Information Security Policy

Document Approval Form

1. Information Security Policy

1.1 Objective

The purpose of this Information Security Policy (the “Policy”) is to protect, maintain and safeguard the collection, use and disclosure of the personal data provided by Qinet’s clients, contractors, employees, and general public to us, in compliance with the Singapore Personal Data Protection (Amendment) Act 2020.

This policy is aligned to and complements Qinet’s Data Protection Policy to assist our clients, contractors, employees, and general public in understanding how we collect, use, disclose, process, protect and retain personal data that is in our possession.

This policy specifies the high-level security requirements for the Qinet Data Protection Management Programme (DPMP) with the aim to protect from intentional or unintentional acts or natural events, which may result in the unauthorized disclosure, modification, destruction, abuse or misuse of the information assets under Qinet purview.

The Policy strives to provide the control measures to mitigate risks to an acceptable level in the course of the conduct of the company business.

1.2 Scope

This policy applies to all employees (permanent, temporary and contract) within Qinet, including but not limited to overseas offices and any third-party vendor/supplier providing services to or on behalf of Qinet for all personal data in the custody of Qinet for its customers, business partners and stakeholders.

To ensure all affected staff understand the Information Security requirements, training will be held in conjunction to that under the DPMP for all employees.

The scope of applicability for this information security will be the Data Inventory Map defined in the DPMP manual.

1.3 Policy Review

This policy is owned by Qinet. The Managing Director (MD) is the approving authority for this Policy and for any changes arising.

Qinet Management together with relevant staff, are responsible to review the policy on an annual basis as well as ensuring that it is communicated to all relevant employees.

This policy may, when required, be released to external parties such as regulators, customers and business partners. The release of the document must be approved by the Director.

1.4 Definitions

1.4.1 Information Asset

An Information Asset is a piece of information, stored in any manner which is recognized as ‘valuable’ to the organization. Information assets have one or more of the following characteristics:

• They are recognised to be of value to the organization.
• They are not easily replaceable without cost, skill, time, resources or a combination.
• Include Personal Data as defined in the Data Inventory Map.

It includes data, information and software regardless of the media in which they are stored (e.g. paper-based to electronic forms), the methods by which they are transmitted (e.g. electronic mail, facsimile, tele-conversation) and any computer processing facility, inclusive of, but not limited to, hardware, infrastructure and networks, operating system, software including off-the-shelf products, services and user-developed applications, database management systems or computer programs associated with information asset usage, whether owned, leased or licensed by Qinet.

1.4.2 Information Asset Owner

A person who is assigned to exercise the organization’s ownership and with authorized access to the information asset. The owner is typically the creator of the information i.e. employee responsible for the content of the information asset.

Information Assets Owners shall be responsible and accountable for classifying information, in all forms including paper-based to electronic forms, by considering its value, legal requirements, and criticality to Qinet as well as sensitivity to unauthorized disclosure, modification or availability.

1.4.3 Information Asset Custodian

A person who possesses an information asset that is not owned by him or her shall be considered as a custodian of the information asset.

1.4.4 Qinet Proprietary Information Assets

Information assets owned by Qinet for which Qinet has legal rights and which are not common knowledge outside the organization.

1.4.5 Non-Qinet Proprietary Information Assets

Proprietary information assets in the custody of Qinet that belong to other organizations such as its customers and business partners.

2. Policy on Handling of Personal Data

2.1 Categorisation

The personal data collected are categorized as per the Data Inventory Map (DIM). The collection, use, transfer/disclosure to external parties within and outside Singapore, its retention and disposal is clearly specified in the Data Inventory Map.

Unless authorized by the Managing Director of Qinet, there shall not be any deviation from what is defined in the DIM.

2.2 Information Confidentiality

All the personal data shall be classified as CONFIDENTIAL and accessible on a need-to-know basis as per the DIM.

This classification is for information assets which have significant value to the organization. The unauthorised disclosure of such information would be detrimental to the interests or reputation of Qinet / Stakeholders, would cause embarrassment to the organization, or would be of advantage to a competitor.

Examples of information assets which will be classified under this category are finance/accounts data e.g. P&L statements, payslips, etc. Also included in this category are the personal data of Qinet staff which will be marked as “Private & Confidential”.

Customer privacy shall be respected and employees can only use such information for work-related purposes. Usage of personal data for all forms of personal consumption is strictly prohibited.

Authorized employees are responsible to handle all personal data under their care with utmost confidentiality. This applies to any third party who has access to such information.

3. Management of Information Assets

Any information that has not been classified shall be treated as RESTRICTED and handled accordingly. Unauthorized use or alteration of Qinet’s information assets is a serious offence. Qinet may take disciplinary or legal action against anyone who uses or alters Qinet’s information assets without authorization.

