Information Security Policy

Document Owner: Executive Management Version: 1.0 Effective Date: 17 May 2026 Review Cycle: Annual or upon significant business/technology change

---

Information Security Policy

Purpose

The purpose of this Information Security Policy is to protect the confidentiality, integrity, and availability of company information, systems, and customer data. This policy establishes the principles and minimum security requirements governing how information assets are managed, accessed, processed, and protected.

The organization recognizes that information security is essential to maintaining customer trust, operational resilience, regulatory compliance, and long term business continuity.

---

Scope

This policy applies to:

• All employees, contractors, consultants, and third parties
• All company-owned or managed systems, applications, infrastructure, and devices
• All information assets, including customer, employee, operational, and business data
• All cloud services, integrations, and external service providers used to support business operations

---

Security Principles

The organization follows the principles below:

• Access to information is granted based on least privilege and business need
• Security controls are designed using a risk-based approach
• Sensitive data is protected throughout its lifecycle
• Security responsibilities are shared across the organization
• Security events are monitored, investigated, and addressed promptly