Information Security & Acceptable Use Policy

This Policy establishes the minimum information-security requirements for OMIYO LTD.

The objective is to protect:

• company information;
• client information;
• personal data;
• intellectual property;
• credentials;
• source code;
• systems;
• devices;
• communications; and
• business operations.

This Policy applies to:

• employees;
• contractors;
• temporary workers;
• consultants;
• developers;
• suppliers with system access; and
• other authorised persons accessing OMIYO information or systems.

OMIYO will apply the principles of:

• least privilege;
• need-to-know access;
• confidentiality;
• integrity;
• availability;
• secure configuration;
• appropriate authentication;
• controlled access;
• secure development;
• supplier risk management; and
• incident preparedness.

Each person must use their own account where technically possible.

Shared credentials should not be used unless there is a documented business requirement and appropriate controls.

Users must not share passwords or authentication credentials.

OMIYO's target standard is to require multi-factor authentication (MFA) for:

• email;
• cloud services;
• administrative accounts;
• source-code repositories;
• production systems;
• financial systems; and
• other systems where MFA is available and appropriate.

OMIYO will prioritise implementation of MFA as a security improvement.

Users must:

• use strong, unique passwords;
• avoid reusing business passwords for personal accounts;
• never disclose passwords to others;
• avoid storing passwords insecurely; and
• use an approved password manager where practical.

OMIYO may permit appropriate personal devices for business activities where necessary.

Where personal devices are used for OMIYO work, users must maintain:

• supported operating systems;
• security updates;
• malware protection;
• device locking;
• appropriate password/PIN protection; and
• reasonable protection against unauthorised access.

OMIYO may require company-managed devices for higher-risk projects.

Devices used for OMIYO work must have appropriate malware/endpoint protection where reasonably available.

Users must not disable security software without authorisation.

Access must be granted according to business need.

When a person:

• leaves OMIYO;
• stops working on a project;
• changes responsibilities; or
• no longer requires access,

access must be reviewed and removed or adjusted promptly.

OMIYO personnel must not access client systems unless authorised.

Where possible, OMIYO should use:

• named accounts;
• client-provided access;
• MFA;
• least-privilege permissions; and
• appropriate logging.

OMIYO personnel must not request or retain client passwords where alternative secure access mechanisms are available.

Company and client information must be stored only in authorised systems.

Users must avoid storing confidential business information on:

• personal USB devices;
• unmanaged public cloud storage;
• personal email;
• unapproved applications; or
• other unauthorised systems.

Users must exercise caution when:

• opening attachments;
• clicking links;
• responding to unusual requests;
• transferring confidential information; or
• receiving requests involving payments or credentials.

Suspicious communications should be reported.

Confidential company or client information must only be disclosed to authorised persons with a legitimate business need.

Confidential information must not be used for personal purposes.

Only appropriately licensed software may be used for OMIYO work.

Employees and contractors must not install unauthorised software that could introduce security, licensing or privacy risks.

Open-source software may be used where appropriate.

Projects must consider:

• licence obligations;
• security;
• provenance;
• dependencies;
• vulnerabilities; and
• client contractual requirements.

AI tools must be used responsibly.

Users must not enter confidential client information, personal data, credentials, source code or other restricted information into an external AI system unless:

1. 1. the use is authorised;
2. 2. the relevant provider has been assessed as appropriate;
3. 3. contractual and privacy requirements have been considered; and
4. 4. appropriate safeguards are in place.

AI-generated outputs must be appropriately reviewed before being relied upon in material client work.

Where OMIYO develops software, reasonable secure-development practices should be applied, including:

• access control;
• code review;
• dependency management;
• vulnerability management;
• secure configuration;
• separation of development and production environments where appropriate;
• protection of credentials; and
• appropriate testing.

Third parties receiving access to OMIYO or client information must be appropriately assessed.

Contracts should contain suitable confidentiality, security, privacy and intellectual-property protections.

Any suspected:

• unauthorised access;
• malware infection;
• lost device;
• credential compromise;
• accidental disclosure;
• data breach;
• suspicious payment request;
• security vulnerability; or
• other security incident

must be reported promptly to the Director or designated responsible person.

Remote workers must:

• use secure networks where reasonably possible;
• protect screens from unauthorised viewing;
• lock devices when unattended;
• avoid exposing confidential information in public environments; and
• follow this Policy regardless of location.

Failure to comply with this Policy may result in:

• removal of system access;
• disciplinary or contractual action;
• termination of contractor access;
• investigation; and/or
• legal action where appropriate.

OMIYO will progressively strengthen its security controls.

Priority improvements include:

1. 1. MFA across critical systems;
2. 2. centralised password management;
3. 3. formal device-security standards;
4. 4. access reviews;
5. 5. supplier/subprocessor register;
6. 6. incident register;
7. 7. backup and recovery arrangements;
8. 8. secure software-development practices; and
9. 9. periodic security reviews.