TUFIN TECHNOLOGIESANTI BRIBERY AND CORRUPTIONHANDBOOK("ABC Handbook")

Page 1 of 22

Message from the Chief Executive Officer
Tufin Technologies is committed to conducting its

This Anti-bribery & Corruption Handbook ("ABCbusiness in a fair and ethical way, without using

Handbook") supplements

bribes or corrupt practices to obtain unfair

Handbook applicable to employees employed in theadvantages in our business dealings.

United States ("Employee Handbook") and willtheUS employee

provide employees, and third parties working on
Tufin operates in a global economy in which

our behalf, with the basic knowledge needed tobusiness ethics now play an increasingly important

detect and prevent bribery and corruption issuesrole. Bribery and corruption are unacceptable ways

and guidance on where to seek advice.

of conducting business. Bribes and corrupt
practices are morally not acceptable, as they harm

The ABC Handbook is not designed to be asocieties in which these acts are committed andcomprehensive guide to anti-bribery and corruption

prevent economic growth and development. They

compliance. It is intended to help you to recognise

are also illegal in most countries around the world.

potential bribery and corruption issues, to give you

As an international organisation, we must ensure

guidance on acceptable and unacceptable behaviour

that we operate within the laws of all the countries

and to tell you where to go for further information.

in which we are active. Any Tufin employee, or
person performing services on behalf of Tufin that

The ABC Handbook will be supplemented withengages in bribery or corrupt practices risks severe

anti-bribery and corruption training, which will put

consequences

for

both

and

bribery and corruption risks in the context ofthemselves,

such

as

damage,working for Tufin. It is intended to be practical andthecompany

reputational

prosecution, fines and imprisonment.

helpful to you. If you have any suggestions on how
we can improve it, please contact the company's

The Tufin Board of Directors ("the Board")
considerscompliancewith

anti-bribery

VP of Finance.

&

corruption laws to be not only a legal requirement,

Thank you for your support and commitment.

but a reflection of the company's strong businessethics. The Board is committed to the Tufin Anti-

Ruvi Kitov

bribery & Corruption Policy ("ABC Policy") and

Chief Executive Officer

it will be communicated to all Tufin employees andthird parties working on our behalf. Tufin will
apply a zero tolerance approach to violations of the
ABC Policy. Any breach of the ABC Policy will be
regarded as a serious matter and may result in
disciplinary action, dismissal or termination ofcontract.

Page 2 of 22

Contents

1.

THE TUFIN ANTI-BRIBERY & CORRUPTION POLICY

42.

WHAT DO WE MEAN BY 'BRIBERY' AND 'CORRUPTION'?

63.

WHAT IS THE LAW ON ANTI-BRIBERY AND CORRUPTION?

8

4.

ARE FACILITATION PAYMENTS ALLOWED?

10

5.

GIFTS AND HOSPITALITY

11

6.

DONATIONS AND SPONSORSHIP

13

7.

WORKING WITH GOVERNMENTS AND GOVERNMENT OFFICIALS

14

8.

WORKING WITH THIRD PARTIES

169.

HOW DO WE PREVENT BRIBERY AND CORRUPTION?

18

10.

WHAT TO DO IF YOU HAVE A QUERY OR CONCERN?

20

11.

GLOSSARY OF TERMS

22

Page 3 of 22

THE TUFIN ANTI-BRIBERY & CORRUPTION POLICY

1.

Tufin will not engage in bribery or corruption in any form, whether it involves privatecompanies, public officials or otherwise;2.

Tufin will not directly or indirectly accept, request, agree to receive, promise, offer or give a
bribe or other improper payment, inducement, reward or anything of value; and3.

Tufin will not tolerate employees, distributors, resellers or other third parties who pay or receive
bribes or otherwise violate this policy.

