Zuar strives to create and maintain a work environment in which people are treated with dignity, decency and respect. The environment of the company should be characterized by mutual trust and the absence of intimidation, oppression and exploitation. Zuar will not tolerate unlawful discrimination or harassment of any kind. Through enforcement of this policy and by education of employees, Zuar will seek to prevent, correct and discipline behavior that violates this policy.

All employees, regardless of their positions, are covered by and are expected to comply with this policy and to take appropriate measures to ensure that prohibited conduct does not occur. Appropriate disciplinary action will be taken against any employee who violates this policy. Based on the seriousness of the offense, disciplinary action may include verbal or written reprimand, suspension, or termination of employment.

Managers and supervisors who knowingly allow or tolerate discrimination, harassment or retaliation, including the failure to immediately report such misconduct to senior leadership or a corporate officer, are in violation of this policy and subject to discipline.

Prohibited Conduct Under This Policy

Zuar, in compliance with all applicable federal, state and local anti-discrimination and harassment laws and regulations, enforces this policy in accordance with the following definitions and guidelines:

Discrimination

It is a violation of Zuar's policy to discriminate in the provision of employment opportunities, benefits or privileges; to create discriminatory work conditions; or to use discriminatory evaluative standards in employment if the basis of that discriminatory treatment is, in whole or in part, the person's race, color, national origin, age, religion, disability status, sex, sexual orientation, gender identity or expression, genetic information or marital status.

Discrimination of this kind may also be strictly prohibited by a variety of federal, state and local laws, including Title VII of the Civil Rights Act of 1964, the Age Discrimination Act of 1967 and the Americans with Disabilities Act of 1990. This policy is intended to comply with the prohibitions stated in these anti-discrimination laws.

Discrimination in violation of this policy will be subject to disciplinary measures up to and including termination.

Harassment

Zuar  prohibits harassment of any kind, including sexual harassment, and will take appropriate and immediate action in response to complaints or knowledge of violations of this policy. For purposes of this policy, harassment is any verbal or physical conduct designed to threaten, intimidate or coerce an employee, co-worker, or any person working for or on behalf of Zuar.

The following examples of harassment are intended to be guidelines and are not exclusive when determining whether there has been a violation of this policy:

• Verbal harassment includes comments that are offensive or unwelcome regarding a person's national origin, race, color, religion, age, sex, sexual orientation, pregnancy, appearance, disability, gender identity or expression, marital status or other protected status, including epithets, slurs and negative stereotyping.
• Nonverbal harassment includes distribution, display or discussion of any written or graphic material that ridicules, denigrates, insults, belittles or shows hostility, aversion or disrespect toward an individual or group because of national origin, race, color, religion, age, gender, sexual orientation, pregnancy, appearance, disability, sexual identity, marital status or other protected status.

Sexual harassment

Sexual harassment is a form of unlawful employment discrimination under Title VII of the Civil Rights Act of 1964 and is prohibited under Zuar 's anti-harassment policy. According to the Equal Employment Opportunity Commission (EEOC), sexual harassment is defined as "unwelcome sexual advances, requests for sexual favors, and other verbal or physical conduct of a sexual nature ... when ... submission to or rejection of such conduct is used as the basis for employment decisions ... or such conduct has the purpose or effect of ... creating an intimidating, hostile or offensive working environment."

Sexual harassment occurs when unsolicited and unwelcome sexual advances, requests for sexual favors, or other verbal or physical conduct of a sexual nature:

• Is made explicitly or implicitly a term or condition of employment.
• Is used as a basis for an employment decision.
• Unreasonably interferes with an employee's work performance or creates an intimidating, hostile or otherwise offensive environment.

Sexual harassment may take different forms. The following examples of sexual harassment are intended to be guidelines and are not exclusive when determining whether there has been a violation of this policy:

• Verbal sexual harassment includes innuendoes, suggestive comments, jokes of a sexual nature, sexual propositions, lewd remarks and threats; requests for any type of sexual favor (this includes repeated, unwelcome requests for dates); and verbal abuse or "kidding" that is oriented toward a prohibitive form of harassment, including that which is sexual in nature and unwelcome.
• Nonverbal sexual harassment includes the distribution, display or discussion of any written or graphic material, including calendars, posters and cartoons that are sexually suggestive or show hostility toward an individual or group because of sex; suggestive or insulting sounds; leering; staring; whistling; obscene gestures; content in letters, notes, facsimiles, e-mails, photos, text messages, tweets and Internet postings; or other forms of communication that are sexual in nature and offensive.
• Physical sexual harassment includes unwelcome, unwanted physical contact, including touching, tickling, pinching, patting, brushing up against, hugging, cornering, kissing, fondling, and forced sexual intercourse or assault.

Courteous, mutually respectful, pleasant, noncoercive interactions between employees that are appropriate in the workplace and acceptable to and welcomed by both parties are not considered to be harassment, including sexual harassment.

Consensual Romantic or Sexual Relationships

Zuar strongly discourages romantic or sexual relationships between a manager or other supervisory employee and an employee who reports directly or indirectly to that person, because such relationships tend to create compromising conflicts of interest or the appearance of such conflicts. In addition, such a relationship may give rise to the perception by others that there is favoritism or bias in employment decisions affecting the staff employee. Moreover, given the uneven balance of power within such relationships, consent by the staff member is suspect and may be viewed by others, or at a later date by the staff member, as having been given as the result of coercion or intimidation. The atmosphere created by such appearances of bias, favoritism, intimidation, coercion or exploitation undermines the spirit of trust and mutual respect that is essential to a healthy work environment. If there is such a relationship, the parties need to be aware that one or both may be moved to a different department or other actions may be taken.

If any employee of Zuar enters into a consensual relationship that is romantic or sexual in nature with an employee who reports directly or indirectly to that employee, or if one of the parties is in a supervisory capacity in the same department in which the other party works, the parties must notify a corporate officer. Because of potential issues regarding quid pro quo harassment, Zuar has made reporting mandatory. This requirement does not apply to employees who do not work in the same department or to parties where neither one supervises or otherwise manages responsibilities over the other.

Once the relationship is made known to Zuar, the company will review the situation in light of all the facts (reporting relationship between the parties, effect on co-workers, job titles of the parties, etc.) and will determine whether one or both parties need to be moved to another job or department. If it is determined that one party must be moved, and there are jobs in other departments available for both, the parties may decide who will be the one to apply for a new position. If the parties cannot amicably come to a decision, or the party is not chosen for the position to which he or she applied, senior management will decide which party will be moved. That decision will be based on which move will be least disruptive to the organization as a whole. If no other jobs are available for either party, the parties will be given the option of terminating their relationship or resigning.

Retaliation

No hardship, loss, benefit or penalty may be imposed on an employee in response to:

• Filing or responding to a bona fide complaint of discrimination or harassment.
• Appearing as a witness in the investigation of a complaint.
• Serving as an investigator of a complaint.

Lodging a bona fide complaint will in no way be used against the employee or have an adverse impact on the individual's employment status. However, filing groundless or malicious complaints is an abuse of this policy and will be treated as a violation.

Any person who is found to have violated this aspect of the policy will be subject to discipline up to and including termination of employment.

Confidentiality

All complaints and investigations are treated confidentially to the extent possible, and information is disclosed strictly on a need-to-know basis. The identity of the complainant is usually revealed to the parties involved during the investigation, and senior leadership will take adequate steps to ensure that the complainant is protected from retaliation during and after the investigation. All information pertaining to a complaint or investigation under this policy will be maintained in secure files in accordance with Zuar data retention policy.

