The road accident fund (raf) wishes to appoint suitable service provider to provide emergency services for sports and wellness activities on 04 september 2026.

Bidders must have policies and procedures in place to comply with RAF requirements and the Protection of Personal Information Act (POPIA). They must demonstrate physical and digital security measures as outlined. Bidders must agree to RAF's right to conduct security screening or vetting of company directors and resources. Bidders must report any security incidents or data breaches to RAF in a timely manner.

The service provider must implement comprehensive security measures for handling RAF confidential files, data, and documents. This includes:

• Document handling and transportation: secure, lockable transportation systems; files kept in lockable containers to prevent loss, theft, or damage.
• Record keeping: accurate records of each document's location, access history, and retention schedule, organized for easy tracking.
• Secure retrieval: verify requester identity; maintain detailed logs of retrieval activities (date, time, requester, reason).
• Secure storage: physical documents in lockable cabinets; controlled access with only authorized personnel.
• Fire suppression: premises must have fire suppression systems, including carbon dioxide extinguishers.
• Physical security: secure perimeter, controlled access points, surveillance cameras, 24/7 monitoring; report any security breaches to RAF with CCTV footage, police report, and alarm records.
• Access control: need-to-know basis, strong authentication, regular review of permissions.
• Network security: firewalls, intrusion detection, encryption for digital storage.
• Data protection: comply with POPIA and other data protection laws; safeguard data against unauthorized access, disclosure, alteration, destruction; impose confidentiality obligations on agents and subcontractors; screen third-party handlers of PII and require data protection agreements.
• Cybersecurity: robust measures against malware, phishing, unauthorized access; encryption for data in transit and at rest; regular updates and patching.
• Incident response: documented plan; report security incidents or data breaches to RAF promptly.
• Subcontractor oversight: ensure subcontractors adhere to same standards; provider responsible for their compliance.
• Audit and monitoring: RAF reserves right to audit compliance; provider must cooperate.

The service provider must implement protocols for proper handling and transport of files, including a secure, lockable transportation system. Files must be kept in lockable containers or packaging to prevent loss, theft, or damage. Accurate records of each document's location, access history, and retention schedule must be maintained, organized for easy tracking. Secure retrieval protocols must verify requester identity and ensure secure transport. Detailed logs of all retrieval activities (date, time, requester, reason) must be kept. Physical documents must be stored in lockable cabinets to prevent unauthorized access or tampering. Access to documents must be controlled and monitored, with only authorized personnel permitted to handle, view, or transport documents. The premises must have a secure perimeter with controlled access, surveillance systems, secure doors, locks, and alarms. Physical security measures must include controlled access points, surveillance cameras, and/or 24/7 security monitoring. Any real, attempted, or suspected breach of physical security must be reported to RAF, along with CCTV footage, police report, and alarm system records. Access to documents and records must be controlled on a need-to-know basis, with strong authentication methods and regular review of access permissions. Digital storage systems must have firewalls, intrusion detection, and encryption. The provider must implement robust cybersecurity measures, including encryption for data in transit and at rest, and regularly update and patch systems. A documented incident response plan must be in place, and security incidents or data breaches must be reported to RAF promptly. If subcontractors are engaged, they must adhere to the same data protection and cybersecurity standards, and the provider is responsible for their compliance. RAF reserves the right to audit and monitor compliance, and the provider must cooperate with audits.

Bidders must comply with the Protection of Personal Information Act (POPIA) and applicable data protection laws. They must have policies and procedures for physical and digital security as outlined. Bidders must agree to RAF's right to conduct security screening or vetting of company directors and resources. They must report any security incidents or data breaches to RAF in a timely manner.

The service provider must have a fire suppression system or similar in place, including fire extinguishers with carbon dioxide, to prevent damage or loss of documents and records in the event of a fire.

The service provider must handle and process personal and sensitive data in compliance with applicable data protection laws and regulations, including the Protection of Personal Information Act (POPIA). Measures must be implemented to safeguard data against unauthorized access, disclosure, alteration, and destruction. RAF must be informed immediately of any data breaches or incidents. The provider must impose confidentiality obligations on agents, subcontractors, or third parties who receive records. Third-party service providers handling personal information must be screened or vetted for data protection policies and must sign a data protection agreement. RAF reserves the right to conduct security screening or vetting for company directors and resources provided.