Information Security Policy

Information Security Declaration

Information systems and information are key assets of 1XP Inc. (the “Company”), and without their reliable provision the Company cannot carry out its work efficiently. The Company’s management is therefore obliged to protect and improve the Company’s information systems and information. This means it must take appropriate measures so that they are protected from threats of every kind, including errors, destruction, terrorism, personal-data leaks, service interruption, and natural disasters.

The Company must keep in mind, and prepare for, the many security problems expected as it builds, operates, and manages its information systems. These include hacking of its information systems, unlawful leakage of and access to information, fast and widespread malware infection, and other operational, execution, and management problems. The need to prepare adequate countermeasures, weighing carefully the loss of important information, the resulting delays and degradation of work, and the legal, social, and ethical consequences, grows every day.

The Company’s information must therefore be protected according to its sensitivity, value, and criticality, and security controls must apply to the media where it is stored, the systems that process it, and the means by which it is transmitted. This protection includes allowing access only to the information that a person’s duties require. Managers must provide sufficient time and resources for information to be properly protected. Where security controls over information systems or information prove insufficient, they must promptly devise and implement remedies to minimise exposure.

Achieving information security requires the participation and cooperation of everyone at the Company, supported by adequate training and reference material. All activities needed to protect the Company’s information systems, including drafting and adopting guidelines and procedures, are to be led by the team responsible for information security. Finally, security audits of information systems must be carried out periodically and company-wide to confirm that information security is working as intended.

Information Security Code

The threats that arise as information and communications technology advances can now seriously affect the information systems and information that are key assets of 1XP Inc. (the “Company”), and information security has become indispensable to the Company’s business and, ultimately, to its survival. Every employee must therefore do their utmost to protect information assets on the basis of the principles set out below.

1. First

   Employees must recognise and handle information as an important asset to be protected. Access to important information assets must go through user identification and authentication. Users must not attempt unauthorised access, must not share passwords or similar credentials with others, and must not leak or disclose information externally without their team lead’s approval.

2. Second

   Every employee must recognise the importance of information security and receive security training at a level suited to their role, so that they can build their capability. The Company must also set and apply fair standards for rewards and sanctions related to information security, to motivate good security practice.

3. Third

   All information security policies and guidelines must be established, reviewed, and implemented so as to ensure the confidentiality, integrity, and availability of assets, and these activities must be carried out consistently by the information security team.

4. Fourth

   All Company assets must be classified by value and importance and managed under the procedures appropriate to each class. The value of assets must be reassessed periodically and reflected in the information security policies and guidelines.

5. Fifth

   Appropriate measures must ensure that only authorised personnel can access the Company’s information assets, and areas where important information assets are operated and managed must be protected from unauthorised access, power outages, fire, flooding, and other disasters and accidents.

6. Sixth

   Even when the Company’s information assets are damaged by a security incident or by deliberate or accidental intrusion from inside or outside, the Company must be able to continue its business. An incident response plan must be established and maintained so that information assets are restored quickly and damage is minimised.

7. Seventh

   Operation of the Company’s information systems must be divided appropriately according to the nature of the work and carried out under predefined procedures. Records of information system operations must be kept and managed so that they inform future operating plans and any incident response. This means each person is accountable for the information assets they manage: important information assets must have a clearly designated author, creation date, and user, and their use must be traceable.

8. Eighth

   Measures must be taken to protect the Company’s information systems from harmful software, and use of information systems unrelated to work must not cause information assets to leak outside the Company or degrade system performance.

9. Ninth

   All of the Company’s information security activities must comply with the relevant guidance of supervising authorities and with the laws on intellectual property and personal data protection, and must be checked periodically to confirm they are carried out correctly under the guidelines and procedures.

Every employee must recognise once more that successful information security is the shortest path to the Company’s competitiveness, and do their utmost to protect information.