Complaint procedure

Zuar has established the following procedure for lodging a complaint of harassment, discrimination or retaliation. The company will treat all aspects of the procedure confidentially to the extent reasonably possible.

1. Complaints should be submitted as soon as possible after an incident has occurred, preferably in writing. A corporate officer may assist the complainant in completing a written statement or, in the event an employee refuses to provide information in writing, the appropriate corporate officer will dictate the verbal complaint.
2. Upon receiving a complaint or being advised by a supervisor or manager that violation of this policy may be occurring, the corporate officer will notify senior management and review the complaint with the company's legal counsel.
3. Senior leadership will initiate an investigation to determine whether there is a reasonable basis for believing that the alleged violation of this policy occurred.
4. If necessary, the complainant and the respondent will be separated during the course of the investigation, either through internal transfer or administrative leave.
5. During the investigation, senior leadership, together with legal counsel or other management employees, will interview the complainant, the respondent and any witnesses to determine whether the alleged conduct occurred.
6. Upon conclusion of an investigation, the appropriate senior leader or other person conducting the investigation will submit a written report of his or her findings to the company. If it is determined that a violation of this policy has occurred, senior leadership will recommend appropriate disciplinary action. The appropriate action will depend on the following factors:

• the severity, frequency and pervasiveness of the conduct;
• prior complaints made by the complainant;
• prior complaints made against the respondent; and
• the quality of the evidence (e.g., firsthand knowledge, credible corroboration).

If the investigation is inconclusive or if it is determined that there has been no violation of policy but potentially problematic conduct may have occurred, senior leadership may recommend appropriate preventive action.

Senior management will review the investigative report and any statements submitted by the complainant or respondent, discuss results of the investigation with other management staff as appropriate, and decide what action, if any, will be taken.

Once a final decision is made by senior management, the appropriate corporate officer will meet with the complainant and the respondent separately and notify them of the findings of the investigation. If disciplinary action is to be taken, the respondent will be informed of the nature of the discipline and how it will be executed.

Alternative legal remedies

Nothing in this policy may prevent the complainant or the respondent from pursuing formal legal remedies or resolution through local, state or federal agencies or the courts.

This policy summarizes Zuar employees’ responsibilities as they relate to confidentiality and inventions. The objective of the policy is to further the interests of Zuar and to permit Zuar to comply with its obligations, including obligations to its licensors and actual and prospective customers and others with whom Zuar may have similar obligations regarding confidentiality and inventions.

Ownership of Employee Inventions

By accepting employment, an employee agrees that Zuar will own any and all inventions that, in its opinion, are made on company time or with company assets, that relate to Zuar’s business, or that are required to meet its obligations, and that the employee will assist Zuar in perfecting and protecting its title to these inventions.

Protection of Confidential Company Information

During the course of their employment at Zuar, employees may have access to Zuar’s confidential, secret and proprietary information. Employees should maintain such information in confidence and use such information only in the interest of Zuar.

The employee may use or disclose information learned or acquired through his or her association with Zuar only for the performance of his or her job or as otherwise permitted by law. Particular care must be taken to keep confidential any information that is:

• Of possible value to competitors.
• Potentially damaging to customers and their competitors.
• Information received under an express or implied secrecy obligation.
• Information received from third parties outside Zuar.

Confidential company information is just for Zuar’s use and is not intended for distribution outside the company. Distribution of such information requires both a need to know and a right to know the information requested.

Information acquired by an employee in the course of his or her employment with Zuar must not be used for the employee’s individual benefit. Access to Zuar’s confidential information does not carry with it personal benefit or advantage to Zuar employees but imposes an obligation on every employee to keep such information confidential and to use it solely in the interest of Zuar.

When in doubt, the employee should treat information acquired in the course of employment at Zuar in the strictest confidence and consult the legal group or the CEO for clarification.

The purpose of this policy is to outline the acceptable use of computer equipment and systems at Zuar. Acceptable use requirements are designed to safeguard sensitive Zuar customer data, and to protect the company and its employees. Inappropriate use may expose Zuar to legal issues, cyber attacks and breaches, and other risks.

Scope

This policy applies to the use of all company-provided IT resources, regardless of their geographic location, and to all Zuar employees and contractors.

Ownership

Whitney Myers is responsible for implementing and maintaining this policy.

Policy Statement

Zuar assets are primarily intended for business purposes. Users are responsible for exercising good judgment regarding appropriate personal use of company resources, such that this use does not negatively impact Zuar in any way.

Acceptable Use

The Acceptable Use Policy outlines the acceptable use of computer equipment and systems at the company.

General Use

General Use and Ownership

• Zuar proprietary and confidential information stored on electronic and computing devices remains the sole property of Zuar, whether the devices themselves are owned by Zuar, an employee, or a third party.
• Theft loss, or unauthorized disclosure of Zuar proprietary and confidential information must be promptly reported.
• Access, use, or sharing of Zuar proprietary information is allowed only to the extent it is both authorized and necessary to fulfill the employee's assigned job duties.
• Good judgment must be exercised regarding the reasonableness of personal use of company-provided equipment.
• Software must be properly licensed, free of malicious code, and authorized, before it is installed on company owned or managed assets.

Security and Proprietary Information

• System and individual user passwords must comply with the Authentication and Password Policy.
• Providing one's personal access credentials to another individual, either deliberately or through failure to secure its access, is prohibited. Passwords for individual accounts may not be shared.

• Employees are required to secure equipment and log out of or lock systems when leaving them unattended for any period of time.
• All computing devices must be configured such that their use requires entering a password are at most 15 minutes of inactivity.
• Employees must use extreme caution when opening email attachments, particularly those received from unknown senders, as any attachments may contain malware.
• Employees must encrypt their devices if asked, and must not interfere with or reduce the level of encryption on their devices.
• Employees should install operating system security updates onto their devices if asked to do so, or if prompted by the system's automatic updates feature. Employees should also be proactive about applying system security updates to their devices.
• Employees must be mindful of sensitive information, whether on paper or in electronic form.
• Sensitive information must be secured when left unattended, and kept out of sight when visitors are present.
• Electronic media and papers that contain sensitive data must be sanitized or destroyed as soon as that data is no longer needed.

Prohibited use

The following activities and actions are prohibited.

• Using Zuar information assets in any way that violates international, federal, state, or local law or regulations or violates any Zuar policy or procedure.
• Accessing data by logging into a server or account that one is not explicitly authorized to access, or accessing data in excess of one's authority.
• Copying, moving, or storing sensitive customer information without a strong business need.
• Sharing individual user credentials (passwords, private keys, etc.)
• Sharing team or group credentials outside the authorized scope of the team or group.
• Unauthorized disclosure, release, or transmission of any company data.
• Downloading, storing, duplicating, distributing, printing, or otherwise using copyrighted, patented, or trademarked material from any source (including both published works as well as the internet) without the owner's permission.
• Taking actions that are intended to breach, or may result in a breach, of Zuar or any other company's or individual's security, confidentiality or privacy. These actions include (but are not limited to):
• Taking actions intended to capture information to which the user is not authorized
• Circumventing, misusing, or exceeding any authentication, privilege, or security mechanism.

• Impersonating any person or entity or falsely stating or otherwise misrepresenting affiliation with a person or entity.
• Interfering with or denying service to any authorized user or process.
• Taking actions meant to disrupt, trick, circumvent, or hide disallowed actions, including (but not limited to) flooding, spoofing, forging data, or causing a denial of service.
• Writing, modifying or distributing computer viruses, Trojan horses, worms, or any other form of malicious software.
• Taking any action for malicious purposes, or in any manner negatively impacting the interests of the company.
• Assisting others in activities which violate this or other Zuar policies and standards, or authorizing others to perform such activities.
• Introducing honeypots, honeynets, or similar technology to company resources, unless explicitly authorized as part of Zuar's security program.

