Virtual microsoft security operations analyst associate training and exam for five days

The service provider will be entrusted with the Road Accident Fund's confidential, private, personal or sensitive information during the subsistence of the contract and must comply with the Protection of Personal Information Act.

Technical and organisational security measures

Scope

• The service provider will be entrusted with RAF confidential, private, personal or sensitive information (files, data and documents) during the subsistence of the contract.

Document handling and transportation

• Protocols must be in place for the proper handling and transport of files to and from the provider's premises.
• A secure, lockable transportation system must be used to transfer files to and from the premises.
• Files must be kept in lockable containers or packaging during handling and transportation to prevent loss, theft or damage.
• Accurate records of each document stored must be maintained, including location, access history and retention schedule, organised for easy and accurate tracking.

Secure retrieval and storage

• Secure protocols must be used for retrieving documents, including verification of the requester's identity.
• A detailed record of all retrieval activities must be kept, including date and time, requester identity and reason for the activity.
• Physical documents and records must be stored in lockable cabinets to prevent unauthorised access or tampering.
• Access must be limited to authorised personnel, with controlled and monitored access policies and procedures.

Premises security

• The premises must have a secure perimeter with controlled access and/or surveillance systems.
• Secure doors, locks and alarms must prevent unauthorised access.
• Physical security measures must include controlled access points, surveillance cameras and/or 24/7 security monitoring.
• All document storage facilities must be adequately protected against unauthorised access.
• A fire suppression system or similar, including carbon dioxide fire extinguishers, must be in place.
• In the event of any real, attempted or suspected breach of physical security, the provider must inform RAF and provide CCTV footage, police reports and linked alarm system records.

Network and data security

• Digital document storage systems must have firewalls, intrusion detection and encryption to protect against unauthorised access or attacks.
• Access must be granted on a need-to-know basis, using strong authentication methods, with access permissions regularly reviewed and updated.
• Personal and sensitive data must be handled and processed in compliance with applicable data protection laws and regulations.
• Measures must safeguard data against unauthorised access, disclosure, alteration and destruction.
• RAF must be informed immediately of any data breaches or incidents affecting information security.
• Confidentiality obligations must be imposed on agents, subcontractors and any third party that receives records.
• RAF reserves the right to conduct security screening or vetting of company directors and resources provided.

Cybersecurity standards

• Robust cybersecurity measures must protect against malware, phishing and unauthorised access.
• Encryption for data in transit and at rest must use industry-standard protocols and algorithms.
• Systems, software and applications must be regularly updated and patched to address security vulnerabilities.

Incident reporting and response

• A documented incident response plan must be in place to address and mitigate data breaches promptly.
• Security incidents or data breaches must be reported to RAF in a timely manner.

Subcontractors and third-party oversight

• Subcontractors must adhere to the same data protection and cybersecurity standards.
• The provider is responsible for the actions and compliance of any subcontractors or third parties engaged.

Audit and monitoring

• RAF reserves the right to audit and monitor the provider's compliance with this policy.
• The provider must cooperate with RAF audits and assessments of data protection and cybersecurity compliance.

Compliance requirements

• Protection of Personal Information Act: the provider must comply with POPIA and applicable data protection laws and regulations when handling and processing RAF personal and sensitive data.
• Security screening: RAF reserves the right to conduct security screening or vetting of company directors and resources provided.
• Third parties: third-party service providers handling personal information must be screened or vetted for data protection policies and procedures and required to sign a data protection agreement.

Health and safety

• Fire suppression: premises must have a fire suppression system or similar, including carbon dioxide fire extinguishers, to prevent damage or loss of documents and records in the event of a fire.
• Physical security: premises must have a secure perimeter with controlled access and/or surveillance, secure doors, locks and alarms to prevent unauthorised access.
• Access control: physical documents and records must be accessible only to authorised personnel, with controlled and monitored access policies and procedures.

Contractual terms

• Breach notification: the provider must inform RAF of any real, attempted or suspected breach of physical security and provide CCTV footage, police reports and linked alarm system records.
• Data breach reporting: security incidents or data breaches must be reported to RAF in a timely manner under a documented incident response plan.
• Subcontractor responsibility: the provider is responsible for the actions and compliance of subcontractors and third parties, who must meet the same data protection and cybersecurity standards.
• Audit rights: RAF reserves the right to audit and monitor compliance with the security policy, and the provider must cooperate with audits and assessments.
• Screening: RAF may conduct security screening or vetting of company directors and resources provided.

Client references

• Bidders must provide details of current or previous clients for whom they have rendered the required services.

Returnable documents

• Bidders Client References: must be completed and submitted; bidders list current or previous clients for whom they rendered the required services, providing project description, services rendered, contract start date, contract end date, client name, client contact person, and client contactable details (email and/or telephone); up to five references may be listed; additional supporting documents may be attached; falsified or misrepresented information leads to disqualification; the RAF may contact listed clients to authenticate the information.

Returnable form:

• SBD 4 (Declaration of Interest): discloses whether any director, trustee, shareholder, member or partner is employed by an organ of state, whether any connected person has a relationship with someone employed by the procuring institution, and whether the bidder or any person with a controlling interest has an interest in any related enterprise; all CSD-registered active companies linked to directors must be disclosed.

Bidders listed in the Register for Tender Defaulters or the List of Restricted Suppliers are automatically disqualified.

A false SBD 4 disclosure disqualifies the bid.

Failure to disclose all CSD-registered active companies linked to directors leads to disqualification.

CSD registration: the supplier registration number (MAAA) and status (active, inactive or deleted) must be provided.

Bidders must not appear on the Register for Tender Defaulters or the List of Restricted Suppliers.

Closing: 12 November 2026 at 12:00

Returnable forms and documents

• SBD 6.1 (Preference Points Claim Form): must be completed and signed and submitted with the tender to claim preference points for specific goals.
• Proof or documentation supporting specific goals claims: must accompany the tender; failure to submit it means preference points for specific goals are not claimed.

Evaluation method

• Preference point system: 80/20.
• Maximum points for price: 80.
• Maximum points for specific goals: 20.
• Total points: 100.

Specific goals points under 80/20

• Historically disadvantaged individuals: 10 points.
• Women: 8 points.
• Persons with disability: 2 points.

Claim requirements

• Bidders must indicate how they claim points for each specific goal.
• Proof or documentation must be submitted with the tender; otherwise no preference points are claimed.
• The procuring institution may require substantiation of any preference claim before or after adjudication.

Consequences of fraudulent claims

• Disqualification from the tendering process.
• Recovery of costs, losses or damages.
• Cancellation of the contract and damages.
• Restriction from obtaining business from any organ of state for up to 10 years, after a hearing.
• Possible criminal prosecution.

Scope

• Virtual or online Microsoft Security Operations Analyst Associate Training and Exam.
• Duration: five (5) days.