Employee On-boarding and Screening Process

Prior To Employment

ThingLogix will ensure that employees, contractors and third party users understand their responsibilities, and are suitable for the roles they are considered for to reduce the risk of fraud, misuse of the facilities or theft of the organization's property. Security responsibilities should be addressed prior to employment in job descriptions and terms and conditions of employment. All candidates for employment should be screened in relation to the sensitivity of the role they are being considered for.

Screening

Prior to completing an unconditional employment offer, ThingLogix will carry out the background checks, including a combination of the following:

• Verifying references from previous employers
• Confirmation of any academic or professional credentials claimed if compulsory for the role
• User identity check against passport or other approved documentation verifying an individual’s right to work in the USA (if applicable).
• Criminal Records check for eligible roles

ThingLogix may perform other checks for certain roles for which there is a specific contractual, regulatory or legal obligation. These checks can include credit or Security Clearance checks but will be directly related to the classification of the information to be accessed and the sensitivity of the role e.g. consulting on U.S.A. Government work. All personal information gathered in relation to individual customer applications will be treated as sensitive (restricted) and handled in accordance with the data protection act.

Employment Background checks for US, UAE and European Employees are conducted by HR through:

https://www.hireright.com/background-checks

False or Misleading Credentials

An applicant who deliberately or knowingly provides misleading, erroneous, or deceptive information in an application form, resume, or during an interview may be immediately eliminated from any further consideration for employment. Any subsequent revelation which indicates that an employee deliberately or knowingly provided incorrect information during the recruitment process may lead to dismissal and/or referral to external authorities.

Employment Agreement

All Employees are required to complete an NDA as well as an Employment Agreement. On occasion, employees may be asked to sign additional documents related to a specific client engagement or location. All such secondary agreements must be reviewed and executed by the CEO and our outside General Counsel.

Management Responsibilities

ThingLogix management will require employees to apply and adhere to information security in accordance with the relevant policies. This should ensure that all employees:

• Are properly briefed on their information security roles prior to being granted access to any sensitive information or resources,
• Are motivated to comply with the security policies,
• Achieve and maintain a level of security awareness relevant to their role,
• Comply with the terms and conditions of their employment including the security requirements.

Employee Briefings and Training

Employees will be be given an on-boarding security briefing which will walk through ThingLogix development and security practices as well as identifying resources such as the Intranet and key leadership roles. Employees will be briefed on security controls and processes as controls and processes are updated and during annual company all-hands meetings.

The HR disciplinary process

will be applied to cases of employees committing a security breach. However, this will not commence prior to the verification that a security breach has occurred and will ensure that correct and fair treatment is applied. Where a serious security breach has been verified consideration will be given to the immediate revocation of employee access rights and privileges.

Employees should be recognized and rewarded as soon as possible for exemplary work. Recognition may take the form of:

• Recognition at company meeting
• Stock awards
• Monetary compensation

Termination or change of employment

The Executive team has responsibility for the employment termination process and will work with the line manager of the employee leaving to ensure that all the relevant security aspects are applied to the process. The termination process for contractors or third party supplier staff will be handled by the responsible agency or direct employer. Contracts with employment agencies or third party suppliers will include the requirement to comply with this policy.

Termination paperwork or questions about the termination process should be submitted to our HR Attorney:

• Susan Morgan - susan@morganesq.com

Return of assets

All employees are required to return all ThingLogix assets on termination of employment, contract or agreement via their line manager, this includes:

• Hardware (laptops, PCs or smart phones)
• Media storage devices (USB drives, CDs or DVDs)
• Physical and logical access tokens (VPN tokens, door access swipe cards)
• ThingLogix documents
• Software

Removal of Access Rights

The access rights of all employees, contractors and third party users to information and information processing facilities will be removed on termination of employment, contract or agreement, or adjusted as necessary on change of role. This is detailed in the Access Control section of this document and should be carried out by their line manager.

This aspect is of particular importance where an employee is dismissed following a disciplinary process or suspended pending the outcome of an investigation. It should take account of both physical and logical access rights. Any shared team or departmental access rights such as door codes or passwords to shared services should also be changed.

A request for removal of access rights is initiated through a service desk ticket originated by the HR Team. Each system owner is responsible for assessing impact. The System Admin is responsible for removing the access per the request and updating the service ticket. System owners validate the removal of access.

Employee Handbook

https://docs.google.com/document/d/1PRou54dLB13SEz07gI4WHK1PA9gvSCnWLh7caWgq4p0/edit