The purpose of this policy is to establish the principles and guidelines for controlling access to systems owned by Zuar.

Scope

The policy applies to all employees and contractors, and the accounts they use in connection with fulfilling their responsibilities to Zuar.

Ownership

Whitney Myers is responsible for implementing and maintaining this policy.

Policy Statement

Access to systems at Zuar must be controlled to ensure only authorized users and applications can access customer and corporate data. Access and access controls must abide by the following principles:

• Deny-by-default: Access must be denied by default. Gaining access requires an explicit configuration step
• Least-privilege: Users and processes must be granted the lowest permission level necessary to perform their role
• Auditability: Access grants are explicitly requested and approved, and an audit trail is persisted

Least-privilege access

Access to sensitive systems and resources is granted based on the principle of least privilege.

The Principle of Least Privilege states that a subject should be given only the privileges needed to complete their task or responsibility. If a subject does not need an access right, the subject should not have that right. In addition, the assignment of rights to a subject should be based on that subject's function and role, rather than the subject's identity or rank.

Each Zuar employee and contractor has limited access to Zuar systems, data and applications. Access is always provisioned to the minimum necessary for the individual to perform their duties and serve the business purpose of their role.

The Principle of Least Privilege is applied not only to user accounts, but also to application-to-application service accounts, machine roles, operating system permissions, private interfaces, as well as the entire publicly-accessible surface of Zuar's systems. Each permission context is reviewed to ensure that only the minimum required rights are granted.

In order to refine access grants over time, and bolster the initial role-based approach, automated tools may be used to continuously monitor access privileges and ag unused ones to be reviewed for revocation.

Role-based access control

Defined permission roles are utilized to assign and segregate access privileges to data and systems.

In a role-based access control approach, access to resources is determined based on roles that reflect a user's set of responsibilities, rather than granted individually for each user. A role-based approach reduces permission customization, improves scalability as teams grow, reduces the likelihood of misconfigured permission settings, and simplifies the access review process.

A default least-privilege role allows for easy onboarding of new users, and reduces the likelihood that users are granted more access than they need.

Zuar employees are granted access to systems according to their role and their team.

If a Zuar employee requires access outside of that provided by their role or team, the employee initiates an access request following the policy outlined in the "requesting and approving access" section.

Requesting and approving access

Access to systems is requested by ling an internal access request ticket specifying the need for the access. Access is approved by the respective manager and granted by administrators based on a least-privilege principle.

Initial access to systems is granted as part of the employee onboarding process, which is documented in full in Zuar's internal knowledge base. Access requests for new employees are typically led by the employee's manager. The ticket trail must contain an explicit approval by the owner of the respective system.

Temporary access

Additional access with privileges exceeding those necessitated by regular duties may be granted on a temporary basis. Each temporary access grant must be accompanied by a valid business purpose, such as an ongoing incident or an operational alert that may lead to an incident if not resolved.

In all cases, access must be revoked immediately once the original business need for the grant no longer exists.

Temporary access grants must be treated as an exception and kept to a minimum. Recurring exceptions must be investigated, and the necessary tooling must be created to alleviate the need for repeated privilege escalation.

Termination process

Termination checklists are executed upon separation with an employee or contractor to ensure asset return, and prompt and complete access revocation.

To ensure access is revoked immediately, Operations or the manager of the departing employee or contractor must file an offboarding ticket as soon as access is no longer needed.

Role changes

An equivalent access revocation checklist is executed when employees change roles within Zuar. New roles may require substantially different access profiles, so it is important that such an event is handled consistently.

Related Controls

• Administrative access
• Role-based access control
• Least-privilege access
• Requesting and approving access

• Termination process

The purpose of this policy is to outline guidelines and practices to protect IT assets used to access sensitive customer or company data, and ensure any such access maintains the security and confidentiality of the data.

Scope

This policy applies to Zuar's physical IT assets, such as laptops, tablets, and smartphones, and all employees and contractors that use them. It also applies to employee-owned devices used to access company information.

Ownership

Whitney Myers is responsible for implementing and maintaining this policy.

Policy Statement

Inventory

The company maintains an inventory of IT infrastructure devices.

Maintaining a complete asset inventory is necessary for keeping IT assets and the data they access and process secure. While Zuar considers its employees' workstations its most critical physical assets to inventory, it may additionally track other asset types, such as company-provided mobile devices or networking office equipment. Policy owner is responsible for maintaining an inventory of these assets using automated or manual means.

Each asset in the inventory is assigned an owner, typically representing its primary user. The asset owner is responsible for complying with relevant sections of the Acceptable Use and Asset Management policies. If an asset is reassigned to another employee, the asset's ownership record should be updated to reflect this change.

Company-owned IT assets which do not process or access customer data, such as printers or scanners, have no impact on data security and as such may be excluded from the inventory.

Related Controls

• Inventory

This policy describes Zuar's requirements with regards to account authentication, including how passwords should be generated, used, and protected.

Scope

The policy applies to all employees and contractors, and the accounts they use in connection with fulfilling their responsibilities to Zuar.

Ownership

Whitney Myers is responsible for implementing and maintaining this policy.

Policy Statement

The overall intent of the policy is to ensure that employees use strong credentials, leverage Single Sign-on (SSO) to reduce the need to maintain one set of credentials for each system, store them securely, and use Multi-factor authentication (MFA) at least for the most sensitive systems.

Single sign-on (SSO)

The company leverages SSO authentication for sensitive systems, wherever available.

Zuar's main Identity Provider is used as its SSO provider.

SSO usage reduces risk by centralizing authentication requirements and enforcement points. It improves employee productivity by reducing the number of credentials they must manage.

Multi-factor authentication (MFA)

Access to sensitive systems requires multi-factor authentication.

Multi-factor (or two-factor) authentication (MFA) has been designated as the preferred method of authentication by NIST (800-63 Digital Identity Guidelines hps://pages.nist.gov/800-63-3/) since 2017. MFA strengthens security by requiring at least one additional factor, in addition to a password, to verify identity. The additional factor is something the user has (such as their phone) or something they are (such as their fingerprint). Since a password is no longer the only means of authentication, and since these other factors are inherently different in nature from memorized secrets, MFA significantly increases the difficulty bar for executing a successful attack. In addition, by not relying solely on password verification for authentication, MFA eliminates the need for periodic password rotation and reduces password fatigue.

Multi-factor authentication is, at a minimum, required for all systems classified to contain sensitive data as per the Data Classification Policy, and strongly recommended for all other systems.

MFA support is a requirement for the adoption of new systems expected to store sensitive data.

For systems storing customer PII and other regulated data, MFA must be enforced: users should not be able to disable the second factor and retain access to these systems, and access to these systems without a second factor should not be possible.

Password management tool

All users with privileged access to sensitive systems are required to use a password management solution.

Password management software improves both convenience and security. A master password is more likely to be long and unique, since only that password needs to be remembered in order for the user to gain easy access to all their other accounts and passwords.

In addition, password managers facilitate generating and using passwords that are unique for each account and significantly stronger than those the typical human can remember.

A user's master password should be memorized and never recorded or shared. Since a password management system is only as secure as the master password used to unlock it, this password should be as long as possible, and should never be reused.

Some password managers also allow secure sharing of credentials, for cases where unique credentials are not required or available. While unique credentials are always preferred, using these sharing mechanisms is encouraged over sharing credentials through other, less secure channels.

