External Parties

Third Party Contractors

Purpose: This procedure dictates the security requirements for working with outside contractors, as required by delivery teams (e.g. Operations Team).

On-boarding Procedure

1. Operations team will determine the scope of the engagement
2. Operations team will complete the following:
   • Signed NDA
   • Consulting Agreement
3. Completed and signed agreements will be countersigned in DocuSign by the CEO or member of the Executive Team
4. All documents will be retained in DocuSign and attached to the account record in Copper CRM, where applicable

Contact With Authorities

Purpose: This procedure should be followed for any contact by or request for information by government or law enforcement entities.

Applies to: ALL EMPLOYEES AND CONTRACTORS

Policy Description: All requests for information, comment or work materials received from any government or law enforcement entity will be handled in the following manner:

• Any such request shall be immediately forwarded to the CEO and ThingLogix General Counsel
• No Employee shall comment or provide any information directly to the requesting entity without the participation of the CEO and the General Counsel

Contact With Special Groups

Purpose: This procedure should be followed for any contact by or request for information by any special interest group. For the purposes of this policy, "Special Interest Groups" will be defined as any group which is not law-enforcement or a government entity.

Applies to: ALL EMPLOYEES AND CONTRACTORS

Policy Description: All requests for information, comment or work materials received from any government or law enforcement entity will be handled in the following manner:

• Any such request shall be immediately forwarded to the CEO and the General Counsel
• No Employee shall comment or provide any information directly to the requesting entity without the participation of the CEO and the General Counsel
• Once approved by the CEO and General Counsel, public comment or a response may only be made by a member of the executive team.

Review of Information Security

The implementation of the security policy and continuous compliance monitoring by the information security team and managers will be carried out, as specified. Independent reviews will be carried out as required at the discretion of the information security manager or senior executives with security responsibilities, or may be conducted by the information security manager or senior executive. The review will consist of verifying third party compliance with these ThingLogix InfoSec policies and doing a risk assessment of any item deemed not implemented or partially implemented, followed by an agreed upon remediation plan and timeline. If remediation plan and timeline cannot be mutually agreed to, or the remediation plan is not faithfully executed, the third party contract shall be terminated for breach of contract and processes for removing access shall be executed.

Security of External Parties

ThingLogix will control access to information processing facilities by third party organizations and individuals. Access by third party organizations will be assigned based on a risk assessment ensuring that access is only granted where there is a genuine, authorized business requirement. Third parties may include the following:

• IT service providers
• Other IT contractors for hardware and software maintenance and support
• 3rd party data handling providers
• Hardware or device/equipment manufacturers

Identification of risks from External Party Access

The security of remotely managed or accessed assets could be put at risk by third parties who do not have adequate security controls in place. Where a third party connection requirement is identified, a risk assessment will be carried out to ensure that adequate controls are implemented to mitigate the risk. The risk assessment will take into account the type of access required (network access, access to physical location), the sensitivity of the information potentially accessed and the existing security measures employed by the third party. Remote access to ThingLogix assets will be on an exception basis and will not be provided until appropriate security measure have been implemented and verified.

Addressing Security When Dealing with Members of the Public

Publicly available information interfaces may introduce significant risks if not correctly controlled and secured. This can arise both from potentially unauthorized access to information, availability of information not intended for public release or the ability to maliciously amend data content (hacking). Any systems or portals permitting access to the organization infrastructure which are made available to the public will be the subject of specific security scrutiny including penetration testing where deemed necessary. Examples would be the AWS Marketplace.