1.1

Our values

Tufin sets high ethical standards which apply to all our business transactions throughout the world and the
behaviours of everyone employed or engaged by us when conducting business on our behalf. This demonstrates
our commitment to maintaining our first class reputation for ethical business behaviour. We are direct, honest,transparent and fair in all our business dealings.
Tufin is committed to conducting its business with quality and integrity. The integrity of our employees,
officers, directors ("Employees") and our resellers, distributors, agents, consultants and services providers("Business Associates") and any other third parties engaged by us to do business on our behalf ("Third
Parties"), is critical to our success and our reputation.
Accordingly, bribery and any other forms of unethical business practices are strictly prohibited. When working
for Tufin, all Employees, Business Associates and Third Parties are required to uphold this commitment by
understanding the requirements of this ABC Policy and the ABC Handbook and by always following Tufin's
standards, instructions and processes. Bribery not only violates our ABC Policy and Code of Ethics, it violates
the law and can have very serious consequences for Tufin, its Employees and its Business Associates.

1.2

Objective

Most countries around the world have laws which prohibit bribery of customers, business associates, local
government officials and foreign government officials. It is important that we protect Tufin, its brand and its
Employees from the risks associated with bribery and corruption.
In addition, tackling bribery and corruption is now a high priority for most countries; for example, the UK has
introduced the Bribery Act 2010 ("Bribery Act"), which allows the prosecution of companies for any act ofBribery committed by persons acting on behalf of the company anywhere in the world, where the company"carries on business in the UK". The US has also steadily increased prosecutions using their Foreign Corrupt
Practices Act 1977 (as amended) ("FCPA"), which has long permitted the prosecution of US persons andPage 4 of 22

companies, publicly-held companies whose securities are registered on a US stock exchange (or anyone acting
on their behalf), or persons who while in the US, commit an act in furtherance of a bribe, for bribery of a foreign
government official for the purpose of obtaining or retaining business. As a result, the number of enforcement
actions globally are increasing and countries are working together to detect and prosecute bribery and corruption
wherever it is committed in the world. Many of the largest global organisations have fallen foul of such laws
and have been penalised with very substantial fines and the imprisonment of certain of their employees.
Tufin therefore prohibits any act of bribery or corruption and applies a "zero tolerance" approach to violations of
the ABC Policy by anyone employed or engaged by Tufin to conduct business on Tufin’s behalf. Any breach,will be treated seriously and may result in disciplinary action, dismissal or termination of contract and may beprosecuted to the fullest extent of the law.
The ABC Policy is based on internationally accepted best practice guidelines and applies in all jurisdictions
where Tufin does business. All Tufin business activities must be conducted in full compliance with the ABC
Policy, the ABC Handbook and all applicable anti-bribery and corruption laws including, but not limited to, theBribery Act and the FCPA.

1.3

Application

The ABC Policy applies to everyone who is employed by, or is engaged to work for and on behalf of Tufin in
whatever capacity. For these purposes, this includes our Employees, Business Associates and Third Parties.
The ABC Policy must be adhered to in all Tufin business dealings and transactions in all countries in which
Tufin, our Employees, Business Associates and Third Parties operate, in transactions with domestic or foreign
government / public officials and transactions with private companies or persons.
All of Tufin's Employees, Business Associates and Third Parties are individually responsible for complying
with this ABC Policy and any breach may lead to disciplinary action, dismissal or termination of contract, andmay be prosecuted to the fullest extent of the law.
This ABC Policy will be communicated to all entities and Employees within Tufin, as well as relevant Business
Associates, Third Parties and entities.

2.

WHAT DO WE MEAN BY 'BRIBERY' AND 'CORRUPTION'?

2.1

Definitions

The terms "bribery" and "corruption" have a range of definitions in law, but there are some universal principles
to bear in mind:
Bribery is the offering, promising, giving, requesting or accepting of a payment, inducement, reward oranything of value for an act or omission which is illegal, unethical or a violation of our internal policies, which
is given with the intention of obtaining or retaining business, or an advantage in the course of business.

Page 5 of 22

(e.g. Tufin is about to submit a quote in response to a tender for software and services from Company A. Prior
to submitting the quote, a manager of Tufin pays, in cash or in kind, a senior manager of Company A for
information about the contract and previous quotes submitted which will allow Tufin to win the contract).
Corruption is the misuse of public office or power for private gain.
(e.g. a public official accepts personal payment, in cash or in kind, to grant Tufin a service contract with agovernment department although Tufin's credentials do not meet the required standards for the issue of thecontract.)