Unique User IDs

Individual accounts are required for access to systems storing or processing sensitive information. Unique IDs allow for granular, least-privilege access which minimizes the impact of any single compromised user account. They also improve accountability since every action in an audit trail can be directly associated with a unique individual.

User IDs and passwords are used to control access to Zuar systems and may not be disclosed to any other employee for any reason.

Sharing of credentials is only permitted for systems storing data with low sensitivity as per the Data Classification Policy, or upon the explicit approval of the CEO. Access must still be restricted to the smallest teams and there must be an established business needs. Any shared credentials must be rotated upon the departure of any employee in the share group. Sharing is best done using a Password Management system or a secure password vault.

Password Configurations

Password configuration settings are managed in compliance with the company's Password Policy.

Strong passwords are defined as:

• Having minimum length of 12 characters, maximum length not shorter than 64 characters.
• Containing multiple character types, such as numbers, uppercase, lowercase, and special characters, though these are not required and should not be enforced, and longer passwords are preferred over more complex ones.
• "Longer is stronger". While special characters increase the strength of a password, length is ultimately the biggest contributing factor to its quality. Longer passwords have a greater number of possible combinations, thus making them harder to brute-force.
• Not appearing in a list of commonly-known weak passwords. One such list is maintained at hps://cry.github.io/nbp/.
• Not having been previously used in this or any other systems. Systems should keep a history of previous password and disallow reuse; please refer to the Encryption Policy for details on how these can be securely stored and accessed.
• Not containing easily discoverable personal information such as birthdays, addresses, phone numbers, family names, pet names, friend names, company name, company slogans, co-worker names and favorite popular characters.
• Not containing personal information specified above with common modifications such as substituting '1' for 'i', '0' for 'o', or '@' for 'a'.

Strong passwords are required for all systems classified to contain sensitive data as per the Data Classification Policy, and strongly recommended for all other systems.

The ability to enforce or monitor for strong passwords is a requirement for the adoption of new systems expected to store sensitive data.

Password handling

Password storage must be encrypted. Passwords should not be written down physically (in notebooks, sticky notes, etc) or be stored unencrypted on any device.

Passwords must not be emailed or sent via other messaging and communication methods. Initial passwords for new accounts are exempt from this rule, but must be changed by the new account holder on first use, as detailed below.

Passwords submitted for authentication purposes must only be transmitted via encrypted channels.

Passwords may not be reused across multiple accounts, including between personal and work accounts. Any reused passwords increase the impact of a single compromised account.

Users who believe their account has been compromised are required to immediately reset their password and promptly report the incident to the CEO. Breached credentials must be changed and never used again.

In systems where a password is automatically generated upon account creation or password reset, the user is required to change their temporary password to a permanent one upon first login. To reduce the risk of a complete set of temporary credentials falling into the wrong hands, each part of the credential (password, email, username, etc) must be communicated out-of-band and in a separate channel.

Related Controls

• Password management tool
• Single sign-on (SSO)
• Multi-factor authentication (MFA)
• Password Configurations

The purpose of this policy is to institute the necessary controls to mitigate the accidental loss of Zuar data. These controls assume that events such as accidental data corruption, deletion, or destruction will occur, and mitigate the impact of such events by maintaining reliable backup copies from which data can be readily restored.

Scope

This policy applies to all Zuar systems storing data classified as Customer Confidential, as defined in the Data Classification Policy.

Ownership

Engineering is responsible for implementing and maintaining this policy.

Policy Statement

Customer data stored on Zuar infrastructure is backed up in order to mitigate the impact of events such as:

• Accidental deletion by customer or employee
• Corruption of data due to software or human error
• General system failure
• Physical or environmental disaster at a data center site
• External attack resulting in stolen or ransomed data

In order to ensure timely and reliable restoration of data, Zuar backup and restore procedures are tested on a periodic basis. Data backups are protected with security equal or greater to that of the original system where said data was stored. Backup copies are retained for a sufficient period of time to ensure that data loss events can be mitigated even in the event of multiple, concurrent system failures or unforeseen incidents.

Backup Plan

Customer data is automatically backed up according to a backup configuration scheduled described in the Backup Policy.

Full backups of Zuar production databases are performed weekly and up to four generational backups are maintained. Where available, database transaction logs are enabled and retained to support point-in-time recovery.

Customer data stored in cloud storage such as S3 or GCS may be backed up using those systems' built-in versioning capabilities. Versioned systems record version history for each stored object, and offer the ability to restore that object to any previously saved state. Versioning is typically simpler to operate and more cost-efficient than full backup snapshots, especially for le objects that change less frequently.

Restore Testing

Backup restore tests are performed at least quarterly and ensure that the restored system works end-to-end.

On their own, regularly performed backups are not a sufficient mitigator of data loss events. It is possible that, over time, backed-up data and the method used to perform backups drift relative to the rest of the system. As a result of such drift, available backup copies may become unusable, or require extended database recovery times in order to correct the differences.

To safeguard against this possibility, Zuar performs quarterly testing of its backup restoration process. Backup copies are restored into a sandbox environment, and end-to-end tests are used to verify correct system operation. Once tests are complete, the full sandbox environment is deleted.

This entire end-to-end process encompassing restoration, testing, and cleanup may be fully automated and executed as part of a test suite.

Backup Storage

Backups are encrypted, stored in geographically independent regions, and have equivalent access control to the original system.

Backup copies of Customer Confidential data contain all customer information that was present in the original system. Therefore, it is critical that these artifacts have the same or greater level of protection as that of data in the original system.

Access to backup artifacts is limited to individuals or systems involved in restore testing, as well as infrastructure administrators. Backups are encrypted in accordance with Zuar’s Encryption Policy.

To ensure the resilience of Zuar data, it is critical for backups to be resilient to local data center issues. As such, backup copies are only stored on fault-tolerant systems offering high availability, or are replicated across multiple geographically-disparate cloud regions.

Backup Retention

Backup retention is governed by customer agreements, and business, legal and regulatory requirements.

Full backup copies are retained for a minimum of 30 days, or longer as required by customer agreements or regulatory requirements. The same retention window applies to cloud filestore backups performed using versioning.

Backup copies older than the retention window are promptly deleted by Zuar using the cloud provider's default secure deletion method, other automated means, or, when they can be configured to do so, automatically expire and are securely deleted by the cloud provider.

Transaction logs used for point-in-time recovery may be retained for a shorter window than that of full backups, resulting in a potential Recovery Point Objective increase. For more information, see the Business Continuity and Disaster Recovery Policy.

Related Controls

• Restore Testing
• Backup Retention
• Backup Storage
• Backup Plan

The purpose of this policy is to establish requirements and plans to recover Zuar operations following a disruption due to causes such as natural disaster, loss of access to premises, pandemic, or malicious activity from external or internal sources.

Scope

This policy applies to all Zuar systems determined to be of critical importance to the business, as described in the Impact Analysis

Ownership

Jen Crane is responsible for implementing and maintaining this policy.

Policy Statement

Zuar employs continuity planning and disaster recovery to enable the continuous operation of its product(s) without unacceptable interruptions or data loss. Zuar establishes plans and technical measures that are commensurate with the complexity and risk of each component, taking into account its function and data.

Business Continuity

Impact Analysis

As part of its continuity planning, Zuar performs analysis of its systems and assets classified according to the Data Classification Policy, and determines the criticality of each component to the business. This analysis is performed annually, or upon significant architectural changes or additions of new key vendors.

