Hiring of mobile ablution facilities and water tanks with strict security and data protection requirements for raf office, hatfield

Evaluation is based on compliance and integrity. Key points:

• Open to all natural or juristic persons, except those listed in the Register for Tender Defaulters or the List of Restricted Suppliers.
• Bids will be disqualified if:
• The bidder or any connected person is employed by the state and this is not disclosed.
• There is a relationship with RAF officials that is not disclosed.
• The bidder has interests in related enterprises bidding for the contract and this is not disclosed.
• The disclosure form is incomplete or false.
• Evidence of collusion, price-fixing, or anti-competitive behavior exists.

Scope: Hiring of mobile ablution facilities and water tanks for three (3) days at RAF office, Hatfield.

• Deliverables: Mobile ablution facilities and water tanks for the specified duration.
• Location: RAF office, Hatfield.

Mandatory compliance and disclosure requirements:

• Complete and submit the Bidder’s Disclosure Form (SBD4).
• Declare if the bidder, directors, trustees, shareholders, members, partners, or controlling persons are employed by the state.
• Declare any relationships with RAF officials or employees of the procuring institution.
• Declare any interests in related enterprises bidding for the contract.
• Certify that the bid was prepared independently without collusion.
• Certify no prior involvement in drafting specifications or terms of reference.
• Must not be listed in the Register for Tender Defaulters or the List of Restricted Suppliers.
• Compliance with the Competition Act No. 89 of 1998 and Prevention and Combating of Corrupt Activities Act No. 12 of 2004 is mandatory.
• False or incomplete declarations may result in bid rejection, administrative penalties, or a 10-year restriction from public sector business.

Evaluation will focus on the service provider's ability to meet security and data protection requirements. Key points: - Demonstrate compliance with POPIA and RAF-specific security policies. - Provide evidence of secure facilities, including physical security (e.g., controlled access, surveillance, alarms, fire suppression). - Show documented procedures for data handling, transportation (lockable containers), storage (lockable cabinets), and access control (need-to-know basis, strong authentication). - Prove capability for network security (firewalls, encryption, regular updates) and cybersecurity (encryption in transit/at rest, incident response plan). - Confirm ability to vet and manage subcontractors for compliance with the same standards. - RAF may audit compliance and reserves the right to vet company directors and resources.

Scope: Hire mobile ablution facilities and water tanks for 3 days at RAF office, Hatfield. Security and compliance requirements: - Implement policies for POPIA compliance and RAF-specific data protection. - Document handling and transportation: Use lockable containers; maintain records of storage, access history, and retention schedules. - Secure retrieval: Verify requester identity; transport documents securely; log all retrieval activities (date, time, requester, reason). - Secure storage: Use lockable cabinets; restrict access to authorised personnel; monitor access. - Physical security: Secure perimeter with controlled access, surveillance, alarms, and 24/7 monitoring; fire suppression systems (e.g., CO2 extinguishers) required. - Network security: Firewalls, intrusion detection, encryption, and regular system updates/patching. - Access control: Grant access on a need-to-know basis; use strong authentication; regularly review permissions. - Data protection: Safeguard against unauthorised access, disclosure, alteration, or destruction; report breaches immediately to RAF; ensure confidentiality obligations for agents/subcontractors. - Cybersecurity: Encrypt data in transit and at rest; comply with industry standards; maintain an incident response plan. - Subcontractors: Ensure third parties adhere to the same security and data protection standards; RAF may audit or vet subcontractors. - Incident reporting: Documented plan for addressing breaches; timely reporting to RAF. - Audits: RAF reserves the right to audit compliance; service provider must cooperate.

Mandatory compliance: - Protection of Personal Information Act (POPIA). - Legislative and regulatory frameworks for data protection and cybersecurity. - Third-party service providers handling personal information must be vetted and required to sign a data protection agreement. - RAF may conduct security screening or vetting for company directors and resources provided.