3.1 Labelling and Marking of Information Assets

• Qinet proprietary information assets that exist as hardcopy documents (e.g. letters, standards/guidelines, transparencies, manuals, files, printouts) or as electronic documents (e.g. Word, Excel office documents, presentation slides) and are classified as RESTRICTED or above shall have the classification level printed or stamped at the page footer of every page.
• Qinet proprietary information assets that exist as electronic mails and are classified as CONFIDENTIAL or above shall have the classification level marked at the subject title (e.g. Subject: Re: Customer Satisfaction Results (Confidential)). Printed copies of electronic mails that do not bear any classification marking shall be deemed to be RESTRICTED.
• Folders or electronic storage devices (e.g. CD-ROM) containing information classified as CONFIDENTIAL and above shall be labelled with the highest classification level of the information assets stored in it.
• Non-Qinet proprietary information assets shall have their original classification level or copyright markings retained.
• Sensitive documents shall be sent in sealed and signed envelopes, to named parties only. The phrase “To be opened by Addressee only” shall be marked or labelled on envelopes containing information assets meant to be read by the addressee only. Recipients should acknowledge receipt of the document.
• Non-sensitive documents shall be sent in sealed and signed envelopes addressed to the intended parties only.

3.2 Copyright Marking of Information Assets

Information assets that are deemed to have intellectual value and would be distributed to external parties (e.g. Qinet technical publications or papers) should have a copyright marking on the covering page consisting at least of the following:

• The "copyright symbol", i.e. © or the word "Copyright"
• The year of first publication
• The name of the copyright owner, i.e. Qinet Pte Ltd
• An example of such a marking is: © 2026, Qinet Pte Ltd. Additional information on the rights to copy or distribute the information assets should be added if necessary.

3.3 Storage of Personal Data

• Personal Data collected via hardcopy shall be secured in a lockable storage cupboard, cabinet or safe when not required to make it inaccessible by unauthorized personnel. Information kept in the lockable storage shall be labelled according to its classification and shall be treated corresponding to its sensitivity. There should be an authorized key holder to any such storage cupboard, cabinet or safe. A second key should also be available with a trusted key holder via a dual control process in case the key holder is unavailable or the item is required in an emergency.
• Information in hard copy printouts shall be subjected to the categorization assigned and shall be treated with appropriate level of sensitivity. Documents shall be printed on a need-to basis only and shall be labelled accordingly.
• Protection of information stored on removable media, including tapes, flash disks, removable hard disks, CDs, DVDs and printed media, is required according to their classification to prevent unauthorized disclosure, modification, removal or destruction of assets and interruption to business activities.
• Contents of re-usable media shall be made unrecoverable when the media is to be removed from Qinet premises for service, maintenance or disposal by a third party. Prior to the media being accessed or removed from Qinet premises, authorization from Qinet directors must be sought and verified.

3.4 Transmission and Distribution of Information Assets

• Dispatch of information asset classified CONFIDENTIAL shall be done by courier services or registered post.
• Dispatch of information assets classified RESTRICTED could be done by public dispatch system.
• Transmission using E-mail or other electronic systems shall only be allowed if the E-mail or electronic systems implement approved encryption and access authentication.

3.5 Disposal of Information Assets

The methods of disposing CONFIDENTIAL information assets (containing personal data), including materials used or produced in the process of preparing the information assets such as drafts, printer copies and spoilt copies etc., shall be as follow:

• Information assets that are paper documents shall be shredded using an approved shredding machine.
• If an information asset cannot be shredded, it shall be physically destroyed (e.g. burning) to the extent that it cannot be recovered by any means.
• If the information assets reside on magnetic media such as hard-disks or tapes, a low-level erasure using an approved deletion program shall be performed to wipe out the information completely.
• Magnetic media such as hard-disks containing information assets classified as CONFIDENTIAL level shall be wiped and kept in storage till there is an acceptable/minimum amount to engage a professional third party data disposal service.

3.6 Backup of Information Assets

Information backup is required to maintain the availability of information and information processing facilities.

All employees shall ensure business information kept on their personal computers are backed up into either external hard drives or a secured personal cloud server.

Financial and personal data shall be backed up separately on an external hard drive by the Finance Manager periodically.