Critical systems are systems that store Customer Confidential data, as well as those that are deemed business-critical by the team. For each critical system, Zuar determines impact and risk, and plans contingencies accordingly.

Business location

Zuar's operations do not require access to a physical office. Company employees are fully equipped and empowered to work from home and perform all business critical functions, including developing and operating its products, and communicating with each other as well as with customers. Further information on home office security is available in the Physical Security Policy, and Authentication and Password Policy.

Data Backups

Zuar data backups are stored, retained and tested as described in the Backup Policy and all related backup controls.

Data Centers

Zuar uses established Infrastructure-as-a-Service cloud providers to procure the necessary infrastructure required to meet its business objectives. These cloud vendors provide and manage best-in-class data centers that offer asset management, redundant power and networks, and physical security. The company employs security controls to govern its obligations as part of the shared responsibility model required by each cloud provider.

Contingency Planning

Zuar's operating infrastructure consists of 2 main parts:

• Cloud environment hosting Zuar's product
• Critical third-party vendors

Cloud environment

As mentioned in the "Data Centers provided by Cloud Providers"

Business Continuity / Disaster Recovery Program

The company maintains a Business Continuity Policy and Plan which outlines the requirements and a process to recover from prolonged disruptions of business operations.

Jen Crane is responsible for managing any disaster recovery efforts by following the plan outlined herein.

The Disaster Recovery plan outlines the main stages that Zuar follows to bring its systems back online following a major disruption. The exact actions performed in each phase will differ depending on the type of the disruption, but following this plan will facilitate consistency, clear communication, and minimization of impact.

Phase 1: Declaration and notification

A disaster is declared when it becomes clear that an ongoing disruption or outage will significantly exceed the standard time required to resolve an incident. Since exact definitions are hard to formalize, the incident manager and their team of subject-matter experts (SMEs) must determine on a case-by-case basis whether to move into the Recovery phase of the plan, or whether to wait for the issue to be resolved following Zuar's standard resolution strategy.

Jen Crane is responsible for leading disaster recovery efforts, involving any necessary SMEs, and communicating to business stakeholders.

Phase 2: Recovery

The Recovery phase consists of the steps required to create a new production environment and divert trac to it. If the original cloud region is experiencing degraded performance or is otherwise unavailable, the new environment may be created in a different region. In order to prepare for this phase, Zuar maintains:

• Infrastructure scripts and code for creating a new production environment, including the creation and configurations of networks, accounts, databases, and any computing clusters
• Access to sufficient backup copies to satisfy the required Recovery Time Objective
• An ability to update DNS records to point to a new environment

Explicit procedures to recover and validate individual components belong with the component's internal documentation, and are not outlined in this policy.

After all components are restored, testing is performed to ensure that the new environment is fully functional, before making it accessible for customers. As a final step, the team communicates resolution to all affected customers using the appropriate channels.

Phase 3: Retrospective

The Retrospective phase establishes a blame-free environment that allows all parties to gain a clear understanding of the incident and its resolution. A retrospective meeting should occur within 1 week of a disaster recovery event.

Retrospective meetings must definitely outline the root case and response timeline, along with any lessons, as well as action items for improving tooling, process, and software. Following the meeting, a retrospective report outlining key items should be created and shared with all participants and relevant stakeholders. Depending on customer impact, a customer-facing version of the report may be created and shared with customers as required by legal obligations and customer agreements.

Disaster Recovery Testing

Disaster recovery testing is essential for ensuring Zuar's readiness to stay within its RTO and RPO goals, and for confirming Zuar's ability to both act and communicate quickly both internally and externally.

The main DR capability of Zuar is the ability to create a new production environment from scratch, potentially in a separate cloud region, and seeding it with a restore of previously backed up production data.

This capability has two requirements:

• Data backups are sufficiently isolated from the regular production infrastructure boundary. If backups are stored along with the data, then the attacker or an accident can affect both. Sufficient isolation requires that the backups are stored in a separate physical region, under a separate cloud account with a different set of account credentials.
• Infrastructure setup is maintained as code or equivalent procedural documentation exists, to ensure a speedy recovery in an automated or scripted fashion.

This capability addresses disaster scenarios such as:

• Ransomware and cyberattacks
• Unintentionally erased databases, files or folders/buckets
• Prolonged datacenter outage

Due to its distributed workforce, Zuar's operations are well protected against pandemics, because all employees are equipped to securely work from home.

Related Controls

• Business Continuity / Disaster Recovery Program
• Disaster Recovery Testing

The purpose of this policy is to provide guidance on the process of managing change across Zuar's critical systems and products.

Achieving Zuar's business goals requires continuous innovation and rapid improvements to its products and tools. Since any product development carries additional risk, it is imperative that Zuar follow a well-defined process to ensure that sufficient checks and balances are in place to mitigate this risk.

Scope

The policy covers changes to Zuar's production systems, as well as to related tools classified as Customer Confidential as per the Data Classification Policy.

Outside of the scope of this policy are changes such as:

• Changes in development environments
• Internal document updates
• Routine IT changes such as fixing a computer or a printer
• Management of user access to various systems, which is subject to the Access Control policy
• Resolution of data or configuration issues for a particular customer as a result of a support ticket
• Data changes resulting from the use of a established, special-purpose tools or user interfaces

Ownership

Engineering is responsible for implementing and maintaining this policy for critical systems housing Customer Confidential. For all other systems, this policy is maintained by Whitney Myers.

Policy Statement

Zuar performs changes on its production systems by following the Change Management Policy outlined in this document and related procedures.

Infrastructure-as-code

All infrastructure is managed as code and follows the standard code review process including approvals and automated testing.

Infrastructure-as-code is the process of configuring infrastructure through the use of scripts or declarative configuration files, as opposed to manual configuration via interactive configuration tools. Infrastructure code is stored in source control, alongside application code, enabling the same tracking, review and approval processes that are followed by application code.

This approach greatly decreases the risk of human error by creating repeatable processes, and improves development velocity, capacity management responsiveness, and Disaster Recovery due to fewer manual steps required to configure and provision systems.

Change Management Workflow

The Change Management documentation outlines the internal workflow for propagating application and infrastructure code changes to the production environment, including tracking, testing, reviewing and approving.

Zuar maintains a detailed change management procedure. The procedure describes the processes followed as changes ow from development to production, including:

• How changes are developed within a development environment
• How changes are tested, including unit, integration, end-to-end, manual, load, and acceptance testing
• How changes are documented and communicated internally and externally
• How changes are reviewed, including a feedback process leading to eventual approval
• How changes are deployed
• How changes are monitored post deployment and reverted if needed

To support the business goal of high development velocity at low risk, Zuar's change management procedure is maintained as a living document, and is continuously updated.

The documented change management procedure is maintained in Zuar's internal knowledge base. Following best practices, many aspects of the procedure are automated, and as such, do not require additional documentation aside from that which is already a part of their implementation.

By default, performing any step outlined in the change management workflow results in the creation of a log entry for auditing and improvement purposes. Such steps include test runs, the approval flow, and the execution of deployment commands.

Change Management Approvals

All application and infrastructure changes are reviewed by a separate technical resource and approved by authorized personnel before being delivered to the production environment.

Before any new code change is merged into the code base, it must be submitted for review as a pull/merge request. A detailed overview of the code review process is part of Zuar's internal development process documentation.

A code review is typically performed after any relevant automated tests have passed, to ensure that the reviewer's time is efficiently allocated.

Depending on the component being changed and the criticality of the change, a review may require approval from multiple individuals.