2.2

BribesFor the purposes of our ABC Policy, Tufin prohibits all forms of bribery and makes no distinction between
whether they are being made to persons in the public or private sectors, and whether or not they are consideredillegal in the relevant jurisdiction in which business is transacted.
Bribes take on many different shapes and forms and do not necessarily involve payments of cash. A bribe could
be anything of value, for example:


Kickbacks - where a percentage from the contract or other financial award is improperly returned to theperson awarding that contract or benefit, e.g. Tufin wins a new contract by promising to pay a customer's
representative a cash payment.



Ffacilitation payments or "grease" payments - usually small, non-discretionary payments to government/ public officials, to speed up routine administrative processes, e.g. giving a government official boxes ofcigarettes to grant visa applications for Tufin's employees ahead of others;

Inflated commissions - where higher than normal commissions are paid as a reward for improper
behaviour, e.g. a reseller paying a bribe (in the form of additional commission) to a Tufin sales employee toencourage them to pass more business through them, rather than to other resellers in the region;

Political or charitable donations - can be used as bribes, e.g. making a donation to a political party tosupport legislation that is favourable to Tufin's business or using charitable donations to a charity headed bya foreign government official to induce the official to direct business to Tufin;

Excessive or inappropriate entertainment - can be used to influence business contacts, e.g. giving a
director of a customer company and his/her family an expensive holiday and valuable theatre tickets before
he/she makes a decision whether to acquire new or additional products or services for his/her company from
Tufin; or

Expensive gifts - can be given to influence the recipient, e.g. Tufin employees giving an expensive iPad toresellers so that they promote Tufin's products and/or services ahead of other competitor’s products and/or
services.

If you have any concerns about whether an act might constitute bribery or corruption, in the first instance andprior to any action taken, speak (preferably face to face) to your immediate supervisor or manager.
Page 6 of 22

If your concerns relate to your immediate supervisor or manager, raise your concerns with the Vice President
responsible for your department as soon as possible.
If your concerns relate to the Vice President of Finance, telephone + 972-3-948-6404.
A glossary of terms commonly associated with bribery & corruption is included in Section 11.

3.

WHAT IS THE LAW ON ANTI-BRIBERY AND CORRUPTION?

3.1

BackgroundAn increasing number of countries are adopting laws to punish bribery and corruption, even when it iscommitted outside their own borders. The USA and the UK have such laws; for example, it is an offence in the
US to bribe a foreign government official. As Tufin is an international organisation with offices and business in
the US, UK and other countries around the world, it is governed by these laws in addition to any local antibribery and corruption laws.
Bribery and corruption are criminal offences in most countries in which Tufin operates, and penalties can besevere for individuals (imprisonment or fines) and could cause incalculable damage to Tufin's brand andreputation (substantial fines, debarment from tendering for US government or EU contracts). It is therefore
important you understand how bribery and corruption might be committed.

3.2

Key Points

The following are some of the key points to remember about anti-bribery and corruption laws that apply to
Tufin:
It is an offence for companies or individuals to directly or indirectly bribe another person, receive a
bribe or bribe a foreign government official.
(e.g. making cash payments to a competitor in order for them to drop out of a tender process could beconsidered a bribe.)To "indirectly bribe another person" involves offering or giving something of value to a third party
acting on your behalf, knowing or intending, that the third party will go on to bribe another.
(e.g. Tufin grants a distributor an increased discount on the cost of Tufin products knowing that they will
use the additional funds to bribe government officials to speed up the customs clearance of Tufin's products
being imported into a new jurisdiction.)

It is unlawful to offer a bribe, regardless of whether the offer is accepted or a benefit gained.
(e.g. offering a meal to a government official, which is refused, intending to persuade them to award acontract.)

