The service provider must implement technical and organisational security measures to protect RAF's confidential, private, personal or sensitive information.
Physical security: controlled access points, surveillance cameras, 24/7 monitoring; storage facilities protected against unauthorised access.
In case of any real, attempted, or suspected breach of physical security, the service provider must inform RAF and provide CCTV footage, police report, and linked alarm system records.
Access control: grant access on a need-to-know basis, use strong authentication, regularly review and update permissions.
Data protection: handle and process personal data in compliance with applicable laws; safeguard against unauthorised access, disclosure, alteration, destruction; inform RAF immediately of any data breaches.
Confidentiality obligations must be imposed on agents, subcontractors, or third parties receiving records.
Third-party service providers handling PII must be screened or vetted and required to sign a data protection agreement.
RAF reserves the right to conduct security screening or vetting of company directors and resources.
Cybersecurity: implement robust measures against malware, phishing, unauthorised access; use encryption for data in transit and at rest; regularly update and patch systems.
Incident response: have a documented plan to address and mitigate data breaches promptly; report security incidents to RAF in a timely manner.
Subcontractors must adhere to the same data protection and cybersecurity standards; the service provider is responsible for their compliance.
RAF reserves the right to audit and monitor compliance; the service provider must cooperate with audits or assessments.