This Tender Has Expired

The service provider must implement comprehensive security and data protection measures for the RAF Tzaneen CEC Office, covering the six-month contract period starting 01 September 2026.

Key requirements include:

• Document Handling and Transportation:
• Protocols for proper handling and transport of files.
• Secure transportation system (lockable) for files.
• Files must be kept in lockable containers or packaging during handling and transportation to prevent loss, theft, or damage.
• Record Keeping:
• Maintain accurate records of each document stored, including location, access history, and retention schedule.
• Records should be organized for easy and accurate tracking.
• Detailed record of all retrieval activities (date, time, requester, reason).
• Document Retrieval and Storage:
• Secure protocols for retrieving documents, including identity verification.
• Physical documents and records stored in lockable cabinets.
• Access to physical documents and records controlled by authorized personnel only.
• Premises Security:
• Secure perimeter with controlled access and/or surveillance systems.
• Secure doors, locks, and alarms.
• Physical security measures: controlled access points, surveillance cameras, 24/7 security monitoring.
• Adequately protected document storage facilities against unauthorized access.
• Immediate notification to RAF and provision of CCTV footage, police reports, and alarm records in case of any security breach (real, attempted, or suspected).
• Fire suppression system or similar (e.g., carbon dioxide fire extinguishers) on premises.
• Network and Digital Security:
• Digital storage systems must have firewalls, intrusion detection, and encryption.
• Access granted on a need-to-know basis.
• Use strong authentication methods.
• Regularly review and update access permissions.
• Implement robust cybersecurity measures against malware, phishing, and unauthorized access.
• Use encryption for data in transit and at rest, complying with industry standards.
• Regularly update and patch systems, software, and applications.
• Data Protection Obligations:
• Comply with applicable data protection laws and regulations (e.g., POPIA).
• Safeguard data against unauthorized access, disclosure, alteration, and destruction.
• Immediately inform RAF of any data breaches or incidents.
• Impose confidentiality obligations on agents, subcontractors, or third parties.
• Screen or vet third-party service providers for data protection policies and require data protection agreements.
• Incident Reporting and Response:
• Documented incident response plan to address data breaches promptly.
• Timely reporting of security incidents or data breaches to RAF.
• Subcontractors and Third-Party Oversight:
• Ensure subcontractors adhere to the same data protection and cybersecurity standards.
• Service provider is responsible for the actions and compliance of subcontractors/third parties.
• Audit and Monitoring:
• RAF reserves the right to audit and monitor compliance with these security policies.
• Cooperate with RAF audits and assessments.
• Security Vetting:
• RAF reserves the right to conduct security screening or vetting for company directors and provided resources.

The provided document (Annexure A) does not explicitly list mandatory compliance documents such as CSD registration, tax clearance certificates, B-BBEE certificates, CIDB grading, or CIPC details. However, it mandates adherence to the Protection of Personal Information Act (POPIA) and other applicable data protection laws and regulations. The service provider must also ensure any subcontractors meet the same data protection and cybersecurity standards.