4. Roles and Responsibilities

4.1 Senior Management (MD & Directors)

The responsibilities of management include:

• Set the Information security policies to maintain the confidentiality, integrity and availability of information.
• Provide visible commitment and support of the Information security policies, including chairing the Information Security Management Committee.
• Ensure that adequate security personnel resources, training and deployment of function are allocated to ensure compliance with these policies.
• Ensure the development of the necessary organization-specific procedures and programs to implement and administer these security policies.
• Ensure that responsibilities for Information security are defined and communicated to all personnel.
• Classify data/information based on the level of value and sensitivity.
• Assess the threats against and the vulnerabilities to Qinet.
• Approve procedures for responding to security breaches.
• Enforce compliance with the Information security policies and legal/regulatory requirements.

4.2 Information Users

Every employee and non-employee user, contractor is charged with the duty of protecting and preserving Qinet’s information assets, and to ensure that the information assets are used only for the direct benefit of Qinet. They are the information users and their responsibilities include:

• Comply with the established Information security policies and participate as ISMS working committee members when required.
• Maintaining the security of the information resource they are accessing and is held accountable for any actions associated with the use of the system under their identification.
• Ensuring that personnel under their supervision understand and discharge their obligation to protect Qinet’s information assets.
• Taking appropriate mitigating actions for deviations from established policies and standards.
• Reporting any occurrence or suspicion of an information security violation or incident.
• Supporting the investigation and follow-up of security violation or incident.
• Ensure their accesses are the minimum required to conduct their responsibilities/duties satisfactorily by verifying he or she is not able to completely perform an instruction from input to approval. They should highlight if they have excessive system accesses to their manager.

4.3 Information Asset Owner

The owner of an information asset shall authorize access to others on a need-to-know basis.

The owner of an information asset that has classification level which may change with time, shall review and change the classification level of the asset when appropriate. The owner shall inform all custodians who possess copies of the information asset to change the classification level of their copies accordingly. For example, the classification level of information on product under development may be downgraded once the product is released.

Custodians of Non-Qinet proprietary information assets shall confirm the definition of the classification level and the procedures for handling the information assets with the owners as these information assets may have classification levels that do not follow the Qinet proprietary information assets classification. The information assets shall be handled as required.

4.4 Data Protection Officer (DPO)

The role of the DPO is to spearhead and coordinate initiatives for the protection of the information assets of Qinet. His responsibilities include:

• Develop and maintain the information security policy and supporting standards and guidelines.
• Protect information assets from accidental or intentional disclosure, modification, destruction or denial through the implementation of appropriate security procedures and practices that are commensurate with the value of the asset.
• Assess and approve any deviations from the information security policy, in concurrence with the Managing Director.
• Identify control requirements and procedures for implementation.
• Conduct awareness programs relating to data protection.
• Investigate and report any data breaches.
• Co-coordinate reviews of the data protection initiatives & programme to ensure compliance with regulatory and data protection requirements.

4.5 Other Managers & Supervisors

• Ensure related issues under their Department, including planning the schedule of internal audits, arranging management review meetings and ensuring corrective and preventive actions are followed up in a timely and effective manner.

5. Technical Controls

5.1 Email communications

Each employee shall be assigned a unique e-mail address, ID and password to ensure accountability. Employees are responsible for any content they send via the Qinet corporate e-mail system.

Only the Qinet corporate e-mail system shall be used for business-related communications with other Qinet employees and any external parties, including but not limited to, partners, vendors, service providers and customers.

No employee shall misuse a given account or system. Misuse includes the following:

• Using Email or any broadcast media for purposes of defamation or personal attack.
• Using Email or any broadcast media to post potentially offensive information that would impinge on another’s culture, ethics or morality.
• Attempting to send offensive or seditious material to other users, either within a given organization or outside.
• Attempting to download offensive or seditious material from the Internet.

Misuse shall be caused to terminate a given account and can be the basis for disciplinary action.

5.1.1 Sending/Receiving Emails

Employees should take precaution when sending out e-mail to external parties. CONFIDENTIAL information should be password protected before sending. Employees should verify the recipient e-mail address before sending such e-mails. The password should not be sent using e-mail but via an alternate channel such as SMS.

Files of unknown origin should not be sent to any external party. Employees should also exercise due diligence and care when sending or forwarding unsolicited e-mails and should comply with relevant laws or regulations at all times.

Official business e-mail should be sent using the Qinet corporate e-mail system. All employees shall not use external e-mail systems for official correspondence to the external party.

All e-mail addresses assigned to employees are the property of Qinet. Qinet reserves the right to monitor, log and access all transmission of e-mail messages sent and received by employees. E-mails shall be made available for inspection to authorized personnel for investigation, when necessary.

Employees must not send chain e-mails and spam.

Employees should refrain from opening e-mail of doubtful origin. Files of unknown origin should be returned to the sender without disclosing sensitive information.

Employees shall not reply or act on unsolicited e-mails.