Emergency changes

During an active incident involving downtime, performance degradation, or a security issue, some workflow checks and reviews may be expedited in order to fast track the change and patch the ongoing issue. Any such incidents must be evaluated on a case-by-case basis, and require the explicit approval of the incident manager.

Commonly, any workflow steps skipped as a result of an emergency change must be completed retroactively once the incident has been resolved.

Related Controls

• Infrastructure-as-code
• Change Management Approvals
• Change Management Workflow
• SDLC - Separation of environments
• SDLC - Security Reviews
• Change Management Tooling
• Agile Process

The purpose of this policy is to define a data classification framework that can be used to determine the sensitivity of Zuar's data and systems, and to provide guidance surrounding the processes of assigning controls to protect the data's security, confidentiality and integrity.

Scope

The policy applies to all data and systems owned or operated by Zuar.

Ownership

Whitney Myers is responsible for implementing and maintaining this policy.

Policy Statement

All Zuar data is valuable to the organization. However, not all information has an equal value, or requires the same level of protection. Identifying the value of information assets is key to understanding the level of security that is required to protect them. Once the appropriate level of security is identified, relevant controls can be implemented to maintain the security, confidentiality and integrity of the asset. Incorrect classification of assets may result in inadequate or incorrect controls, and inadvertent disclosure or compromise.

Data classification

All company and customer data is classified as per the data classification policy.

Zuar classifies its data in four different categories: Customer Confidential, Zuar Restricted, Zuar Confidential, and Public.

Zuar's systems are then classified based on the classification of the data stored within them. If more than one class of data is stored on a system, the highest class determines the system's classification. The system classification is used to assign controls to each system.

Customer Confidential

Customer Confidential is the highest level of data classification, and information classified as such is protected with the strictest safeguards against unauthorized disclosure or modification. The confidentiality of this data is typically required by law or customer/partner agreements, and access to it must be severely limited and based only on a clear business need.

By default, customer data belongs in this classification. Customer data is defined as data that Zuar's customers would consider themselves owners of, and would regard as their own confidential data. Typically, this data has either been sent to Zuar for storing or processing, or has been created as a result of using Zuar's products.

Examples include:

• Operational customer data
• Personally Identifiable Information (PII) belonging to Zuar's customers
• Data subject to a confidentiality agreement with a customer, such as intellectual property or confidential communication
• Regulated data, such as electronic personal health information (ePHI)

• Credentials that can be used to access Customer Confidential data

Compromising data that falls within this classification could expose the company to legal action. In addition, any exposure of such data could adversely affect Zuar customers and partners, and as a result severely damage the company's reputation, competitive advantage, and industry confidence.

Control applicability varies by the specific type of the system, but Customer Confidential systems (sometimes referred to as "sensitive systems" in control language) require all available data protection controls.

Zuar Restricted

Zuar Restricted data is internal to the company, and it is used to operate its business. Very few people in Zuar have access to Zuar Restricted data.

Examples include:

• Sensitive internal communication not intended for all employees, such as emails and confidential documents
• Legal documents and contractual agreements
• Employee PII
• Customer PII, further detailed below
• Private employee records, such as compensation details and performance reviews
• Customer support cases, as long as they don't contain Customer Confidential data, whether directly embedded or as attachments
• Sensitive company intellectual property (IP)
• Credentials that can be used to access Customer Confidential data

As mentioned above, some limited customer PII can be classified as Zuar Restricted. Examples includes:

• Business contact information
• Sales leads and opportunities
• Confidential communication around establishing and maintaining the relationship between Zuar and its customers

Exposure of Zuar Restricted data can adversely affect Zuar, and can result in adverse effects such as erosion of employee trust and ceding critical information beneficial to competitors. Significant exposure of employee PII could pose a legal risk.

Access to Zuar Restricted data should be restricted to a limited set of employees based on their role (such as Operations or Legal), seniority (executives), or other similar business need.

Zuar Confidential

Zuar Confidential data is data internal to the company that is used to operate the business. Many people in the company have access to this data.

Examples include:

• Data in common messaging channels
• All-hands quarterly presentations
• Company policies
• Documents shared with everyone on the company's domain
• Intellectual Property, such as source code, which is not of significant competitive advantage

Access to some Zuar data and documents may be restricted, but its internal disclosure will not have any adverse impact. Examples in this category are product and engineering design documents, and product analytics data.

Zuar Confidential data is intended to stay private and confidential to Zuar, and should not be made public. Exposure of information within this classification could result in ceding critical information beneficial to competitors, as well as erosion of employee trust.

Public

Public information may be disclosed to any entity or person within or outside of the company. The data may be available through a public website, and does not have confidentiality requirements.

Data owned by Zuar is private by default, as are the information systems storing that data. As such, most company data and systems are not classified as Public. Making data public requires an explicit authorization and publishing step by the owner of the data or the system storing it.

As is true for any data associated with or produced by Zuar, the integrity of public data is an important factor that can affect the company's reputation and brand. For example, a press release must be thoroughly vetted by Zuar leadership, and open source software must be properly licensed and vetted by qualified engineers to be of sufficient quality.

Examples of public data include:

• Press releases
• Sales messaging and advertising
• Reports and ebooks intended for public distribution
• Software released under an open source license

Due to Zuar's need to control and vet any publicly-available information in order to ensure its integrity, any systems hosting public data must themselves not be public. Such systems must be protected using adequate safeguards, such as strong authentication and limited access.

Data/System Ownership

All data and systems are required to have a designated owner. Owners are responsible for appropriately classifying their data and systems, as guided by this policy, and in coordination with the policy owner. Owners are stewards of the data within their purview, and do not legally own it. They are responsible for understanding the nature of the data within their system as well as the security requirements and safeguards associated with it. Owners make decisions about who will have access to the data, including administrative access.

Related Controls

• Data classification

The purpose of this policy is to establish practices for protecting Zuar data in the event of unauthorized access through the use of encryption. The policy describes the different components that can be configured to utilize encryption, the algorithm that must be used for each, and how encryption keys should be managed.

Scope

The policy applies to all systems that store or process Zuar data classified as Customer Confidential as per the Data Classification Policy.

Ownership

Engineering is responsible for implementing and maintaining this policy.

Policy Statement

All sensitive data classified according to Zuar's Data Classification policy is encrypted at rest and in transit using strong, industry-recommended algorithms. Encryption at rest is used across multiple systems and layers of the stack including le systems, le object stores, databases, third-party SaaS services, and directly in Zuar's own developed components. Encryption in motion is primarily achieved through the use of Transport Layer Security (TLS), but may include other secure protocols.

Cloud storage encryption

Third-party cloud storage such as S3 and GCS are configured with a minimum server-side encryption using the vendor's key.

All Zuar files stored in S3 are encrypted using industry-standard AES-256 encryption with AWS-managed keys. S3 encrypts each object on the server, using a unique key, and then further encrypts the keys themselves with a master key stored in AWS KMS.

Data store encryption

Data stores are configured to enable encryption at rest. Zuar utilizes Digital Ocean & AWS for hosting and storing Customer Confidential data. More information on these datacenter providers can be found at https://www.digitalocean.com/security and https://aws.amazon.com/security/, respectively.

TLS certificates and endpoints

TLS usage is evaluated on a quarterly basis using tools such as ssllabs and any grades lower than A are promptly corrected.

Strong encryption of data in transit based on TLS requires up-to-date cipher suites on any TLS-enabled endpoints. The list of suite components that must be kept updated includes the TLS version, configuration options, as well as available algorithms and key lengths. Critical vulnerabilities in older SSL and TLS versions, such as the Beast and Poodle attacks, as well as subsequent deprecations of TLS v1.0 and v1.1 over the past several years, have made securing TLS termination endpoints a necessary major focus of any strong security program.

