This policy establishes the framework for our quality and information security management systems and demonstrates our commitment to meeting applicable legal, regulatory, and contractual requirements.

Technofusion is committed to:

• Ensure compliance of all business activities with applicable laws, regulations, or legislation of the Republic of Azerbaijan, together with relevant international standards, codes of practice, and client requirements. It is the responsibility of every employee to understand and comply with the laws, regulations, and policies that are relevant to their job.

• Ensuring confidentiality, integrity, availability, and security of owned and operated physical and information assets at all times for serving the needs and expectations of interested parties both within the organization and from external parties including clients, suppliers, regulatory, and governmental bodies, and to provide the necessary resources to achieve this.

• Ensure fulfillment of customer requirements and deliver products and services that meet or exceed their expectations by actively engaging with them to understand their needs, and feedback, and use this information to drive continuous improvement and to enhance customer satisfaction and meet their changing needs.

• Ensure information security has the highest priority in all activities by setting annual objectives based on a thorough understanding of the risks and vulnerabilities associated with our information assets.

• Implement, maintain, and continuously improve the Quality and Information Security Management Systems based on the process approach and risk-based thinking, in accordance with the requirements of international standards.

• Ensure continual improvement of the Integrated Management System by conducting periodic evaluations and assessments of our IMS to identify areas for improvement by reviewing our policies, procedures, controls, and security measures to ensure they align with industry best practices and emerging threats.

• Conduct regular training and awareness programs for our employees to ensure they have the necessary knowledge and skills to support our integrated management system. This includes providing guidance on security best practices, promoting a culture of IMS awareness, and encouraging employees to actively participate in maintaining a secure environment.

• Provide necessary resources, training, and awareness programs to promote IMS culture within the organization. 

Integrated Management System Policy

## Policy Statement

The company has robust and well-established procurement processes that are designed to ensure solutions and services procured are cost-effective, maintain the confidentiality, availability, and integrity of information, and are fit for purpose. It is therefore important that throughout the procurement and subsequent contractual period company is clear on its expectations in terms of data protection, information security, and supplier responsibilities.

## Information Security Risks and Requirements for Third Parties

The security of information is the key focus in the company's ISO/IEC 27001:2022 risk assessment, procurement, and management strategy. We employ a risk-based and proportionate approach to safeguarding information assets, ensuring the security of all data held on our systems, whether related to our own business, our clients, or our third-party suppliers. Aligning our procurement processes with identified information asset risks helps guarantee that we have the necessary systems in place to meet the level and quality of information security expected by the company. We will require all our third-party suppliers to be aware of and agree to the contents of this policy.

Technofusion has established a Supplier Information Security Due Diligence procedure to ensure that suppliers/vendors, which have to have access to the sensitive information of the company, conform to our information security requirements.

## Supplier Access to Company's Information
The company will allow third-party suppliers to access its information and data where formal contracts and data sharing agreements exist in accordance with current data protection legislation, the company`s IMS, and where:

• Accessing the information is an agreed-upon part of the solution/service provided.
• The processing and viewing of information are necessary for the maintenance and troubleshooting of the solution being provided.
• Information may need to be reconstructed, repaired, or restructured.
• Information has been provided for inclusion in the solution/service by the company.
• Information may need to be transferred to other systems or during IT solution upgrades.
• Information may need to be collected with agreement from, and on behalf of the company.

Third-party suppliers wishing to gain access to the requested HRASD department via e-mail.

Third-party suppliers will only be granted access to project information related to works they are undertaking by the Engineering department, only after getting approval from the CEO.

## Secure Termination of the Supplier Relationship
Once access is no longer required, the supplier/vendor will be disabled from Technofusion systems.

De-provisioning of access rights is possible after third-party supplier requests for release act preparation via e-mail or the Jira system.

The process of information handling involves connecting a third party to the necessary source of information, such as Jira or a corporate Dropbox folder. The owner of the process, for instance, a programmer or the team lead of programmers in the case of programming, or the CEO in the case of a company providing accounting services, initiates a request to grant access.

These requests are submitted through the ITSM portal to the Head of the Engineering Department, with the CEO's name specified in the "share with" section. The maximum time for execution is set at one business day. The requester is responsible for monitoring their request until it is successfully closed.

In case of any changes occurring, it is communicated using e-mail.

## Site Audits
As part of the company`s commitment under its quality and information security management system standard accreditation, we may seek to undertake an independent Audit of any third-party supplier currently working on our behalf if this is deemed necessary for the works being delivered. The Audit review may necessitate a visit to the third-party supplier’s main office where access to, or processing of, personal data is being undertaken on behalf of Technofusion. The objective of the site visit(s) will be to assess the adequacy of the physical, logical, and operational controls in place and assess whether the supplier’s approved IT security procedures are embedded within day-to-day operations.

## Security Incident Management
Third-party suppliers will be expected to have appropriate Security incident management procedures in place, which correspond to the level of service being provided, and sensitivity of the data. The extent of these responsibilities will be specified in the contract or data-sharing agreement.

A third-party supplier company or individual is required to notify us of the incident via email and provide comprehensive information regarding the incident's details. This should include an explanation of what occurred, the underlying cause, the steps taken to mitigate the consequences, and any actions undertaken as part of the lessons-learned process.

## Breaches of Policy
Breaches of this policy and/or security incidents can be defined as events that could have or have resulted in loss or damage to Technofusion information assets, or an event that is in breach of Technofusion’s security procedures and policies. All third-party suppliers contracted to provide, support, or access solutions, that enable Teshnofusion to carry out its business functions and deliver its services, have a responsibility to adhere to this policy and all supporting requirements as described and referenced within formal documentation and agreed contractual agreements.

All employees and third-party suppliers have a responsibility to report security incidents and breaches of this policy as quickly as possible through Technofusion’s Security incident management policy.

Our Policies

Integrated Management System Policy

Supplier Security Policy