1. PURPOSE

This Information Security (IS) Policy is established to:

• Ensure the confidentiality, integrity, and availability of information while maintaining appropriate authenticity, traceability, and accountability.
• Prevent, detect, respond to, and promptly address information security incidents, risks, and violations.
• Meet the requirements of ISO/IEC 27001:2022, including Amendment 1:2024, and applicable Vietnamese laws and regulations on cybersecurity, information security, personal data protection, and electronic transactions.
• Establish, maintain, and continually improve the Information Security Management System (ISMS) based on risk assessments and interested-party requirements.
• Control the creation, storage, access, transmission, exchange, and sharing of information with customers, partners, and external parties through Company-approved channels.

2. SCOPE

This Policy applies to:

• All officers, employees, collaborators, interns, and individuals working for or representing the Company; and contractors, partners, and suppliers who access or process the Company's information or information systems.
• All information assets owned, managed, or controlled by the Company, including data, paper records, software, source code, hardware, network systems, cloud computing services, accounts, cryptographic keys, and business systems.
• Information exchange channels with customers and external parties, including Company email, call centers, ticket/helpdesk systems, CRM, customer service portals, business systems, and applications such as Zalo, WhatsApp, Telegram, Viber, Messenger, or similar platforms when authorized by the Company.

3. LEGAL AND REGULATORY BASIS

This Information Security Policy is established and applied based on relevant standards, legal instruments, and requirements, including:

• ISO/IEC 27001:2022 – Information Security Management Systems; ISO/IEC 27001:2022/Amd 1:2024 – amendment concerning actions to address climate change; and ISO/IEC 27002:2022 – information security control guidance.
• Law on Cybersecurity No. 116/2025/QH15 and its effective implementing and guiding instruments; and legal requirements on cyber information security to the extent they remain effective or apply during transition periods.
• Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP, together with effective amendments, supplements, and implementing guidance.
• Law on Electronic Transactions No. 20/2023/QH15; Decree No. 23/2025/ND-CP on electronic signatures and trust services; and other sector-specific regulations applicable to the Company's actual products, services, and activities.
• The Company's internal policies, procedures, and regulations; contracts, confidentiality agreements, customer/partner requirements, and other legal compliance obligations identified in the Compliance Obligations Register.

4. GENERAL PRINCIPLES

• Confidentiality: Information may only be accessed, used, or disclosed by authorized individuals or organizations for proper purposes.
• Integrity: Information must be protected against unauthorized modification, deletion, or destruction; significant changes must be approved and logged.
• Availability: Systems, data, and services must meet defined availability, recovery, and business continuity requirements.
• Accountability: Information access and processing activities must be attributable to responsible parties, recorded, and capable of appropriate review.
• Compliance: All activities must comply with approved policies, procedures, legal obligations, contractual requirements, and controls.

5. INFORMATION SECURITY OBJECTIVES

• Protect the Company's, customers', partners', and employees' information assets against unauthorized access, disclosure, use, modification, loss, or destruction.
• Identify, assess, and address information security risks, reducing the likelihood and impact of incidents.
• Ensure employees and relevant parties understand their responsibilities, required competencies, and information security compliance obligations.
• Build a culture of information security, personal data protection, and safe practices throughout the Company.
• Reduce the risk of leaks, loss, misdirected messages, sharing with unauthorized recipients, or use of information for improper purposes when communicating with customers, partners, and external parties.

6. RESPONSIBILITIES AND COMMITMENTS

• Management: Approve the Policy and information security objectives; ensure the ISMS is integrated into Company operations; assign responsibilities, provide resources, and review ISMS effectiveness.
• ISO/ISMS Committee: Coordinate implementation, monitoring, review, and improvement of the ISMS; maintain risk assessments, risk treatment plans, the Statement of Applicability (SoA), internal audit programs, and compliance obligation tracking.
• IT/Technology Department: Administer systems and implement access controls, secure configurations, patching, logging, backups, monitoring, maintenance, and technical incident response.
• Human Resources and Administration Department: Coordinate Policy communication and awareness training; manage confidentiality commitments, job changes, onboarding, and offboarding.
• All employees: Follow the Policy and procedures, protect assigned assets, never share accounts, attend training, and promptly report incidents or suspected information security violations.
• Partners/Contractors/Suppliers/Customers: Comply with applicable security, data processing, and other obligations under contracts, agreements, and Company requirements.
• Department managers: Approve access needs and control the creation of customer communication groups/channels; ensure participants, content, and channels are appropriate for the purpose, authority, and information classification level.
• Personnel communicating with customers: Use only approved channels, verify recipients, avoid sending sensitive information through unsuitable channels, and record important business communications in official systems.

