Adobe acrobat pro license renewal (140 licenses) – road accident fund

The Road Accident Fund (RAF) seeks to appoint a service provider for the renewal of 140 Adobe Acrobat Pro licenses for 12 months. Bidders must adhere to principles of transparency, accountability, impartiality, and ethics as outlined in South African legislation.

Submit the following returnable documents: A completed and signed Bidder’s Declaration of Interest (SBD 4) form. Failure to disclose required information or providing false/incorrect information may result in automatic disqualification.

The Road Accident Fund (RAF) requires the renewal of 140 licenses for Adobe Acrobat Pro for a period of 12 months. Bidders must be natural or juristic persons and comply with transparency, accountability, impartiality, and ethical principles as per South African legislation.

Bidders must not be listed in the Register for Tender Defaulters or the List of Restricted Suppliers. Bidders must declare any state employment, relationships with procuring institution employees, or interests in related enterprises. Collusive bidding or disclosure of bid terms to competitors is prohibited and may result in penalties, including reporting to the Competition Commission or National Prosecuting Authority (NPA).

The tender is for the renewal of 140 Adobe Acrobat Pro licenses for a 12-month period. The SBD 6.1 Preference Points Claim Form must be completed and submitted as part of the bid.

Submit the SBD 6.1 Preference Points Claim Form as part of the tender. Failure to include required proof or documentation for specific goals will result in no preference points being awarded for those goals. The organ of state may request substantiation of claims at any time.

No explicit eligibility criteria are stated in the provided document excerpt. However, implicit requirements include: (1) Must be a registered legal entity (Partnership/JV/Consortium, Sole proprietorship, Close corporation, or Company type); (2) Must be able to supply and renew 140 Adobe Acrobat Pro licenses; (3) Must comply with Preferential Procurement Regulations 2022; (4) Must be able to substantiate any specific goals claimed with documentary proof; (5) Must not have been restricted from doing business with organs of state; (6) Authorized representative must sign declaration

Submit proof of B-BBEE status or other documentation to claim preference points for specific goals (Historically Disadvantaged Individuals, Women, Persons with Disability). Fraudulent claims may result in disqualification, cost recovery, contract cancellation, business restrictions for up to 10 years, or criminal prosecution.

• The service provider must comply with the Protection of Personal Information Act (POPIA) in all activities related to this contract.

Must have policies and protocols in place for secure document handling, transportation, and storage.

Must comply with POPIA and other relevant data protection regulations.

Must demonstrate robust cybersecurity and physical security measures.

Must allow RAF to conduct security screening or vetting of directors and resources.

Must provide CCTV footage, police reports, or alarm records in case of security breaches.

Must have a documented incident response plan for data breaches.

Must permit RAF to audit and monitor compliance with security standards.

• Scope: Renewal of 140 licenses for Adobe Acrobat Pro for a period of 12 months.
• Security measures apply to handling of RAF confidential, private, personal and sensitive information.
• The service provider must comply with the Protection of Personal Information Act (POPIA).
• Document handling and transportation: Protocols required for proper handling and transport of files; secure lockable transportation system mandatory.
• Security measures during handling: Files must be kept in lockable containers or packaging to prevent loss, theft, or damage.
• Record keeping: Maintain accurate records of each document stored, including location, access history, and retention schedule; records must allow easy and accurate tracking.
• Document retrieval: Secure protocols required, including identity verification of requesters and secure transport of documents.
• Retrieval record keeping: Detailed records of all retrieval activities required, including date/time, identity of requester, and reason for activity.
• Secure storage: Physical documents must be stored in lockable cabinets to prevent unauthorised access or tampering.
• Access control: Physical documents accessible only to authorised personnel; policies and procedures must control and monitor access.
• Fire suppression: Premises must have fire suppression system or similar (e.g., carbon dioxide fire extinguishers) to prevent damage or loss.
• Secure facility: Premises must have secure perimeter with controlled access and/or surveillance systems; secure doors, locks, and alarms required.
• Physical security: Controlled access points, surveillance cameras, and/or 24/7 security monitoring required; all document storage facilities must be protected against unauthorised access.
• Breach reporting: Any real, attempted, or suspected breach of physical security must be reported to RAF immediately, with CCTV footage, police report, and linked alarm system records provided.
• Document access control: Only authorised personnel permitted to handle, view, or transport documents.
• Access monitoring: Procedures required to ensure only authorised personnel access documents, records, and storage facility.
• Network security: Digital document storage systems must have firewalls, intrusion detection, and encryption to protect against unauthorised access or attacks.
• Access control (digital): Grant access on need-to-know basis; use strong authentication methods; regularly review and update access permissions.

• Protection of Personal Information Act (POPIA): The service provider must comply with POPIA provisions.
• Data protection obligations:

• Handle and process personal and sensitive data in compliance with applicable data protection laws and regulations.
• Implement measures to safeguard data against unauthorised access, disclosure, alteration, and destruction.
• Inform RAF immediately of any data breaches or incidents impacting information security.
• Implement measures to ensure confidentiality of personal, confidential and sensitive data, including imposing confidentiality obligations on agents, subcontractors, and third parties who receive records.
• Comply fully with respective legislative and regulatory frameworks in processing personal information.

