Provision of regulation 21 refresher firearm training and shooting range facility for raf security personnel

The Road Accident Fund (RAF) requires a service provider to deliver Regulation 21 refresher exercises for handgun, self-loading rifle, and Shooting Range facility for Security Personnel over a 12-month period. The service includes secure handling of RAF’s confidential, private, personal, or sensitive information in compliance with POPIA.

Scope: Provide Regulation 21 refresher exercises for handgun, self-loading rifle, and Shooting Range facility for Security Personnel over 12 months.

Key Requirements:

• Secure handling, transportation, and storage of RAF confidential, private, personal, or sensitive information (files, data, or documents).
• Compliance with the Protection of Personal Information Act (POPIA).
• Secure transportation system (lockable containers) for transferring files to and from premises.
• Document handling protocols to prevent loss, theft, or damage.
• Accurate record-keeping for stored documents, including location, access history, and retention schedule.
• Secure retrieval protocols, including identity verification of requesters.
• Physical storage in lockable cabinets to prevent unauthorised access or tampering.
• Access control limited to authorised personnel only, with monitored and controlled procedures.
• Fire suppression systems (e.g., CO2 fire extinguishers) to protect documents from fire damage.

Data Protection and Security:

• Full compliance with the Protection of Personal Information Act (POPIA).
• Implementation of measures to safeguard data against unauthorised access, disclosure, alteration, or destruction.
• Immediate reporting of any data breaches or security incidents to the RAF.
• Confidentiality obligations imposed on agents, subcontractors, or third parties handling records.
• Third-party service providers handling PII must be vetted for data protection policies and required to sign a data protection agreement.
• RAF reserves the right to conduct security screening or vetting of company directors and resources.

Cybersecurity:

• Robust cybersecurity measures to protect against threats such as malware, phishing, and unauthorised access.
• Encryption for data in transit and at rest, using industry-standard protocols and algorithms.
• Regular updates and patching of systems, software, and applications to address vulnerabilities.
• Documented incident response plan for data breaches.
• Subcontractors must adhere to the same data protection and cybersecurity standards.

Audit and Monitoring:

• RAF reserves the right to audit and monitor compliance with security policies.
• Service Provider must cooperate with audits or assessments conducted by RAF.

Physical Security:

• Secure perimeter with controlled access, surveillance systems, secure doors, locks, and alarms.
• 24/7 security monitoring for document storage facilities.
• Immediate reporting of any real, attempted, or suspected physical security breaches, including provision of CCTV footage, police reports, and alarm system records.

Fire Safety:

• Service Provider’s premises must have a fire suppression system or equivalent (e.g., CO2 fire extinguishers) to prevent damage or loss of documents and records in case of fire.

Physical Security:

• Secure perimeter with controlled access and/or surveillance systems.
• Secure doors, locks, and alarms to prevent unauthorised access.
• 24/7 security monitoring for document storage facilities.
• Access control policies to ensure only authorised personnel handle, view, or transport documents.

Security and Compliance:

• Service Provider must ensure physical security of records, including controlled access points, surveillance cameras, and 24/7 monitoring.
• All document storage facilities must be protected against unauthorised access.
• Immediate reporting of any real, attempted, or suspected physical security breaches to RAF, including CCTV footage, police reports, and alarm records.

Network Security:

• Digital storage systems must have firewalls, intrusion detection, and encryption to prevent unauthorised access or attacks.

Access Control:

• Access granted on a need-to-know basis.
• Strong authentication methods required for system and data access.
• Regular review and updates of access permissions.

Data Protection:

• Compliance with applicable data protection laws and regulations.
• Measures to safeguard data against unauthorised access, disclosure, alteration, or destruction.
• Immediate notification to RAF of any data breaches or incidents impacting information security.
• Confidentiality obligations for agents, subcontractors, or third parties.
• Third-party service providers handling PII must be vetted and required to sign a data protection agreement.
• RAF reserves the right to conduct security screening or vetting of company directors and resources.

Cybersecurity:

• Robust measures to protect against cyber threats (malware, phishing, unauthorised access).
• Encryption for data in transit and at rest, using industry-standard protocols.
• Regular system, software, and application updates to address vulnerabilities.

Incident Reporting:

• Documented incident response plan for data breaches.
• Timely reporting of security incidents or data breaches to RAF.

Subcontractors and Third-Party Oversight:

• Subcontractors must adhere to the same data protection and cybersecurity standards.
• Service Provider is responsible for subcontractor compliance.

Audit and Monitoring:

• RAF reserves the right to audit and monitor compliance.
• Service Provider must cooperate with RAF audits or assessments.

Confidential Information Handling:

• Service Provider will be entrusted with RAF’s confidential, private, personal, or sensitive information (files, data, or documents).
• Must comply with the provisions of the Protection of Personal Information Act (POPIA).

Document Handling and Transportation:

• Secure transportation system (lockable containers) required for transferring files to and from premises.
• Protocols must prevent loss, theft, or damage of documents.

Record Keeping:

• Maintain accurate records of each stored document, including location, access history, and retention schedule.
• Records must be organised for easy and accurate tracking.

Document Retrieval:

• Secure protocols for retrieving documents, including identity verification of requesters.
• Detailed records of all retrieval activities, including date, time, requester identity, and reason for retrieval.

Secure Storage:

• Physical documents and records must be stored in lockable cabinets to prevent unauthorised access or tampering.

Access Control:

• Documents and records accessible only to authorised personnel.
• Policies and procedures must ensure controlled and monitored access.