Under the UK Bribery Act, in certain circumstances, a company could be prosecuted for failing toprevent its employees, Business Associates, Service Providers or any third party acting on the
Page 7 of 22

company's behalf, from paying bribes to obtain or retain business for the company, or a businessadvantage for the company.
(e.g. Tufin could be prosecuted if a distributor acting for Tufin in Angola were to pay a bribe to acustomer's representative to encourage them to buy Tufin products, even if Tufin did not know that the
distributor was going to make such a payment, and even if bribes may not be considered illegal in Angola).
Some countries have laws (e.g. the US FCPA) which grant prosecutors authority to prosecute bribery
and corruption offences whether the offence occurs within or outside their borders.
(e.g. any Tufin senior management in Israel could be prosecuted if they know and allow their sales
employees in India to pay bribes, whether or not bribes are considered illegal in India.)

3.3

Why should this matter to you?

If you fail to follow the ABC Policy and ABC Handbook, you put yourself, your colleagues and Tufin at risk,
and your act or omission may result in disciplinary action, dismissal or termination of contract, and may beprosecuted to the fullest extent of the law. In addition, you and Tufin could be committing a serious criminal orcivil offence, which may result in a large fine for Tufin and imprisonment or a fine for you and anyone else
involved.
3.4

Why do these laws matter to Tufin?

Compliance is also a key concern to many of our customers, Business Associates and Third Parties we engage
with, which expect Tufin to comply with internationally accepted standards of behaviour. These requirements
are motivated by the customers', Business Associates' or Third Parties' own legal obligations, by their own codeof ethics and for reasons of good governance. Failure to comply may therefore result in the termination of acontract, loss of business to Tufin and possibly claims for loss and damage by our contractual counterparties.
Compliance and good governance will additionally help Tufin retain business. It is therefore in your interests, aswell as Tufin's, that you are aware of the legal risks and do not directly or indirectly engage in any acts ofbribery or corruption.
The ABC Handbook is designed to help you to understand your obligations and to comply with the spirit and theletter of the law. It contains general advice on sound ethical business practice supported by more detailed
sections dealing with identified areas of high risk business activity.
Each section is structured as follows:

Rules - are compulsory obligations and set out what you can and cannot do. Failure to apply the rules
is automatically a breach of the ABC Policy.

Guidance - is given to help you interpret the rules and apply them effectively in your business dealings(guidance however, does not replace careful and minded consideration in conducting business, whichshould be applied at all times).
Page 8 of 22

4.

ARE FACILITATION PAYMENTS ALLOWED?

4.1

Rules



Those employed or engaged by Tufin must never directly or indirectly offer, promise or give a
facilitation payment to a government official for any reason or in any form.



At Tufin, there is no distinction between a bribe and a facilitation payment. Both are prohibited by
Tufin Employees, Business Associates and Third Parties acting on Tufin's behalf and are in breach of
the ABC Policy. Although certain laws, such as the FCPA, permit facilitation payments in very
limited circumstances, the majority of anti-bribery and corruption laws do not distinguish between
bribes and facilitation payments. As such, Tufin prohibits Employees, Business Associates and Third
Parties from making facilitation payments, which are in violation of the ABC Policy.

4.2

Guidance

A facilitation payment is an unofficial payment (in cash or in kind), to a government official, which isdemanded, offered or paid to enable or speed up a routine government process which the government official isalready duty bound to perform, e.g. processing papers, issuing planning permissions or customs clearance.
Facilitation payments are not intended to influence the outcome of the official's actions, only the timing. If sucha payment were intended to influence his actions, it would be considered a bribe.
Do not offer to make or pay a facilitation payment or attempt to use Business Associates or Third Parties tooffer or pay facilitation payments indirectly on behalf of Tufin.
Not only will we ensure that employees do not pay facilitation payments, we will also seek to ensure that
Business Associates or Third Parties do not make facilitation payments on our behalf; for example, by providingthem with a copy of the ABC Policy and/or including anti-bribery and corruption terms in our contracts withthem.
Practical Example:
Tufin is trying to import some essential parts for research and development laboratory testing equipment. The
paperwork was accurate, complete and filed on time but the parts have not cleared through customs because of adelay at the relevant government office processing the importation documents. One of Tufin's managers isanxious to obtain the clearance as it is slowing down services being delivered to a major customer. The Tufin
manager offers the relevant government office money or another form of benefit to speed up the processing of
the importation documents.
This would be a breach of the ABC Policy. A facilitation payment has been made to a government official to
speed up a routine governmental action.