Zuar maintains a secure and updated configuration of its TLS endpoint, and performs continuous external tests. A passing test requires TLS v1.2 or higher, and AES-128 or higher.

Data in transit encryption

Data in transit over the public Internet is encrypted with industry-standard algorithms.

All public interfaces must only be accessible over secure ports and protocols, such as TLS and ssh. Where possible, communication between Zuar Customers and Zuar's network components and software is encrypted with AES-256 or equivalent to ensure any accidental or malicious exposure of a communication channel is unreadable to unauthorized parties.

Data in transit encryption at Zuar is applied universally to all data, without consideration of that data's classification or its status as Sensitive or Regulated.

Related Controls

• TLS certificates and endpoints
• File store encryption
• Data store encryption
• Data in transit encryption
• Encryption Documentation
• File systems encryption

The purpose of this policy is to establish the requirements for a comprehensive human resources process wherein Zuar attracts, develops, and retains competent and high-performing individuals capable of achieving the company's business and security objectives.

Scope

This policy applies to all Zuar employees and contractors.

Ownership

Jen Crane is responsible for implementing and maintaining this policy.

Policy Statement

Background checks

Background checks are performed on newly hired employees as required by customers and where permitted by law.

Background verification checks carried out by Zuar are proportional to its business requirements and perceived risks. The primary risk component taken into account when determining appropriate background checks is the classification of the information that will be accessed by the employee while performing their role.

• Background checks may include:
• Prior employment verification.
• Personal and professional references.
• Educational verification.
• Criminal history.
• Social Security verification (US-specific).

Background check reports will be reviewed to determine employment eligibility.

Disciplinary process

Material violations of the company's Acceptable Use Policy, Code of Conduct, and Information Security policies and procedures applicable to each employee subjects the individual to disciplinary action that could include termination.

Workforce members who violate Zuar policies are subject to disciplinary steps. Disciplinary steps shall be proportionate to the severity of the violation, and will be enhanced in the event of repeated violations by the same person. The disciplinary process will be carried out in a timely manner in accordance with business needs.

Disciplinary steps may include:

• No Action - for minor violations not serious enough to warrant formal disciplinary action.
• Retraining - If the individual violated a policy, procedure, or standard that was covered in training, the individual may be required to redo the training or complete additional remedial training.
• Warning - for minor violations serious enough to warrant formal action, a warning may be given.
• Improvement Plan - For serious or repeated violations, the individual may be placed on an improvement plan.
• Dismissal - For serious or repeated violations, including failure to correct as a result of an improvement plan, the individual may be terminated from the company.

Policy acknowledgement

Company employees are required to sign and attest their adherence to applicable company policies and procedures.

Zuar requires all employees to sign an agreement confirming their understanding of and commitment to their security roles and responsibilities. Each employee's attestation is saved for auditing purposes, and is a required condition of employment.

Confidentiality agreement

All employees and contractors must sign a confidentiality agreement with the company prior to gaining access to any sensitive information.

Zuar workforce members, contractors, and partners with access to information are required to execute a non-disclosure agreement reflecting Zuar's requirements to protect its data and operational information. The agreement is a legal document and is drafted and reviewed by the legal council.

Job Descriptions

Roles and responsibilities of company employees are communicated through documented job descriptions. Job descriptions are written by hiring managers and reviewed by their manager, peers and HR.

Job descriptions are available internally for all employees to read.

Employee performance reviews

The company has an informal review process that encourages annual employee self-reviews and immediate manager reviews. Reviews include performance assessments, goal setting, and an evaluation of resources required for the next review period.

Reviews are performed by the employee's direct manager, and include performance feedback and growth goal setting for the next review period. In addition to the periodic formal review process, frequent, continuous feedback is given to employees regarding their performance.

Ongoing feedback complements scheduled reviews, and ensures that employees can learn about their strengths and potential areas of improvement as early as possible, and that they are given ample opportunity to adapt and avoid any negative consequences to themselves or the company.

Related Controls

• Confidentiality agreement
• Disciplinary process
• Job Descriptions
• Employee performance reviews
• Background checks
• Policy acknowledgement

The purpose of this policy is to establish an Information Security Program which protects the confidentiality, integrity, and availability of Zuar, Inc.'s data and assets.

The program defines and implements safeguards that help Zuar, Inc. prevent unauthorized access, disclosure, loss, or inappropriate use of data. It aims to ensure that data is protected, both during transmission and at rest, from internal, external, accidental, and deliberate threats.

Scope

The policy applies to all employees of Zuar, Inc., and all systems and data owned by it.

Ownership

Whitney Myers is responsible for implementing and maintaining this policy.

Policy Statement

The Information Security Program institutes technical, physical, and administrative safeguards to protect data and assets from unauthorized access, disclosure, or inappropriate use. The program establishes requirements and standards, and organizes them into Policy documents. Policies encompass, but are not limited to the areas listed below.

Backup

Zuar, Inc.'s backup procedures are documented in its Backup Policy. The purpose of this policy is to institute the necessary controls to mitigate the accidental loss of Zuar, Inc. data. These controls assume that events such as accidental data corruption, deletion, or destruction will occur, and mitigate the impact of such events by maintaining reliable backup copies from which data can be readily restored.

Encryption

Encryption practices are documented in Zuar, Inc.'s Encryption Policy. The purpose of this policy is to establish practices for protecting Zuar, Inc. data in the event of unauthorized access through the use of encryption. The policy describes the different components that can be configured to utilize encryption, the algorithm that must be used for each, and how encryption keys should be managed.

Change Management

Zuar, Inc.'s change management process is documented in its Change Management Policy. The purpose of this policy is to provide guidance on the process of managing change across Zuar, Inc.'s critical systems and products in order to ensure that sufficient checks and balances are in place to mitigate the risks inherent in continuous product development.

Vulnerability Management

Zuar, Inc.'s Vulnerability Management program is documented in the Vulnerability Management Policy. The purpose of this policy is to establish vulnerability management controls and provide guidelines for their implementation. Vulnerability management encompasses source code, operating systems, runtimes, and devices, and vulnerability scans are performed externally via penetration testing and web application scans.

Access Control

Zuar, Inc.'s access control practices are documented in its Access Control Policy. The purpose of this policy is to establish the principles and guidelines for controlling access to systems owned by Zuar, Inc.

Authentication and Password

Zuar, Inc.'s approach to authentication and password management is documented in Zuar, Inc.'s Authentication and Password Policy. This policy describes Zuar, Inc.'s requirements with regards to account authentication, including how passwords should be generated, used, and protected.

Security Incident Response

Zuar, Inc.'s procedures for handling security incidents are documented in its Security Incident Management Policy. The purpose of this policy is to establish requirements and plans for reporting and responding to security incidents impacting Zuar, Inc. 's corporate or customer systems.

Business Continuity

Zuar, Inc.'s business continuity plan is documented in the Business Continuity Policy. The purpose of this policy is to establish requirements and plans to recover Zuar, Inc. operations following a disruption due to causes such as natural disaster, loss of access to premises, pandemic, or malicious activity from external or internal sources.

Risk Management

Zuar, Inc. maintains a risk management program to identify, prioritize, and mitigate risk to acceptable levels. The program consists of regularly performed risk assessments, which identify and prioritize security and compliance gaps, and recommend additional security controls needed to mitigate the risk carried by the gaps.

Policy Management

The company develops and maintains formal policies that govern information security within the company. The policies are formally reviewed and approved at least once a year, and are communicated to all employees.

