NOXIUM INFORMATION SECURITY POLICY

Information Security Objectives

Noxium is committed to:

• Protecting the confidentiality, integrity and availability of information in all its forms.
• Complying with the legal, regulatory and contractual requirements related to information security.
• Effectively managing information security risks.
• Ensuring the continuity of critical business operations.
• Promoting a culture of information security throughout the organisation.

Information Security Principles

To achieve these objectives, Noxium adheres to the following principles:

• Information security is everyone’s responsibility.
• Information security risks are assessed and managed systematically.
• Security controls are implemented in proportion to the risks.
• Information security is integrated into all the company’s processes and activities.
• A continuous improvement approach is maintained in information security management.

Control Framework

Noxium will implement and maintain a comprehensive set of information security controls based on the ISO/IEC 27001:2022 standard, including but not limited to:

• Information security policies and procedures
• Organisation of information security
• Human resources security
• Asset management
• Access control
• Cryptography
• Physical and environmental security
• Operations security
• Communications security
• System acquisition, development and maintenance
• Supplier relationships
• Information security incident management
• Information security aspects of business continuity management
• Compliance

Roles and Responsibilities

• Top management is responsible for approving this policy and providing the resources needed to implement it.
• The Information Security Management System manager is responsible for overseeing the implementation of this policy and the overall scope of the ISMS.
• The Information Security officer is responsible for overseeing and ensuring that the security infrastructure is protected against threats and vulnerabilities.
• Department heads are responsible for implementing this policy in their respective areas.
• All employees, contractors and third parties are responsible for complying with this policy and reporting any security incident.

Compliance and Consequences

Compliance with this policy is mandatory for all employees, contractors and third parties. Any violation of this policy may result in disciplinary action, which may include termination of employment or contract.

Review and Continual Improvement

This policy will be reviewed annually, or whenever significant changes occur, to ensure its continuing suitability, adequacy and effectiveness. Noxium is committed to the continual improvement of its ISMS and of this policy.

Communication

This policy will be communicated to all employees, contractors and relevant interested parties, and will be available for consultation at all times.