Page 9 of 22

5.

GIFTS AND HOSPITALITY

5.1

Rules



Tufin employees, Business Associates and Third Parties acting on behalf of Tufin must never use gifts
or hospitality to improperly or illegally influence the business decision-making process or cause
others (including government officials in any country) to perceive an improper influence. The use ofgifts or hospitality in this manner constitutes an improper payment for purposes of the ABC Policy.



Always follow your Local Gifts & Hospitality Procedure when giving or accepting a gift or
hospitality. This will explain what is prohibited and permitted and whether you need permission to
give or accept gifts or hospitality.

5.2

Guidance

Tufin has a clear position which forbids the giving and receiving of gifts or hospitality (including entertainmentand sporting events) for improper purposes. We must ensure that the circumstances in which gifts andhospitality are offered, given or accepted are restricted to those which are appropriate and compliant with local
laws and the Local Gifts & Hospitality Procedure.
When deciding whether to offer, promise, give, or receive gifts or hospitality, consider the underlying purpose.
If the purpose is to gain an improper business advantage, it is probably illegal. As a general rule, you should notgive or receive gifts or hospitality you would feel uncomfortable explaining to your work colleagues, yourfamily or the media. In such cases, you must not try to hide gifts and hospitality by giving or receiving themthrough a third party intermediary. If you are in doubt, you should refuse to make or receive the gift or
hospitality.
The occasional acceptance or offer of modest gifts and hospitality without any expectation to obtain an improper
business advantage may be a legitimate contribution to good business relationships. It is also understood that
there may be times when refusing to accept gifts or hospitality from a business associate or declining to provide
them would be considered impolite, e.g. where it is local custom. Notwithstanding this, you must comply with
the ABC Policy and Local Gifts & Hospitality Procedure. If you have any doubts about the propriety ofaccepting a gift or hospitality, do not be embarrassed to decline the offer by referring to the ABC Policy andreport this to your manager or supervisor. This will usually be accepted and understood by the party who offered
the gift or hospitality, who in most cases will be subject to similar rules.
You should exercise special caution when providing gifts or hospitality to prospective customers, re-sellers,
distributors or their representatives, particularly where these individuals have discretion or influence overpassing business or awarding contracts with Tufin.
You should consider the following questions before accepting or offering a gift or hospitality event:

Could my acceptance or offer lead to an obligation for Tufin or imply an obligation?

Is this gift or hospitality event a 'reward' for the award or retention of business or other businessadvantage?
Page 10 of 22

Does this gift or hospitality event seem to be excessive or expensive in any way?



Am I likely to breach any applicable laws, or rules of ethics?



Are there any potential adverse reputational implications in the type of gift or hospitality being
accepted or given? Would my colleagues be unhappy to see Tufin reported in the press in connection
with this gift or hospitality event?

If the answer to any of these questions is yes, the gift or hospitality should not be offered or accepted.
These are some examples of gifts and hospitality which you should not give or accept, as they could beconsidered bribes or part of a corrupt transaction:
cash or cash equivalents;

gifts or hospitality which you know or suspect to be improper or illegal;services or favours provided personally, rather than in a business context, unless such services are
pursuant to a proper arms' length business transaction;loans;

travel and/or accommodation costs for family members, friends or relatives;



events or meals where you are not present; orgifts or hospitality during periods when important decisions, regarding the award or retention ofbusiness, are being made.

Practical Example:
Tufin is competing with another company to supply products and services to a significant potential customer.
The Tufin employee negotiating with the potential customer arranges for the customer and his wife to fly to
London for a luxury weekend break. Tufin did not subsequently win the contract.
This would be a breach of the ABC Policy. Although Tufin did not win the contract, hospitality was used in an
attempt to improperly influence the decision-making process.

6.

DONATIONS AND SPONSORSHIP

6.1

Rules



Tufin prohibits its Employees, Business Associates and Third Parties from making donations topolitical parties or individual politicians on its behalf.

Tufin will only provide charitable or educational donations and sponsorships if they are ethical andlegal according to local written laws, and not intended to influence government officials in any
country.