5.1.2 Retaining Emails

E-mail that can be construed as “official records” (e.g. minutes of meetings, reports, correspondence, etc.) should be kept for the required retention period, either archived or printed and filed. Such e-mail archives should be made retrievable upon the employee resignation.

E-mails containing personal data shall be classified as per the Masterlist of Quality Records and kept as per defined retention period.

5.1.3 Sending Information to Third Parties

All information (other than public information) that is sent to third parties shall carry a disclaimer or advice to highlight the sensitivity of the data.

Third party partners should also be made aware of their obligations on protecting Qinet information.

5.2 Password locking, Operating System updates and Anti-virus

All employees shall set a secure password to lock their computers. The minimum requirement for the passwords shall be as follows:

• At least 8 characters long
• A mixture of upper- and lower-case letters and numbers
• Inclusion of at least one special character (e.g., ! @ # ? ])

All employees are advised to update their laptop operating systems and anti-virus software monthly.

Computers used in office that has contact with personal data files shall be kept to the latest update no later than a month and this is checked during the Security Measures Audit as part of the Internal Audit conducted annually.

5.3 Data Backup and Encryption

Files containing personal data handled by the Finance Manager shall be backed up in the external hard disks weekly. The files shall also be encrypted using Bitlocker in the external hard disk. The back up key shall be printed and kept in the locked cabinet in office.

5.4 Data Disposal

Softcopy information assets containing personal data shall be deleted using a data wiping software Eraser.

Hardcopy information assets containing personal data shall be shredded using the office P3 cross cut shredder.

All data disposal shall be recorded in the Personal Data Destruction Record and approved by the Director.

6. Administrative Controls

6.1 Clean Desk Policy

Employees should always practice a clean desk policy and especially when they are away from the office. Sensitive documents must not be left unattended. All documents containing customer or Qinet proprietary information must be always safe-kept and locked away when not in use.

Signage is placed around the office to remind employees of the policy.

6.2 Clear Screen Policy

Standard screen saver or lock screen shall be enabled to protect workstations / laptops against unauthorized access, misuse of information stored therein, and misuse of access privileges granted.

User shall log-off from the computer when not in use and should not leave sensitive information on screen.

6.3 Employee Compliance

All employees must comply with the Information Security Policy and are required to acknowledge reading and understanding its contents whenever there are new updates to the Policy.

All employees must be responsible in handling Qinet information. As stipulated in the employment contracts, employees must protect the confidentiality of proprietary information, both during and after the contractual obligations with Qinet. Corresponding disciplinary actions shall be taken against employees found to have misused Qinet information.

When an employee, contractor or third party exits Qinet, the direct reporting manager shall be responsible for ensuring that all equipment assigned to him or her be returned, and any access rights granted are to be removed.

7. Physical Controls

7.1 Lock and Key

All information (documents) stored in the office cabinet shall be locked and only accessible by the departmental head and the Managing Director.

The main office door shall be locked when there is nobody in the office. The keys are only held by the Directors and Finance Manager.

8. Incident Management

8.1 Definition

An Information Security Incident is the occurrence or development of an unwanted or unexpected situation which indicates either:

• a possible breach of an information security framework or
• a failure of information security controls which have a significant probability of compromising business operations.

Examples of Information Security Incidents include (but are not limited to):

• Direct loss or theft of Classified Information (e.g. papers taken from car, post intercepted, unauthorized download)
• Loss or theft of equipment used to store Classified Information (e.g. laptop, smartphone, USB stick)
• Accidental or unauthorized disclosure of Classified Information (e.g. via misaddressed correspondence or incorrect system permissions/filter failure)
• Corruption or unauthorized modification of vital records (e.g. alteration of master records)
• Computer system or equipment compromise (e.g. virus, malware, denial of service attack)
• Compromised IT user account (e.g. spoofing, hacking, shared password)
• Break in at location holding Classified Information

A serious Information Security Incident is an incident whose impact, if unmanaged, has the potential to reach Moderate or above on the Qinet’s Risk Acceptability Criteria.

This procedure shall complement the Data Protection Complaint procedure if they relate to complaint due to personal data breaches.

8.2 Process

• All Information Security Incidents shall be reported promptly to the Managing Director.
• The severity of the incident shall be assessed, and the management response shall be proportionate to the threat.
• Key information about serious Information Security incidents, including the impact of the incident (financial or otherwise), shall be formally recorded and the records shall be analysed in order to assess the effectiveness of information security controls.
• New risks identified as a result of an incident and shall be assigned to the relevant risk owner and unacceptable risks shall be mitigated promptly in accordance with the Qinet’s risk management processes.
• Serious incidents shall be reported to the appropriate external authorities where relevant by authorized individual.