The service provider must implement protocols for proper handling and transport of files, including a secure, lockable transportation system. Files must be kept in lockable containers or packaging to prevent loss, theft, or damage. Accurate records of each document's location, access history, and retention schedule must be maintained, organized for easy tracking. Secure retrieval protocols must verify requester identity and ensure secure transport. Detailed logs of all retrieval activities (date, time, requester, reason) must be kept. Physical documents must be stored in lockable cabinets to prevent unauthorized access or tampering. Access to documents must be controlled and monitored, with only authorized personnel permitted to handle, view, or transport documents. The premises must have a secure perimeter with controlled access, surveillance systems, secure doors, locks, and alarms. Physical security measures must include controlled access points, surveillance cameras, and/or 24/7 security monitoring. Any real, attempted, or suspected breach of physical security must be reported to RAF, along with CCTV footage, police report, and alarm system records. Access to documents and records must be controlled on a need-to-know basis, with strong authentication methods and regular review of access permissions. Digital storage systems must have firewalls, intrusion detection, and encryption. The provider must implement robust cybersecurity measures, including encryption for data in transit and at rest, and regularly update and patch systems. A documented incident response plan must be in place, and security incidents or data breaches must be reported to RAF promptly. If subcontractors are engaged, they must adhere to the same data protection and cybersecurity standards, and the provider is responsible for their compliance. RAF reserves the right to audit and monitor compliance, and the provider must cooperate with audits.