7. INFORMATION ASSET MANAGEMENT AND CLASSIFICATION

All information assets must be identified and recorded in the appropriate asset inventory, with their owners, storage/processing locations, and protection requirements specified. Asset owners are responsible for reviewing this information when changes occur.

Information must be classified according to its sensitivity and the impact of disclosure, modification, loss, or unavailability. At a minimum, the classifications include:

• Public: Approved for public release; disclosure is not expected to cause significant adverse impact.
• Internal: For use within the Company or by authorized groups; must not be disclosed externally without approval.
• Confidential: Disclosure, modification, or loss may harm the Company, customers, employees, or partners. Examples include customer data, contracts, personnel records, logs containing identifying data, and internal technical documents.
• Restricted: Highly sensitive information or information with very high impact; access requires specific approval. Examples include private keys, authentication secrets, privileged administration information, and system secrets.

Information must be labeled or otherwise identified and stored, transmitted, copied, shared, retained, and destroyed in accordance with its classification. Personal data must be identified and protected according to its nature, processing purpose, and legal requirements. Internal classification does not replace state-secret classification levels under applicable law.

8. ACCESS CONTROL

• Access is granted on a need-to-know and need-to-use basis, with least privilege, role appropriateness, and approval from the information/system owner or an authorized delegate.
• User accounts must be individually assigned and must not be shared. Each individual is responsible for activity performed using their assigned account.
• Passwords must be sufficiently long, difficult to guess, and not reused across services. Company-approved passphrases and password managers are preferred. Passwords must be changed promptly if compromise is suspected; a fixed length rule alone must not replace risk assessment and authentication controls.
• Multi-factor authentication (MFA) must be applied to administrator accounts, remote access, critical systems, and other high-risk cases, and expanded based on risk assessment results.
• Access must be revoked promptly when an employee leaves, changes departments, or no longer needs it for work. Privileged and remote access should be revoked immediately where possible.
• Membership in communication groups, customer support accounts, communication-channel administrator accounts, and support tools must be granted, changed, reviewed, and revoked according to role, business need, and approval.
• When personnel leave, change departments, or stop supporting a customer/project, managers must coordinate with HR and IT to revoke system and communication-channel access and recover related devices and assets; the actions must be recorded.

9. SYSTEM AND DATA SECURITY

• Servers, computers, and mobile devices must be securely configured, patched, protected against malware, and monitored in a manner appropriate to their risk.
• Do not install software, use unapproved cloud services or AI tools, or copy data to personal devices or accounts without authorization.
• Important data must be backed up according to defined business requirements and RPO/RTO. Backups must be protected, recovery capability tested, and records retained.
• Sensitive data transmitted externally or over public networks must use suitable encryption and secure protocols/channels. Cryptographic keys and system secrets must be managed according to Company requirements.
• Devices and applications used to communicate with customers must be screen-locked, patched, and securely configured. Rooted/jailbroken devices or untrusted public devices must not be used to access Company data.
• Only software, communication platforms, cloud services, and work tools assessed/approved by the Company or specifically authorized may be installed and used.

10. PROTECTION OF PERSONAL INFORMATION AND CUSTOMER DATA

• The collection, processing, storage, use, sharing, provision, transfer, and deletion of personal data must comply with the Law on Personal Data Protection No. 91/2025/QH15, Decree No. 356/2025/ND-CP, and effective implementing guidance.
• Personal data may only be processed for a defined purpose and on a lawful basis. Consent must not be assumed to be the basis for every activity. Where consent is legally required, it must be valid, specific, demonstrable, and supported by a withdrawal mechanism.
• Sharing or transferring personal data abroad requires assessment of the legal basis, purpose, recipient, processing location, and safeguards, and completion of impact assessment records/procedures, notifications, or other legal obligations. Internal approval does not replace legal obligations.
• Data subject requests, including deletion requests, must be received, verified, assessed for legal grounds, and handled within statutory time limits. A 72-hour period must not be treated as a general statutory deadline for every case. Continued retention is permitted only where a lawful basis exists.
• External sharing of personal data, customer data, or internal information must be for a proper purpose, authorized, sent to the correct recipient, limited to what is necessary, and subject to appropriate agreements/safeguards. The Company's role in the processing activity must be correctly determined.
• Do not send passwords, OTPs, PINs, private keys, secret keys, API keys, access tokens, or authentication secrets through messaging applications. Identifying data, sensitive personal data, and customer data must be exchanged through approved channels with appropriate access controls and audit trails.

