Information Security Policy

Fundora Technologies Ltd recognizes information security as a critical component of its operations. This Information Security Policy establishes the framework for protecting Fundora's systems, applications, customer information, business data and technology infrastructure.

The objectives of this Policy are to ensure:

1. confidentiality of information;
2. integrity of systems and data;
3. availability of services;
4. prevention of unauthorized access;
5. effective response to security incidents.

Fundora shall maintain an information security governance structure consisting of:

Fundora classifies information as:

Fundora shall enforce:

1. unique user accounts;
2. strong authentication;
3. least-privilege access;
4. role-based permissions;
5. periodic access reviews.

Security controls include:

1. two-factor authentication;
2. biometric verification;
3. secure password requirements;
4. session controls;
5. login monitoring.

Fundora shall encrypt sensitive information:

• during transmission;
• during storage;
• during processing where appropriate.

Encryption controls include secure encryption technologies including Tremble Vault.

Fundora shall maintain:

1. secure software development practices;
2. vulnerability management;
3. system monitoring;
4. security testing;
5. patch management.

Fundora applications shall be developed and maintained with:

• secure coding practices;
• access controls;
• authentication requirements;
• security testing.

Fundora shall implement:

1. network monitoring;
2. firewall controls;
3. intrusion detection measures;
4. secure communications protocols.

Third parties shall be assessed before access to Fundora systems.

Requirements may include:

• security reviews;
• confidentiality agreements;
• compliance obligations;
• access restrictions.

Fundora shall maintain an incident response process.

Security incidents shall be:

1. detected;
2. contained;
3. investigated;
4. resolved;
5. documented.

Fundora shall maintain measures including:

• backups;
• recovery procedures;
• continuity planning;
• system restoration processes.

Employees shall receive training on:

• cybersecurity awareness;
• phishing prevention;
• password protection;
• data handling.

Fundora may conduct:

• security assessments;
• system audits;
• access reviews;
• vulnerability assessments.

Violation of this Policy may result in:

• access restrictions;
• disciplinary action;
• termination;
• regulatory reporting.

This Policy shall be reviewed periodically to ensure effectiveness.