Occupational hygiene surveys & ergonomics risk assessment services for raf johannesburg office

Provide Occupational Hygiene Surveys and Ergonomics Risk Assessment for the RAF Johannesburg Office. Work involves handling confidential, private, or sensitive information, requiring strict compliance with data protection and security measures.

Scope: Provide Occupational Hygiene Surveys and Ergonomics Risk Assessment for RAF Johannesburg Office.

Key Requirements:

• Conduct surveys and assessments in compliance with the Protection of Personal Information Act (POPIA).
• Handle RAF’s confidential, private, personal, or sensitive information securely.

Data Protection and Security:

• Full compliance with the Protection of Personal Information Act (POPIA).
• Implement policies and measures to safeguard personal, confidential, and sensitive data.
• Ensure third-party service providers handling PII are vetted and sign data protection agreements.
• RAF reserves the right to conduct security screening or vetting for company directors and resources.

Physical Security:

• Secure perimeter with controlled access and/or surveillance systems.
• Secure doors, locks, and alarms to prevent unauthorised access.
• Fire suppression system (e.g., CO2 fire extinguishers) to protect documents and records.

Document Handling:

• Secure transportation system (lockable containers) for files to/from premises.
• Maintain accurate records of document storage, access history, and retention schedules.
• Secure retrieval protocols, including identity verification of requesters.

Access Control:

• Restrict document access to authorised personnel only.
• Monitor and control access to documents, records, and storage facilities.
• Grant system access on a need-to-know basis with strong authentication methods.

Cybersecurity:

• Implement robust measures against cyber threats (malware, phishing, unauthorised access).
• Use encryption for data in transit and at rest (industry-standard protocols).
• Regularly update and patch systems, software, and applications.

Incident Reporting:

• Documented incident response plan for data breaches.
• Timely reporting of security incidents or breaches to RAF.

Subcontractors:

• Ensure subcontractors adhere to the same data protection and cybersecurity standards.
• Service Provider remains responsible for subcontractor compliance.

Audit and Monitoring:

• RAF reserves the right to audit and monitor compliance.
• Service Provider must cooperate with audits and assessments.

Fire Safety:

• Premises must have a fire suppression system or equivalent (e.g., CO2 fire extinguishers) to prevent damage or loss of documents/records.

Physical Security:

• Secure perimeter with controlled access and/or surveillance systems.
• Secure doors, locks, and alarms to prevent unauthorised access.
• Ensure physical security of all records in possession.

Security and Compliance:

• Service Provider must ensure physical security of all RAF documents and records in their possession.
• Document storage facilities must be protected against unauthorised access.
• Report any real, attempted, or suspected physical security breaches to RAF, including CCTV footage, police reports, and alarm records.

Data Protection:

• Handle and process personal/sensitive data in compliance with POPIA and other applicable laws.
• Safeguard data against unauthorised access, disclosure, alteration, or destruction.
• Impose confidentiality obligations on agents, subcontractors, or third parties with access to records.
• Screen/vetting of third-party service providers handling PII, with signed data protection agreements.

Cybersecurity:

• Implement robust measures against cyber threats (malware, phishing, unauthorised access).
• Use encryption for data in transit and at rest (industry-standard protocols).
• Regularly update and patch systems, software, and applications.

Incident Reporting:

• Maintain a documented incident response plan for data breaches.
• Report security incidents or breaches to RAF promptly.

Subcontractors:

• Subcontractors must adhere to the same data protection and cybersecurity standards.
• Service Provider is responsible for subcontractor compliance.

Audit Rights:

• RAF reserves the right to audit and monitor compliance with security policies.
• Service Provider must cooperate with audits and assessments.

Network Security:

• Digital document storage systems must have technical security measures (firewalls, intrusion detection, encryption) to protect against unauthorised access or attacks.