controlled access.
• Ensure secure retrieval protocols, including identity verification of requesters.

Physical Security Measures: - Premises must have:

• Secure perimeter with controlled access and/or surveillance systems.
• Secure doors, locks, and alarms.
• Fire suppression systems (e.g., CO2 fire extinguishers).
• 24/7 security monitoring (where applicable). - Report any real, attempted, or suspected security breaches to RAF, including CCTV footage, police reports, and alarm records.

Access Control: - Restrict document access to authorised personnel only. - Implement access monitoring and control procedures. - Grant access on a need-to-know basis with strong authentication methods. - Regularly review and update access permissions.

Digital Security Measures: - Protect digital storage systems with:

• Firewalls, intrusion detection, and encryption.
• Encryption for data in transit and at rest (industry-standard protocols).
• Regular system, software, and application updates/patches.

Data Protection Obligations: - Handle personal/sensitive data in compliance with POPIA and other applicable laws. - Safeguard data against unauthorised access, disclosure, alteration, or destruction. - Immediately inform RAF of any data breaches or security incidents. - Impose confidentiality obligations on agents, subcontractors, or third parties handling RAF records. - Screen/vet third-party service providers for data protection compliance and require signed data protection agreements. - RAF reserves the right to conduct security screening of company directors and resources.

Incident Reporting and Response: - Maintain a documented incident response plan for data breaches. - Report security incidents or data breaches to RAF promptly.

Subcontractor and Third-Party Oversight: - Ensure subcontractors/third parties adhere to the same data protection and cybersecurity standards. - Service Provider remains responsible for subcontractor compliance.

Audit and Monitoring: - RAF reserves the right to audit and monitor compliance with these security measures. - Service Provider must cooperate with RAF audits or assessments.

Mandatory compliance requirements: - Protection of Personal Information Act (POPIA) adherence. - Data protection and cybersecurity standards as outlined in technical specifications. - Confidentiality agreements for agents, subcontractors, or third parties handling RAF records. - Submission to RAF security screening or vetting of company directors and resources, if required.