Information Security Policy

Creative Marketing Solution

INFORMATION SECURITY POLICY

1. Purpose

The purpose of this Information Security Policy is to protect the confidentiality, integrity, and availability of information assets belonging to Creative Marketing Solution (CMS) and its clients. This policy establishes the framework for managing information security risks and ensuring compliance with applicable legal and contractual obligations.

CMS processes data on behalf of its clients, including Zain, and is committed to handling all such data with the highest standards of security and confidentiality.

2. Scope

This policy applies to:

• All CMS employees, contractors, and subcontractors

• All information assets owned or managed by CMS

• All systems, networks, and devices used to process CMS or client data

• All physical locations where CMS information is processed or stored

3. Information Security Principles

CMS is committed to maintaining information security based on the following core principles:

• Confidentiality: Information is accessible only to authorized individuals

• Integrity: Information is accurate, complete, and protected from unauthorized modification

• Availability: Information is available to authorized users when required

• Accountability: All access to information assets is traceable and auditable

4. Roles & Responsibilities

4.1 Senior Management

• Overall responsibility for information security rests with the CEO

• The CEO and Operations Manager jointly oversee information security practices

• Management reviews information security practices annually

4.2 All Employees & Contractors

• Comply with all information security policies and guidelines

• Protect login credentials and never share passwords

• Report any suspected security incidents immediately to management

• Complete information security awareness training as required

• Sign and adhere to confidentiality agreements

5. Asset & Information Management

5.1 Information Classification

All information assets must be classified according to their sensitivity:

• Confidential: Client data, financial records, personal employee data

• Internal: Internal communications, operational documents

• Public: Marketing materials, publicly available information

5.2 Acceptable Use

• Company assets are provided for business use only

• Personal use of company systems must be minimal and must not compromise security

• Unauthorized software must not be installed on company devices

6. Access Control

• Access to information systems is granted on a need-to-know basis

• All users must have unique login credentials — shared accounts are prohibited

• Access rights are reviewed when an employee's role changes or they leave the company

• Strong passwords must be used and changed regularly

• Sensitive systems must use multi-factor authentication where possible

7. Data Protection & Confidentiality

CMS is committed to protecting personal and client data in accordance with applicable data protection laws.

• Client data must not be shared with unauthorized third parties

• Data must be stored securely and disposed of properly when no longer needed

• Employee personal data is maintained confidentially in personnel files

• All employees sign confidentiality clauses as part of their employment contracts

8. Physical Security

• Office premises are secured and access is restricted to authorized personnel

• Sensitive documents must be stored securely and not left unattended

• Clear desk and clear screen policies must be followed

• Visitors must be accompanied by an authorized employee at all times

9. Security Incident Management

Any suspected or actual information security incident must be reported immediately to senior management.

• All security incidents are logged, investigated, and resolved

• Affected clients will be notified in accordance with contractual obligations

• Lessons learned from incidents are used to improve security practices

• A formal incident response procedure is being developed and will be in place by Q4 2026

10. Third-Party & Supplier Security

• All third-party suppliers with access to CMS or client data must agree to comply with this policy

• Supplier agreements include confidentiality and data protection clauses

• Supplier security practices are monitored as part of the supplier management process

11. Business Continuity

• Critical business data is backed up regularly

• Recovery procedures are in place to restore operations following disruption

• A formal Business Continuity Plan is being developed by Q4 2026

12. Compliance & Review

Compliance with this policy is mandatory for all employees and contractors. Violations may result in disciplinary action up to and including termination of employment or contract.

• This policy is reviewed annually or following a significant security incident

• Updates to this policy are communicated to all relevant personnel

• CMS aims to align with ISO 27001 standards as part of its security roadmap for 2027

13. Awareness & Training

Information security awareness is communicated to all employees and relevant contractors.

• Security awareness is provided during employee onboarding

• Regular refresher sessions are conducted to address emerging threats

• Employees are encouraged to raise security concerns and suggestions

Policy Approval

This Information Security Policy has been reviewed and approved by CMS senior management and is effective as of the date signed below.