• Third-party service providers: Must be screened or vetted for data protection policies and procedures; required to sign a data protection agreement.
• Security screening: RAF reserves the right to conduct security screening or vetting for company directors and resources provided.
• Cybersecurity standards:

• Implement robust cybersecurity measures to protect against malware, phishing, and unauthorised access.
• Use encryption for data in transit and at rest; utilise encryption protocols and algorithms that comply with industry standards.
• Regularly update and patch systems, software, and applications to address security vulnerabilities.

• Incident reporting and response:

• Must have a documented incident response plan to address and mitigate data breaches promptly.
• Must report any security incidents or data breaches to RAF in a timely manner.

• Subcontractors and third-party oversight:

• Ensure subcontractors adhere to the same data protection and cybersecurity standards.
• Service provider is responsible for actions and compliance of any subcontractors or third parties.

• Audit and monitoring:

• RAF reserves the right to audit and monitor service provider compliance.
• Service provider must cooperate with any audits or assessments conducted by RAF.

• Access control policies and procedures must be in place to ensure controlled and monitored access to documents and facilities.
• Fire suppression requirements:

• Premises must have fire suppression system or similar in place.
• Carbon dioxide fire extinguishers required to prevent damage or loss of documents and records in event of fire.

• Secure facility requirements:

• Premises must have secure perimeter with controlled access and/or surveillance systems.
• Secure doors, locks, and alarms required to prevent unauthorised access.

• Physical security measures:

• Controlled access points, surveillance cameras, and/or 24/7 security monitoring required.
• Physical security of records must be ensured at all times.
• All document storage facilities must be adequately protected against unauthorised access.

• Physical security obligations:

• Maintain controlled access points, surveillance cameras, and/or 24/7 security monitoring.
• Ensure physical security of records at all times; all document storage facilities must be adequately protected against unauthorised access.
• In case of any real, attempted, or suspected breach of physical security, inform RAF immediately and provide CCTV footage, police report, and linked alarm system records.

• Digital/network security obligations:

• Implement firewalls, intrusion detection, and encryption to protect against unauthorised access or attacks.
• Grant access on need-to-know basis; use strong authentication methods; regularly review and update access permissions.

• Data protection obligations:

• Handle and process personal and sensitive data in compliance with applicable laws and regulations.
• Safeguard data against unauthorised access, disclosure, alteration, and destruction.
• Inform RAF immediately of any data breaches or incidents.
• Ensure confidentiality of personal, confidential and sensitive data through confidentiality obligations on agents, subcontractors, and third parties.
• Comply fully with legislative and regulatory frameworks for processing personal information.

• Third-party management:

• Screen or vet third-party service providers handling PII for their data protection policies and procedures.
• Require third parties to sign data protection agreements.
• RAF reserves the right to conduct security screening or vetting for company directors and resources provided.

• Cybersecurity standards:

• Implement robust measures against malware, phishing, and unauthorised access.
• Encrypt data in transit and at rest using industry-standard protocols and algorithms.
• Regularly update and patch systems, software, and applications.

• Incident reporting:

• Maintain documented incident response plan to address and mitigate data breaches promptly.
• Report any security incidents or data breaches to RAF in a timely manner.

• Subcontractor oversight:

• Ensure subcontractors adhere to same data protection and cybersecurity standards.
• Service provider remains responsible for actions and compliance of all subcontractors and third parties.

• Audit and monitoring:

• RAF reserves the right to audit and monitor compliance with this policy.
• Service provider must cooperate with all audits and assessments by RAF.

• The service provider will be entrusted with RAF confidential, private, personal or sensitive information (files, data, and/or documents) during the contract period.
• Compliance with the Protection of Personal Information Act (POPIA) is mandatory.
• Document handling and transportation:

• Protocols required for proper handling and transport of files to and from premises.
• Secure lockable transportation system mandatory for transferring files.

• Security measures: Files must be kept in lockable containers or packaging during handling and transportation to prevent loss, theft, or damage.
• Record keeping: Maintain accurate records of each document stored, including location, access history, and retention schedule; organise records for easy and accurate tracking.
• Document retrieval and handling:

• Secure retrieval protocols required, including identity verification of requesters.
• Documents and records must be transported securely.
• Detailed records of all retrieval activities required: date/time, identity of requester, and reason for activity.

• Secure storage: Physical documents and records must be stored in lockable cabinets to prevent unauthorised access or tampering.
• Access control: Physical documents and records accessible only to authorised personnel; policies and procedures must ensure access is controlled and monitored.
• Document access control: Only authorised personnel permitted to handle, view, or transport documents.
• Access monitoring and control: Procedures required to ensure only authorised personnel are granted access to documents, records, and storage facility.
• Network security: Digital document storage systems must have appropriate technical security measures including firewalls, intrusion detection, and encryption.