Servicing of fire suppression system at raf durban office

The service provider must comply with the provisions of the Protection of Personal Information Act (POPIA).

Service providers must: 1. Have policies to comply with RAF requirements and POPIA 2. Possess secure premises with controlled access and surveillance systems 3. Implement robust cybersecurity measures including encryption 4. Maintain accurate document tracking and access records 5. Have secure transportation systems for document transfer 6. Provide physical security measures and fire suppression systems 7. Allow RAF to audit compliance and conduct security vetting of directors and resources

The service provider must comply with the Protection of Personal Information Act (POPIA).

• The service provider must implement technical and organisational security measures to protect RAF's confidential, private, personal, or sensitive information (files, data, documents).
• The service provider's premises must have a fire suppression system or similar (e.g., carbon dioxide fire extinguishers) to prevent damage or loss of documents in a fire.
• The service provider's premises must have a secure perimeter with controlled access and/or surveillance systems, secure doors, locks, and alarms.
• Physical security measures must include controlled access points, surveillance cameras, and/or 24/7 security monitoring.
• Document storage facilities must be adequately protected against unauthorised access.
• Digital document storage systems must have technical security measures like firewalls, intrusion detection, and encryption.
• The service provider must have protocols for secure document handling and transportation, using lockable containers and a secure transportation system.
• The service provider must maintain accurate records of each document stored, including location, access history, and retention schedule.
• Secure retrieval protocols must include verifying the requester's identity and ensuring secure transport.
• Detailed records of all retrieval activities must be kept.
• Physical documents must be stored in lockable cabinets.
• Access to documents must be controlled and limited to authorised personnel, with policies and procedures for access control and monitoring.
• Network security must include access control on a need-to-know basis, strong authentication methods, and regular review of access permissions.
• Data protection obligations require compliance with applicable laws, safeguarding against unauthorised access, disclosure, alteration, and destruction, and immediate reporting of data breaches to RAF.
• Cybersecurity standards require robust measures against cyber threats, encryption for data in transit and at rest using industry-standard protocols, and regular system updates and patching.
• An incident response plan for data breaches is required.
• Subcontractors must adhere to the same data protection and cybersecurity standards.
• RAF reserves the right to audit and monitor compliance, and the service provider must cooperate.

The service provider must comply with the Protection of Personal Information Act (POPIA).

• The service provider must have policies in place to comply with RAF requirements and POPIA.
• Data protection obligations include handling personal and sensitive data in compliance with applicable laws and regulations.
• Measures must be implemented to safeguard data against unauthorised access, disclosure, alteration, and destruction.
• Immediate reporting of any data breaches or security incidents to RAF is required.
• Confidentiality obligations must be imposed on agents, subcontractors, or third parties who receive records.
• Third-party service providers handling personally identifiable information (PII) must be vetted for data protection policies and required to sign a data protection agreement.
• RAF reserves the right to conduct security screening or vetting for company directors and resources provided.
• The service provider must cooperate with RAF audits and assessments for compliance with data protection and cybersecurity standards.

• The service provider's premises must have a fire suppression system or similar (e.g., carbon dioxide fire extinguishers) to prevent damage or loss of documents and records in a fire.
• The premises must have a secure perimeter with controlled access and/or surveillance systems, secure doors, locks, and alarms to prevent unauthorised access.
• Physical security measures must ensure the safety and security of documents.

• The service provider must ensure physical security of documents, including controlled access points, surveillance cameras, and/or 24/7 security monitoring.
• All document storage facilities must be adequately protected against unauthorised access.
• Any real, attempted, or suspected breach of physical security must be reported to RAF, providing CCTV footage, police reports, and alarm system records.
• Network security measures like firewalls, intrusion detection, and encryption must protect against unauthorised access or attacks.
• Access control must be granted on a need-to-know basis, using strong authentication methods, with regular review and update of permissions.
• Data protection obligations require compliance with applicable laws, safeguarding data, immediate reporting of breaches, and imposing confidentiality obligations on agents, subcontractors, or third parties.
• Third-party service providers handling PII must be vetted and sign a data protection agreement.
• RAF reserves the right to conduct security screening for company directors and resources.
• Cybersecurity standards require robust measures against cyber threats, encryption for data in transit and at rest using industry standards, and regular system updates.
• A documented incident response plan for data breaches is required, with timely reporting to RAF.
• Subcontractors must adhere to the same data protection and cybersecurity standards, and the service provider is responsible for their compliance.
• RAF reserves the right to audit and monitor compliance, and the service provider must cooperate.

• The service provider will handle RAF's confidential, private, personal, or sensitive information (files, data, documents) and must comply with the Protection of Personal Information Act (POPIA).
• Document handling and transportation require a secure (lockable) transportation system and protocols to prevent loss, theft, or damage.
• Security measures include using lockable containers during handling and transportation.
• Record keeping must maintain accurate records of each document stored, including location, access history, and retention schedule, organised for easy tracking.
• Secure retrieval protocols must verify the requester's identity and ensure secure transport.
• Record keeping for retrievals must include date, time, requester identity, and reason.
• Secure storage requires lockable cabinets to prevent unauthorised access or tampering.
• Access control policies and procedures must ensure access is controlled and monitored.
• Document access control must limit handling, viewing, or transport to authorised personnel only.
• Access monitoring and control procedures must ensure only authorised personnel access documents, records, and storage facilities.
• Network security requires appropriate technical measures like firewalls, intrusion detection, and encryption.