Information Security Policy

NewWave Wellbeing & Inclusion Ltd.
Version 1.0 | Approved by the CEO on 19 March 2026 | Document owner: NewWave Wellbeing & Inclusion Ltd. | Prepared by: COO

Introduction

NewWave Wellbeing & Inclusion is committed to providing the highest level of Confidentiality, Integrity, and Availability of information and related assets by:

• Protecting them from all threats using reasonably practical measures.
• Ensuring continual improvement in business continuity of its services and related operations.
• Monitoring, regularly reviewing, and continually improving Information Security Management.
• Ensuring that ISMS is implemented within the legal framework of local, provincial, and federal governments.

Purpose

It is vital to NewWave Wellbeing & Inclusion's reputation, operation, and financial well-being that company information assets contain controls to ensure confidentiality, integrity, and availability. These controls must protect the organization’s information assets, and the business processes they support, against unauthorized use, disclosure, transfer, modifications, or destruction, whether accidental or intentional, or the denial of availability of these assets or business processes to legitimate users.

The intention of the NewWave Wellbeing & Inclusion IT policy, standards, and procedures is to support the NewWave Wellbeing & Inclusion Information Security Policy enacted by NewWave Wellbeing & Inclusion to ensure the establishment of procedural, technical, and physical safeguards that will be utilized by NewWave Wellbeing & Inclusion to protect sensitive information from unauthorized access, disclosure, corruption, or destruction. NewWave Wellbeing & Inclusion policy, standards, and procedures will be based upon established industry best practices and internationally recognized information security standards which include ISO 27001.

The NewWave Wellbeing & Inclusion Information Security Policy will apply these controls to all information that it stores, processes, or transmits for business, statutory, or regulatory functions on behalf of NewWave Wellbeing & Inclusion, NewWave Wellbeing & Inclusion customers, or NewWave Wellbeing & Inclusion third parties.

Scope

This NewWave Wellbeing & Inclusion Information Security Policy contains a series of common requirements across the NewWave Wellbeing & Inclusion business, third-party vendors, and contractors. All employees, contractors, part-time and temporary workers, and those employed by others to perform work on company premises or granted access to company information or systems are covered or required to adhere to this policy.

Roles & Responsibilities

The CEO and COO of NewWave Wellbeing & Inclusion is the senior-level management team that serves as the authorizing officials for assessments of all NewWave Wellbeing & Inclusion information systems. These individuals must authorize the information system for processing before commencing operations.

The COO is responsible for:

• Providing vision and leadership for developing and implementing information security that aligns with the mission of NewWave Wellbeing & Inclusion.
• Directing the planning and implementation of enterprise IT and Security in support of NewWave Wellbeing & Inclusion business operations to assure the confidentiality, availability, and integrity of the information utilized by NewWave Wellbeing & Inclusion.
• Participating in strategic and operational governance processes of NewWave Wellbeing & Inclusion as a member of the senior management team.
• Developing and maintaining an appropriate information security structure that supports the needs of the business.
• Ensure the security policy is frequently reviewed and updated as needed to ensure compliance.

Compliance, Enforcement, and Sanctions

Audits of compliance with this standard shall be performed regularly. Such audits shall be performed by an authorized employee of NewWave Wellbeing & Inclusion or by an outside individual or firm at the discretion of management.

Users are required to observe and follow the policies, standards, and procedures of NewWave Wellbeing & Inclusion at all times. Non-compliance with the security policies and standards may result in disciplinary action, up to and including termination of employment, unless prohibited by applicable law.

Policy

Where possible, all NewWave Wellbeing & Inclusion Governance policy documentation will address the purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance per ISO 27001 guidance.

NewWave Wellbeing & Inclusion shall ensure that all policies, procedures, standards, and guidelines are created and maintained by the appropriate responsible stakeholders. All IT Security Governance documentation shall be reviewed and updated annually or upon significant organizational change. Where possible, procedures should be developed to directly facilitate the implementation of the policy and the associated technical controls.

This information security policy document should state management commitment and set out NewWave Wellbeing & Inclusion’s approach to managing information security. NewWave Wellbeing & Inclusion ensures information security in all categories. To ensure Security, Confidentiality, Integrity, and Availability NewWave Wellbeing & Inclusion has these policies which are mentioned below.

Network Security

• The system shall use password-based authentication
• The system supports multi-level system access.
• The system shall support multiple login sessions and authentication concurrently, and each session shall be protected from each other.
• The system shall have strong security rules for user registration and updating passwords.
• The system shall have a time limit for locking sessions when the user leaves the system unused.
• The system shall keep historical records (logging) of events and processes executed in or by an application.
• Database access is provided according to the access rights defined in the access control policy.
• Confidential information stored in shared storage has limited access and only can be accessed by authorized users.
• The system shall ensure business user accounts cannot be administrator accounts and vice versa.
• The user accounts shall possess privileges within the application to perform their responsibilities. However, the privileges must be limited.

Data Security

• To ensure the confidentiality of NewWave Wellbeing & Inclusion data, appropriate security measures shall be implemented.
• To manage database access tightly with the principle of least privileges, limited access rights are given to the people.
• Database is protected from threats such as Excessive and unused privileges, Privilege abuse, SQL injection, Poor auditing records, Storage media exposure, Denial of service, and Malware by applying security controls.
• Audit and monitor the user activities by automated log reviewing, to detect anomalous activity.
• Application auditing is done at these levels: Access and authentication auditing, User and administrator auditing, Security activity monitoring, Vulnerability, and threat auditing.
• Data will be backed up regularly and backup data shall be stored securely.
• The system shall ensure all data protected by the application has consistency (either create a new and valid state of data or return all data to its state before a transaction is started).

System Security

• The system implements a security policy that specifies who may have access to each specific system resource and the type of access that is permitted in each instance.
• An auditing function monitors and keeps a record of user access to system resources.
• The system has been protected by a firewall to enforce the security policies on the incoming and outgoing traffic on the network.
• Identified security needs of the system by removing unnecessary services, applications, and protocols, configuring users, groups, permissions, and configuring resource controls.
• System shall use compile-time and run-time defense to avoid buffer overflow attacks.
• There should be sufficient security controls in place to keep the application safe without hiding core functionality or source code.
• Separation of duties can be used to prevent individuals from acting fraudulently.
• The system shall always check the validity of data that third-party services send and not give those services high-level permissions within the system.
• The system shall have multiple security control layers for the authentication process for user access.
• Processes communication between the kernel and user interface must be protected by defining the privileges at every level of the 3-tier architecture.

Review of the policies for information security

The information security policy shall be reviewed on an annual basis or as needed to ensure that it is relevant to the context of the organization. The review should include assessing opportunities for improvement of NewWave Wellbeing & Inclusion’s information security policy and approach to managing information security in response to changes to the organizational environment, business circumstances, legal conditions, or technical environment. Information security risks are addressed and documented in the risk register.

The review of the information security policy should consider the results of management reviews. There should be defined management review procedures, including a schedule or period of the review. Please refer to management standard operating procedures for more details.

Associated Documents and Records

• Document Master List
• Management Review Minutes
• Corrective and Preventive Action Log
• Training materials and records
• Management standard operating procedures

ISO 27001 Compliance Mapping