Information Security Policy

At Identicum, safeguarding strategic and confidential information is critical to our operations and the trust we build with our clients. This policy outlines our comprehensive approach to information security, which includes protecting our internal information, client data, and any information related to our clients’ customers. Our practices are designed to ensure confidentiality, integrity, and compliance with industry standards.

Employee Confidentiality Obligations

All Identicum employees sign a confidentiality agreement upon joining the company. This agreement requires employees to protect confidential information related to Identicum, its clients, and third parties. Employees are prohibited from sharing or using confidential information for unauthorized purposes, both during and after their employment at Identicum.

Confidential information includes non-public details about Identicum’s operations, client business processes, and data related to client customers. Employees must use this information solely for its intended purpose and in alignment with Identicum’s business objectives.

Policy Framework

1. Acceptable Use

Identicum’s resources, including hardware, software, network access, and data, must only be used for legitimate business purposes. Any unauthorized, personal, or inappropriate use of these resources is strictly prohibited.

2. Clean Desk Policy

Employees must maintain a secure workspace by:

• Keeping desks free of confidential information when not in use.
• Storing physical documents in locked cabinets or drawers.
• Logging off or locking devices before leaving their workstations.

3. Data Handling

Identicum applies stringent measures to handle confidential data securely:

• Limited Retention: Data is retained only as long as necessary and deleted immediately after its purpose is fulfilled. Paper documents will be shredded and physical media will be destroyed after use.
• Secure Transfer: Sensitive information is shared exclusively through secure, approved channels.
• Access Control: Only authorized personnel with a valid business need can access confidential information.

4. Device Management

Devices used for company operations must adhere to the following requirements:

• Be updated with the latest operating systems and security patches.
• Use strong passwords or biometric authentication.
• Encrypt sensitive data stored on the device.
• Report lost or stolen devices to IT immediately.

5. Password Management

Employees must follow these best practices:

• Use complex passwords with a mix of letters, numbers, and symbols.
• Avoid reusing passwords across systems.
• Change passwords periodically and never share them.
• Enable multi-factor authentication (MFA) wherever possible.

6. Personal Information (PI)

Identicum ensures that any Personal Information (PI) provided by clients or their customers is:

• Collected and processed solely for its intended purpose.
• Secured using encryption and robust access controls.
• Deleted promptly once it is no longer needed.

7. Phishing Protection

Employees must remain alert to phishing attempts and adhere to the following:

• Avoid clicking on suspicious links or downloading unexpected attachments.
• Verify the sender’s identity before sharing any sensitive information.
• Report suspected phishing emails to the IT team immediately.

8. Security Awareness

Employees participate in regular security awareness training to stay informed about emerging threats, company policies, and best practices for handling sensitive information.

9. Social Engineering Protection

Employees are trained to identify and prevent social engineering tactics, such as impersonation or manipulation, that could compromise security. They are instructed to verify all requests for sensitive information through established protocols.

Data Privacy and Training

Identicum is committed to upholding the highest standards of data privacy to ensure compliance with applicable laws and regulations. Employees are trained on data privacy principles and legal requirements to ensure responsible handling of sensitive information.

• Understanding applicable data privacy laws, including GDPR, and their implications for handling client and customer information.
• Training programs focus on practical measures for securing data and responding to privacy-related incidents.
• Ensuring client data is processed and stored in accordance with contractual and legal obligations.

Telework Policy

Identicum supports teleworking as part of our flexible work environment while maintaining strong security and confidentiality standards. Employees who work remotely are required to adhere to the following guidelines:

• Ensure a secure and private workspace to prevent unauthorized access to company information.
• Use company-approved devices and secure connections, such as VPNs, for accessing company systems and data.
• Comply with all applicable policies, including the Clean Desk Policy and Data Handling guidelines, while working remotely.
• Report any security incidents, such as device loss or suspected unauthorized access, to IT immediately.
• Participate in regular telework security training to stay updated on best practices and emerging threats.

Compliance with Industry Standards

Identicum adheres to internationally recognized security frameworks and standards, such as ISO 9001. This commitment ensures that our information security management system is robust, compliant, and aligned with industry best practices.

Incident Response Measures

Identicum maintains a formal incident response plan to address potential security breaches. This includes:

• Investigating and mitigating incidents promptly.
• Reporting breaches to relevant stakeholders.
• Continuously improving our response processes to prevent future occurrences.

Third-Party Confidentiality

Vendors and subcontractors working with Identicum are required to sign confidentiality agreements and comply with our stringent security standards. This ensures that any third-party access to sensitive data is tightly controlled.

Data Protection and Retention in Case of Legal Holds

Identicum has established procedures to ensure the preservation of data, documents, and records in the event of a legal obligation, judicial requirement, or any other process necessitating their retention.

• Suspension of Deletion: Any automated or manual process that could delete or modify the relevant data is immediately halted.
• Internal Notification: Employees and relevant teams are notified about the obligation to retain specific information.
• Secure Storage: Data subject to retention is protected through access controls and encryption mechanisms to prevent unauthorized access or alterations.
• Legal Compliance: All processes are aligned with applicable legal regulations to ensure the proper preservation and subsequent disposition of the information.

Periodic Audits and Reviews

To maintain the effectiveness of our information security program, Identicum conducts regular audits and reviews of its policies, procedures, and systems. These reviews ensure compliance with evolving industry standards and address emerging security challenges.

Use of Company Resources

All resources provided by Identicum, including systems, tools, and data, must be used exclusively for business purposes. Unauthorized use is strictly prohibited and may result in disciplinary action.

Our Commitment to Confidentiality and Security

Confidentiality and security are integral to Identicum’s operations and values. By implementing rigorous policies, providing ongoing training, and ensuring compliance with international standards, we protect the trust and interests of our clients and their customers.

This policy reflects Identicum’s unwavering dedication to maintaining the highest level of information security and professionalism in all our activities.