Cloud administrator learnership programme for the road accident fund (raf)

Service Providers must have policies in place to comply with RAF requirements and POPIA, maintain secure facilities with controlled access and surveillance, have fire suppression systems, implement robust cybersecurity measures, and be willing to submit to security screening and audits by RAF. Third-party service providers handling PII must be vetted for data protection policies and sign data protection agreements.

The service provider must implement the following technical and organisational security measures for handling RAF’s confidential, private, personal, or sensitive information (files, data, or documents):

• Document Handling and Transportation:
• Use secure, lockable transportation systems for transferring files to and from premises.
• Ensure files are kept in lockable containers during transit to prevent loss, theft, or damage.

• Record Keeping:
• Maintain accurate records of each document, including location, access history, and retention schedule.
• Organise records for easy and accurate tracking.

• Document Retrieval and Handling:
• Use secure protocols for retrieving documents, including identity verification of requesters.
• Log all retrieval activities (date, time, requester identity, and reason).
• Store physical documents in lockable cabinets to prevent unauthorised access or tampering.

• Access Control:
• Restrict document access to authorised personnel only.
• Implement policies to control and monitor access to documents and storage facilities.

• Physical Security:
• Secure premises with controlled access points, surveillance cameras, and/or 24/7 monitoring.
• Equip premises with secure doors, locks, and alarms.
• Install fire suppression systems (e.g., CO2 fire extinguishers) to protect documents.

• Network and Digital Security:
• Implement firewalls, intrusion detection, and encryption for digital storage systems.
• Grant access on a need-to-know basis with strong authentication methods.
• Regularly review and update access permissions.

• Data Protection Obligations:
• Comply with the Protection of Personal Information Act (POPIA) and other applicable data protection laws.
• Safeguard data against unauthorised access, disclosure, alteration, or destruction.
• Immediately report any data breaches or security incidents to the RAF.
• Impose confidentiality obligations on agents, subcontractors, or third parties handling records.
• Screen or vet third-party service providers for data protection compliance and require signed data protection agreements.

• Cybersecurity Standards:
• Implement robust measures against cyber threats (e.g., malware, phishing, unauthorised access).
• Use industry-standard encryption for data in transit and at rest.
• Regularly update and patch systems, software, and applications to address vulnerabilities.

• Incident Reporting and Response:
• Maintain a documented incident response plan for data breaches.
• Report security incidents or breaches to the RAF promptly.

• Subcontractors and Third-Party Oversight:
• Ensure subcontractors adhere to the same data protection and cybersecurity standards.
• Assume responsibility for subcontractor or third-party compliance.

• Audit and Monitoring:
• Cooperate with RAF audits or assessments to evaluate compliance with security standards.

Compliance with the following is mandatory:

• Legislative and Regulatory Frameworks:
• Full compliance with the Protection of Personal Information Act (POPIA) for processing personal information.

• Data Protection and Security:
• Implement measures to ensure confidentiality of personal, confidential, and sensitive data.
• Screen or vet third-party service providers handling personally identifiable information (PII) and require signed data protection agreements.
• Allow RAF to conduct security screening or vetting of company directors and resources.

• Security Standards:
• Maintain physical security measures (e.g., controlled access, surveillance, alarms) for document storage facilities.
• Report any real, attempted, or suspected physical security breaches to the RAF, including providing CCTV footage, police reports, and alarm records.
• Implement cybersecurity measures (e.g., encryption, firewalls, intrusion detection) to protect against unauthorised access or attacks.

• Audit Cooperation:
• Permit RAF to audit and monitor compliance with data protection and cybersecurity standards.

Health and safety requirements for the service provider’s premises:

• Install a fire suppression system (e.g., CO2 fire extinguishers) to prevent damage or loss of documents and records in the event of a fire.
• Ensure premises have a secure perimeter with controlled access and/or surveillance systems.
• Equip premises with secure doors, locks, and alarms to prevent unauthorised access.
• Implement physical security measures to protect records, including controlled access points and 24/7 monitoring.

Contractual obligations include:

• Physical Security:
• Ensure document storage facilities are protected against unauthorised access with controlled access points, surveillance cameras, and 24/7 monitoring.
• Report any real, attempted, or suspected physical security breaches to the RAF, including providing CCTV footage, police reports, and alarm system records.

• Digital Security:
• Implement firewalls, intrusion detection, and encryption to protect against unauthorised access or attacks.

• Access Control:
• Grant access on a need-to-know basis.
• Use strong authentication methods for systems and data access.
• Regularly review and update access permissions.

• Data Protection Obligations:
• Handle and process personal and sensitive data in compliance with applicable laws and regulations.
• Safeguard data against unauthorised access, disclosure, alteration, or destruction.
• Immediately inform the RAF of any data breaches or incidents impacting information security.
• Ensure confidentiality of personal, confidential, and sensitive data, including imposing obligations on agents, subcontractors, or third parties.

• Third-Party Management:
• Screen or vet third-party service providers handling PII for their data protection policies and procedures.
• Require third parties to sign data protection agreements.
• Allow RAF to conduct security screening or vetting of company directors and resources.

• Cybersecurity Standards:
• Implement robust measures to protect against cyber threats (e.g., malware, phishing, unauthorised access).
• Use industry-standard encryption for data in transit and at rest.
• Regularly update and patch systems, software, and applications.

• Incident Reporting and Response:
• Maintain a documented incident response plan for data breaches.
• Report security incidents or breaches to the RAF in a timely manner.

• Subcontractor Oversight:
• Ensure subcontractors adhere to the same data protection and cybersecurity standards.
• Assume responsibility for subcontractor or third-party compliance.

• Audit and Monitoring:
• Cooperate with RAF audits or assessments to evaluate compliance with data protection and cybersecurity standards.

Special conditions for handling RAF’s confidential, private, personal, or sensitive information:

• The service provider is entrusted with RAF’s files, data, and/or documents and must comply with RAF requirements and the Protection of Personal Information Act (POPIA).
• Implement secure protocols for document handling and transportation, including lockable containers to prevent loss, theft, or damage.
• Maintain accurate records of each document, including location, access history, and retention schedule, organised for easy tracking.
• Use secure retrieval protocols, including identity verification of requesters and secure transport of documents.
• Log all retrieval activities, including date, time, requester identity, and reason for access.
• Store physical documents in lockable cabinets to prevent unauthorised access or tampering.
• Restrict document access to authorised personnel only and monitor access to storage facilities.