How will bids be evaluated?

The service provider must have the necessary policies and procedures in place to comply with RAF requirements and the provisions of the Protection of Personal Information Act. They must also have a secure facility with controlled access, surveillance systems, and physical security measures to ensure the safety and security of documents.

What are the technical specifications?

The service provider must comply with the Protection of Personal Information Act (POPIA). - The service provider will handle RAF's confidential, private, personal, or sensitive information (files, data, documents). - The service provider must have policies and procedures to comply with RAF requirements and POPIA. - Implement the following security measures: 1. Document Handling and Transportation: - Have protocols for proper handling and transport of files to and from the service provider's premises. - Use a secure, lockable transportation system. - Keep files in lockable containers during handling and transport to prevent loss, theft, or damage. - Maintain accurate records of each document stored, including location, access history, and retention schedule. 2. Document Retrieval and Handling: - Use secure protocols for retrieval, including verifying requester identity and ensuring secure transport. - Maintain detailed records of all retrieval activities (date, time, requester identity, reason). - Store physical documents and records in lockable cabinets. - Implement access control policies so only authorised personnel can handle, view, or transport documents. - Premises must have a fire suppression system (e.g., carbon dioxide fire extinguishers) to prevent document loss in a fire. 3. Security and Secure Facility: - Premises must have a secure perimeter with controlled access and/or surveillance systems, secure doors, locks, and alarms. - Implement physical security measures: controlled access points, surveillance cameras, and/or 24/7 security monitoring. - Report any real, attempted, or suspected physical security breach to RAF, providing CCTV footage, police reports, and alarm records. - Implement access monitoring and control procedures. - Digital storage systems must have technical security measures: firewalls, intrusion detection, encryption. - Access control: grant on a need-to-know basis, use strong authentication, regularly review permissions. - Data protection: handle personal/sensitive data in compliance with laws; safeguard against unauthorised access, disclosure, alteration, destruction; report data breaches immediately to RAF; impose confidentiality obligations on agents, subcontractors, or third parties. - Third-party service providers handling PII must be vetted and sign a data protection agreement. - RAF reserves the right to conduct security screening of company directors and resources. - Cybersecurity: implement robust measures against malware, phishing, unauthorised access; use encryption for data in transit and at rest; regularly update and patch systems. - Have a documented incident response plan and report security incidents/data breaches to RAF promptly. - Ensure subcontractors adhere to the same data protection and cybersecurity standards. - Cooperate with RAF audits and monitoring of compliance.

What compliance and legal requirements must bidders meet?

The service provider must comply with data protection laws, including the Protection of Personal Information Act (POPIA). - Implement security measures to protect confidential, private, personal, or sensitive information. - Have policies and procedures for document handling, transportation, storage, retrieval, and access control. - Premises must have physical security (controlled access, surveillance, alarms) and fire suppression. - Implement cybersecurity measures: firewalls, intrusion detection, encryption, regular updates. - Report any physical security breaches or data incidents to RAF immediately. - Third-party service providers must be vetted and sign data protection agreements. - RAF reserves the right to audit compliance and conduct security screening of company directors and resources.

Road Accident Fund Office Space Rental Tender in Limpopo

Technical Specifications

Source: Annexure A - Security Measures.pdf (unknown)

The service provider must comply with the Protection of Personal Information Act (POPIA).

The service provider will handle RAF's confidential, private, personal, or sensitive information (files, data, documents).
The service provider must have policies and procedures to comply with RAF requirements and POPIA.
Implement the following security measures:

Document Handling and Transportation:

Have protocols for proper handling and transport of files to and from the service provider's premises.
Use a secure, lockable transportation system.
Keep files in lockable containers during handling and transport to prevent loss, theft, or damage.
Maintain accurate records of each document stored, including location, access history, and retention schedule.

Document Retrieval and Handling:

Use secure protocols for retrieval, including verifying requester identity and ensuring secure transport.
Maintain detailed records of all retrieval activities (date, time, requester identity, reason).
Store physical documents and records in lockable cabinets.
Implement access control policies so only authorised personnel can handle, view, or transport documents.
Premises must have a fire suppression system (e.g., carbon dioxide fire extinguishers) to prevent document loss in a fire.

Security and Secure Facility:

Premises must have a secure perimeter with controlled access and/or surveillance systems, secure doors, locks, and alarms.
Implement physical security measures: controlled access points, surveillance cameras, and/or 24/7 security monitoring.
Report any real, attempted, or suspected physical security breach to RAF, providing CCTV footage, police reports, and alarm records.
Implement access monitoring and control procedures.
Digital storage systems must have technical security measures: firewalls, intrusion detection, encryption.
Access control: grant on a need-to-know basis, use strong authentication, regularly review permissions.
Data protection: handle personal/sensitive data in compliance with laws; safeguard against unauthorised access, disclosure, alteration, destruction; report data breaches immediately to RAF; impose confidentiality obligations on agents, subcontractors, or third parties.
Third-party service providers handling PII must be vetted and sign a data protection agreement.
RAF reserves the right to conduct security screening of company directors and resources.
Cybersecurity: implement robust measures against malware, phishing, unauthorised access; use encryption for data in transit and at rest; regularly update and patch systems.
Have a documented incident response plan and report security incidents/data breaches to RAF promptly.
Ensure subcontractors adhere to the same data protection and cybersecurity standards.
Cooperate with RAF audits and monitoring of compliance.

DocumentRFQ Document PR10117389 Rental of Office Space Polokwane.docxReview complete

Description

Source: RFQ Document PR10117389 Rental of Office Space Polokwane.docx

Service providers/suppliers should ensure that RFQ responses are emailed to the correct email address; [email protected]. The office space must be 400m² Gross Lettable Area (GLA) for a period of six (6) months preferably on the Ground Floor with parking.

Important Dates