11. COMMUNICATION WITH CUSTOMERS AND EXTERNAL PARTIES

• Official channels include Company email, ticket/helpdesk systems, CRM, call centers, customer service portals, or business systems approved by the Company and capable of retaining records.
• Applications such as Zalo, WhatsApp, Telegram, Viber, WeChat, Messenger, or similar platforms may only be used as supplementary channels when approved. They are not automatically official storage or confirmation channels for important business requests.
• Contracts, official quotations, acceptance records, payments, complaints, service change requests, access grants/revocations, incident notifications, and legally binding commitments must be handled through official channels/systems in accordance with procedures.
• Before sending information, personnel must verify the recipient, group, address/phone number/account, attachments, and permitted scope of sharing. Additional verification is required for unusual or high-risk requests.
• Customer communication groups must have a clear purpose, an assigned owner/administrator, and appropriate members. The owner must review, add, or remove members when roles, projects, or personnel change.
• Files sent or received through supplementary channels must be checked for source, content, file type, and sensitivity. Files related to support, incidents, or business decisions must also be recorded in official channels.
• Do not forward customer information, screenshots, system logs, internal documents, personal data, or configuration details to unauthorized individuals, groups, or third parties.
• IT/ISMS must periodically review approved applications, assess risks in new communication channels, and issue secure configuration guidance. Platform providers must be appropriately assessed when they process Company or customer information.

12. INFORMATION SECURITY INCIDENT RESPONSE

• Employees must promptly report incidents or suspected information security violations to the ISMS contact through a Company-designated reporting channel. Do not delete evidence or conceal incidents.
• All incidents must be recorded, classified, assessed for impact, and handled under the Information Security Incident Response Procedure, including assignment of responsibility, containment, recovery, and post-incident follow-up.
• After an incident, conduct root cause analysis, assess control effectiveness, and implement corrective and preventive actions.
• Misdirected messages, personal data leaks, lost devices, account compromise, malware, cyberattacks, suspicious files/links, or suspected customer impersonation must be reported and handled immediately. For incidents involving personal data, assess notification/reporting duties and statutory deadlines.

13. TRAINING AND AWARENESS

• All employees must receive information security awareness training upon joining and at least annually. Additional training is required when there are significant changes in risks, technology, or regulations.
• New employees must be briefed on the Policy and complete mandatory training before receiving appropriate access or within the Company's onboarding period.
• Training sessions, awareness assessment results, and follow-up actions must be recorded, retained, and periodically evaluated for effectiveness.
• Training must cover information classification, personal data protection, password/MFA management, approved customer communication software, recognition of sensitive information, prevention of misdirected messages, phishing/impersonation, and incident reporting.

14. MONITORING AND AUDIT

• Conduct internal ISMS audits according to the planned program, ensuring the entire ISMS scope is audited during the audit cycle, at least annually. Adjust frequency based on risk, changes, and previous audit results.
• Periodically or unexpectedly monitor, measure, and check compliance with this Policy using defined indicators, criteria, and methods.
• Compliance with customer communication channel requirements must be checked periodically or unexpectedly, especially in departments that regularly interact with customers, provide support, or process customer data.
• Information security violations must be recorded, assessed, and addressed under internal rules, contracts, and applicable laws, with proper authority and procedure.

15. POLICY MAINTENANCE AND REVIEW

• This Policy must be reviewed and updated at least annually, or when there are changes to laws, standards, technology, products/services, ISMS scope, organization, risks, or interested-party requirements.
• Each updated version must be reviewed and approved by an authorized person before issuance. Superseded versions must be identified and controlled to prevent unintended use.

16. CONTINUAL IMPROVEMENT COMMITMENT

The Company is committed to maintaining and continually improving its Information Security Management System (ISMS) to ensure it remains suitable for:

• The Company's strategic objectives, business operations, and operational requirements.
• Actual information security risks, threats, and changes in the operating context.
• ISO/IEC 27001:2022, Amendment 1:2024, and relevant legal, contractual, and national requirements.

To fulfill this commitment, the Company will:

• Periodically review ISMS effectiveness and suitability at least annually or when major changes occur in the organization, systems, services, or operating context.
• Assess information security risks, update risk treatment plans, select suitable controls, and maintain the SoA and evidence of implementation.
• Monitor and analyze incidents and nonconformities, identify causes, implement corrective actions, and evaluate their effectiveness.
• Provide ongoing information security training and awareness development according to personnel roles and risk levels.
• Conduct internal audits and management reviews as planned, at least annually, addressing inputs and outputs required by ISO/IEC 27001:2022.
• Collect feedback from departments, partners, and customers; review contextual changes, including whether climate change is a relevant issue for the ISMS, to identify improvement opportunities.

Management is responsible for:

• Providing the resources, budget, personnel, and tools needed to maintain and improve the ISMS.
• Ensuring the Policy, objectives, and security culture are communicated, understood, and implemented throughout the Company.
• Approving and monitoring improvement results and addressing matters requiring decisions at management review meetings.

Continual improvement is a mandatory, ongoing commitment embedded in the Company's routine activities.