Cybersecurity Policy

Cybersecurity Policy

Authorized By: Chief Information Security Officer (CISO)

Purpose/Overview

Securing and protecting the confidentiality, integrity, and availability of Safire’s information assets is critical to the protection of critical infrastructure, financial transactions, and Nonpublic Information (NPI). Failure to address cybersecurity risks could result in significant costs to Safire due to lost, compromised, or unauthorized use of NPI, legal and regulatory actions, reputational damage, and loss of customers. Cybersecurity Programs are critical to proactively protecting data, mitigating risks, and responding efficiently to cyber incidents, while maintaining compliance with best practices and regulatory requirements.

This Policy provides a framework for Safire’s Cybersecurity Program, which establishes a roadmap for effective security management. These controls protect and maintain the confidentiality, integrity, and availability of Safire’s Information Systems and assets, including NPI.

This Policy is based upon the findings of Safire’s Risk Assessment and addresses the following core cybersecurity functions:

• Protect the confidentiality, integrity, and availability of digital information and infrastructure.
• Manage Safire’s risk of cybersecurity exposure and compromise.
• Ensure a secure and stable information technology (IT) environment at Safire.
• Identify, respond to, and recover from events involving the misuse, loss, or unauthorized disclosure of assets.
• Monitor information systems for anomalies that might indicate a compromise.
• Promote information security awareness and decrease the risk of compromise.

Scope

This Policy covers all of Safire’s cybersecurity practices across all areas of its business. All Safire employees, including contractors, third parties, and anyone else with access to Safire’s systems and data, are required to comply with this Policy.

Policy

Roles and Responsibilities

The CISO, IT, and Compliance teams will provide oversight and administrative authority for the company’s Cybersecurity Program. Business units will retain ownership of their respective systems and data but will not have administrative authority over the Program.

The CISO will

• Implement and maintain written policies, approved by Executive Management, setting forth the expectations and goals for the protection of the company’s Information Systems and Nonpublic Information (NPI).

• Ultimately be responsible and accountable for the company’s cyber compliance, risk, and resilience.

• Oversee and implement the company’s Cybersecurity Program and report to management on the company’s overall cybersecurity posture.

• Facilitate a comprehensive review of Safire’s Cybersecurity Program and controls at least annually.

• Prepare and, where applicable, submit annual Certifications of Compliance or related documents required by regulations.

• Conduct a cybersecurity Risk Assessment at least annually to inform the design of policies and the overall cybersecurity program.

• Review cybersecurity policies, standards, guidelines, and procedures annually to ensure compliance with applicable laws, regulations, and industry best practices.

The IT team will

• Implement and maintain technical controls to support the company’s Cybersecurity Program.
• Monitor the company’s information systems for anomalies indicating compromise.
• Manage vulnerability management, secure configuration baselines, and logging/monitoring.

The Compliance team will

• Ensure the company’s compliance with applicable laws, regulations, and industry best practices.
• Conduct regular audits and compliance-based risk assessments to identify areas for improvement.

Employee Responsibilities: All Safire employees, contractors, consultants, and temporary workers will:

• Ensure information assets are only for authorized Safire business purposes.
• Take reasonable steps to ensure electronic assets are not improperly disclosed, modified, or destroyed.
• Never deliberately circumvent information security controls or make Safire’s resources available to unauthorized persons.
• Report suspicious activity or unauthorized access regarding Safire’s Information Systems immediately to a manager or the CISO.

Cybersecurity Policies to Support the Cybersecurity Program

Safire will implement and maintain written policies in support of the company’s Cybersecurity Program. Such policies may include, but are not limited to:

• Acceptable Encryption

• Acceptable Use

• Access Control

• Anti-Phishing

• Asset Inventory and Device Management

• Clean Desk

• Data Breach Incident Response

• Data Classification

• Data Protection

• Disaster Recovery Plan

• E-mail

• Email Retention

• Information Logging Policy

• Patching

• Physical Security

• Portable Media/USB

• Remote Access

• Risk Assessment

• Systems and Network Security

• Third-Party Service Provider Policy

Training and Awareness

• All Personnel: Safire will provide regular cybersecurity awareness training for all personnel. This training will be updated to reflect risks identified in the Annual Risk Assessment and current real-world threats.
• Executive Training: The Senior Executive Team shall receive specialized training sufficient to address strategic cybersecurity risks.
• Tracking: Safire will track and record attendance at training activities. Records of attendance shall be retained for audit purposes. Failure to complete training is a violation of this policy.

Risk Management, Monitoring, and Continuous Improvement

• Assessment: The CISO will conduct a formal cybersecurity Risk Assessment at least annually and upon material changes to business operations or technology.
• Monitoring: IT will monitor information systems for anomalies indicating compromise and maintain vulnerability management, secure configuration baselines, and active logging.
• Testing: The Cybersecurity Program will be tested annually (e.g., exercises, tabletop simulations, incident response drills), and lessons learned will be applied to improve controls.

Cybersecurity Governance and Reporting

• Reporting: The CISO shall report in writing at least annually on the Cybersecurity Program and material cybersecurity risks to the Board of Directors and Senior Executive Team. Interim updates will be provided as material risks or incidents arise.
• Escalation: The CISO, IT, and Compliance departments are authorized to escalate material risks, urgent security issues, or conflicts regarding risk acceptance directly to the CEO for immediate resolution.

Compliance

Compliance Measurement

The policy owner will verify compliance through methods such as business tool reports and internal and external audits. Oversight is provided by CISO, IT, and Compliance functions, which do not have direct enforcement authority without escalation to the CEO.

Exceptions

Any exceptions must be approved by the Policy Owner in advance.

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies, Plans, and Procedures

• NIST Cybersecurity Framework (CSF)
• NIST Special Publication 800-171

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page