True Information Security Policy

2.1 Authorised users of information systems

All users of True Corp and its subsidiaries' information systems shall be formally authorised by its IT entity. Authorised users will be in possession of a unique user identity. Any password associated with a user identity shall not be disclosed to any other person.

Authorised users will pay due care and attention to protect True Corp and its subsidiaries's information in their personal possession. Confidential, personal or private information shall not copied or transported without consideration of:

• permission of the information owner
• the risks associated with loss or falling into the wrong hands
• how the information will be secured during transport and at its destination.

2.2 Acceptable use of information systems

Use of True Corp and its subsidiaries's information systems by authorised users will be lawful, honest, decent and shall have regard to the rights and sensitivities of other people.

2.3 System Owners

System owners who are responsible for information systems are required to coordinate with its IT entity to ensure that:

1. Systems are adequately protected from unauthorised access.
2. Business Continuity Plan is in place and be ready to ensure the availability of the key business information system.
3. System can be recovered in the event of loss of the primary source. I.e. failure or loss of a computer system.
4. Data is maintained with a high degree of accuracy and quality
5. Transfer of confidential data via Internet websites must be protected.
6. System owner shall use the approved cryptographic techniques to ensure secrecy and integrity of data.
7. Systems are developed securely and met their intended purpose.
8. Electronic data, including, personal data, transaction data, audit trail and access logs are only retained for a justifiable period to ensure compliance with relevant laws and True Group standard.
9. Third parties that access to True Corp and its subsidiaries's data or provide services to True Corp and its subsidiaries should understand their responsibilities with respect to maintaining its security.

2.4 Operations

Each IT entity of True Corp and its subsidiaries is responsible for all related operation tasks in its responsible area. The IT entity shall ensure that

1. Changes in data and system configuration are controlled.
2. Vulnerabilities related to system and infrastructure are managed and monitored
3. Disaster recovery plan is in place and be ready to restore data to a level commensurate with its importance.
4. Electronic data backup should be kept and be ready for restoration
5. Strong authentication system is in place to authenticate the authorized person
6. IT assets are secured against theft and physical damage
7. Support IT governance, IT risk management and IT compliance activities

2.5 Access Control

True Corp and its subsidiaries operate on the principle of 'least privilege' for access control. This is to ensure that only authorized individuals are permitted access to our business applications, systems, networks and computing devices; that individual accountability is established and to provide authorized users with the access permissions that are sufficient to enable them to perform their duties but do not permit them to exceed their authority

2.6 Personal Information

Personal information must be protected from any harms. Duly authorised officers of the True Corp and its subsidiaries may access or monitor personal data contained in own information system.

2.7 Communications and Operations Security

A defence-in-depth approach shall be implemented to protect True Corp and its subsidiaries information asset from existing and emerging threats. The security related operations such as back-up and recovery, change management, release management and capacity planning shall be delivered by experienced IT officers. Security monitoring shall be performed to detect any unusual or suspicious events and trigger the information security incident response team to handle the incident.

Remote access to the True Corp and its subsidiaries network is only permitted for preauthorized employees using a True Corp managed asset. This is achieved using an encrypted VPN solution that performs security validation checks against the asset and is supported by multi-factor authentication.

2.8 Individual in breach of this policy

Individuals in breach of this policy are subject to disciplinary procedures and legal actions. True Corp and its subsidiaries will take legal action to staffs or third parties to ensure that its information systems are not used by unauthorised persons.