Policy Creation

Zuar, Inc.'s management team is responsible for creating policies and supporting any relevant requirements and activities through sufficient staffing and budget allocation. The management team is also responsible for ensuring that Zuar, Inc.'s staff is trained to understand and remain familiar with all relevant policies, and for keeping policies available for review both internally and externally by customers and partners.

Policy Reviews

Whitney Myers is responsible for ensuring all Zuar, Inc. information security policies are reviewed at least annually by Zuar, Inc. management, and re-approved or updated as necessary.

Existing policies may be updated and new policies may be created for reasons including:

• Complying with applicable laws and regulations
• Complying with new requirements for certification and governance by the company or its customers
• Addressing new threats
• Technological or business requirements

Security Awareness Training

Security awareness training is provided to new employees, and to all employees on a recurring basis, to promote strong security practices for the whole company.

All workforce members are required to complete Security Awareness Training shortly after they join the company. On a periodic basis, typically annually, the company will provide additional trainings. In addition, they may be asked to complete further training as dictated by operational or environmental changes.

Changes that might lead to adjustment of the training program include:

• A security incident retrospective determining that additional training is required
• Adoption of new technology by the company
• Material changes in organizational policies

Whitney Myers is responsible for creating the training program, and for selecting and updating training material over time. The program may be delivered internally, by qualified personnel, or by a third-party vendor.

Security Council

Management and the Board of Directors consider requirements relevant to security, availability, processing integrity, and confidentiality. These considerations are documented in the company's Information Security Policy, which specifically delegates the overall responsibility of security to the Security Council.

The Security Council consists of the CEO, President, CFO and VP, Engineering . As such, this Council is responsible for creating, approving, and enforcing security policies and procedures, leading the monitoring, vulnerability management, and incident detection and response initiatives, and tracking and reducing risk across the organization.

The Security Council and their supporting team are responsible for setting the direction of and taking the authoritative role in Zuar, Inc. 's Information Security Program and related activities, including:

• Coordinating internal and external assessments
• Designing and implementing security controls
• Leading security incident response activities
• Monitoring systems and networks to detect vulnerabilities and misconfigurations, and to promptly resolve them
• Regular testing of all security controls

Related Controls

• Security Awareness Training
• Security Officer
• Policy Management

The purpose of this policy is to establish the requirements and process for controlling access to Zuar facilities and requirements for data centers hosting Zuar system components.

Scope

This policy applies to the cloud providers used to host Zuar's system components, to Zuar's corporate facilities, to and to home and remote offices used by its employees.

Ownership

Whitney Myers is responsible for implementing and maintaining this policy.

Policy Statement

Most Zuar employees are either remote employees or work extensively from home. All employees are required to secure their physical laptops in the following manner:

• The confidentiality, security and privacy of company data must be preserved, by ensuring that no unauthorized individuals may view or gain access to customer data.
• While in public areas, employees are required to avoid viewing customer support emails and data, and to avoid discussing confidential information in person or through teleconference.
• End user devices containing access to internal company resources, such as laptops and cell phones, must be protected at all times and may not be le unattended. Reasonable precautions must be taken to protect company hardware, software, and information from the and damage.
• Lost, damaged, or compromised hardware must be promptly reported.

The default, company-provided means for workforce members to connect to Zuar information systems leverage secure, encrypted protocols, such as SSL/TLS and SSH, as governed by Zuar's Encryption Policy, and multi-factor authentication, governed by the Authentication and Password Policy. Employees must follow those established practices, and are barred from tampering or subverting them.

Zuar provides workstations, such as laptops, for remote use.

Clear Desk Policy

Workforce members and contractors must take measures to avoid inadvertently exposing confidential data by allowing it to be viewed by unauthorized individuals. Displays for all workstations used to access confidential data must not be viewable from outside the immediate work area. Unauthorized viewing from windows, hallways, or by employees without access rights to the same information should be avoided.

Information not in active use that is classified as confidential must not be displayed or le out in a work area. When information is not in active use, any applications displaying it on a computer should be closed. When leaving a workstation unattended, employees must ensure that its screen is locked, and that automatic screen lock settings are not relaxed. If usage of printed or removable media is allowed by company policy, confidential media must be secured in a locked cabinet once it is not in use, and whenever employees are away from their immediate desk area.

Datacenters

The company uses established Infrastructure-as-a-Service cloud providers to procure the necessary infrastructure required to meet the business objectives. The cloud vendor(s) provide and manage best-in-class Data Centers, including Asset Management, Redundant Power and Networks, and Physical Security. The company has security controls to govern its obligations as part of the shared responsibility model required by the cloud provider.

The capabilities of Zuar's cloud infrastructure provider are summarized below.

Secure Design

• Site Selection - the site is carefully selected to mitigate environmental risks, such as flooding, extreme weather, and seismic activity.
• Redundancy - data centers are designed to anticipate and tolerate failure while maintaining service levels.
• Availability - each Availability Zone is engineered to operate independently with high reliability, and zones are connected to enable easy fail-over without interruptions.
• Capacity Planning - a capacity planning model assesses infrastructure usage and demands, and supports future demand planning.

Business Continuity and Disaster Recovery

• Business Continuity Plan - a plan outlines measures to avoid and lessen environmental disruptions, including steps to be taken before, during, and aer an event.
• Pandemic Response - pandemic response policies and procedures are incorporated into disaster recovery planning.

Physical Access

• Employee Data Center Access - employees who require data center access must first provide a valid business justification. Requests are reviewed and approved by authorized personnel, and access is promptly revoked once access is no longer required.
• Third-party Data Center Access - access requests are granted based on the principle of least privilege, are time-bound, and are approved by authorized personnel.

Monitoring and Logging

• Data Center Access Review - access to data centers is regularly reviewed and is automatically revoked when an employee's record is terminated.
• Data Center Access Logs - physical access to data centers is logged, monitored, retained, and correlated with physical monitoring systems.
• Data Center Access Monitoring - data centers are monitored 24/7 by local teams ready to respond to security incidents by triaging, analyzing, and dispatching responses.
• Surveillance and Detection CCTV - physical access points to server rooms are recorded by Closed Circuit Television (CCTV) cameras. Images are retained according to legal and compliance requirements.
• Data Center Entry Points - physical access is controlled at building ingress points and requires multi-factor authentication.
• Intrusion Detection - Intrusion detection systems are installed to monitor, detect, and automatically alert appropriate personnel of security incidents.

Device Management

• Asset Management - assets are centrally managed through an inventory management system that tracks owner, location, status, maintenance, and descriptive information.

• Media Destruction - media storage devices used to store customer data are decommissioned using techniques detailed in NIST 800-88.
• Operational Support Systems Power - electrical power systems are designed to be fully redundant and maintainable without impact to operations.
• Climate and Temperature - data centers use mechanisms to control climate and maintain an appropriate operating temperature for servers and other hardware.
• Fire Detection and Suppression - data centers are equipped with automatic re detection and suppression equipment.
• Leakage Detection - data centers are equipped with functionality to detect the presence of water, and mechanisms are in place to remove water.

Infrastructure Maintenance

• Equipment Maintenance - equipment maintenance procedures are carried out by qualified persons and completed according to a documented maintenance schedule.
• Environment Management - electrical and mechanical systems are employed to enable automatic identification of issues, and preventative maintenance is performed.

Governance and Risk

• Ongoing Data Center Risk Management - ongoing assessment and mitigation of potential vulnerabilities is performed through data center risk assessment activities.
• Third-party Security Attestation - data centers are tested by third parties to ensure appropriately implemented security measures.

Related Controls

• Datacenters