Page 11 of 22All Tufin donations and sponsorships must be approved in writing by the company's Chief Financial
Officer / or by the Vice President of Finance in advance.

6.2

Guidance

As bribes can be concealed in the form of charitable, political or educational donations or sponsorships, you
should not agree to make such donations or sponsorships when conducting business on behalf of Tufin.
If charitable or educational donations are to be made, they must be given to the charitable organisation or
educational establishment on behalf of a particular student, and not to an individual or directly to the student
concerned. This is because there have been cases where the school fees of the children of government officials
have been paid as part of a corrupt deal. Prior to making charitable donations, research should be to ensure thatthe charitable organisation is registered as a certified charitable entity under the local country's laws orotherwise a legitimate charitable entity. Background checks and due diligence must also be undertaken on the
charity itself and on its managers and representatives.
Although no Tufin asset or resource should be used for political donations or purposes, we do recognise theright of Employees, Business Associates and Third Parties acting on our behalf, to participate as individuals in
the political process and make political donations. This is permitted, subject to making it entirely clear that yourdonation is personal in nature and not made as a representative of Tufin, and that your views and actions are
your own. In addition, individuals are asked to ensure any contributions of money or services are made inaccordance with applicable law, and consideration is given to potential conflicts of interest in their professional
capacity and their personal affiliations to political parties, charities or sponsorship beneficiaries.

Practical Example:
Tufin is approached to provide security software to a government agency. A senior Tufin manager has dinnerwith the government employee in charge of deciding whether to use Tufin as its service provider. During thedinner, the government employee indicates that the business may be more likely to come Tufin's way if adonation is given to the charity that his wife works for. As a result, the senior Tufin manager arranges for a
substantial payment to the charity in question, and Tufin is awarded the contract.
This would be a breach of the ABC Policy. A donation to charity was given as a bribe in order to obtainbusiness for Tufin.

7.

WORKING WITH GOVERNMENTS AND GOVERNMENT OFFICIALS

7.1

Rules



Whenever Tufin conducts business or otherwise engages with any national or local governments,
government agencies, government or other public officials or public international agencies, our
Employees, Business Associates and Third Parties engaged to conduct business on our behalf must
apply the highest ethical standards and comply with all applicable laws.
Page 12 of 22



Improper or secret payments or transfers of any value (including 'facilitation payments') made togovernment officials are prohibited.



Improper payments or transfers of items of value made through intermediaries, or to a third party,
while knowing that all or a portion of the payment will go directly or indirectly to a government
official are prohibited.



No one acting on behalf of Tufin should exert, or attempt to exert, any improper or illegal influence
on government officials.



If asked to provide information in connection with a government or regulatory agency enquiry, youmust always seek advice before responding and then ensure that all information provided is truthful
and accurate.

7.2

Guidance

You should take extra care when dealing with government officials. It is against our ABC Policy to bribe any
government official anywhere in the world, whether or not such activities are considered illegal under thelegislation in any country in which business is transacted. Most countries in the world have made it an offence
to bribe their own government officials; many have also made it an offence to bribe a foreign government
official.
A “government official” for this purpose is defined as:an officer or employee of a government, any governmental and/or municipal/local authority (e.g. civil
servants, local government and the armed forces);an officer or employee of a “public international organisation” or any person acting in an official
capacity for or on behalf of such public international organisation (e.g. the United Nations, the World
Bank, the European Commission)an employee of a company or other business entity in which a governmental body has an ownershipinterest and/or over which such governmental body may, directly or indirectly, exercise a dominant
influence (e.g. state owned commercial enterprises);a political party or a member of a political party or a candidate for political office; and

any person known or suspected to be a close family member or associate of any of the above, orcompanies who are controlled by close family members or associates of any of the above.

It is therefore important that you comply with the ABC Policy, ABC Handbook and your Local Gifts &Hospitality Procedure when dealing with government officials. You should be aware that using Business
Associates or Third Parties to do anything indirectly on behalf of Tufin, which you would not be permitted to do
yourself, would still breach the ABC Policy; for example, asking one of Tufin's resellers to pay a bribe to agovernment official on behalf of Tufin.

Page 13 of 22

Practical Example:
An agent has been engaged by Tufin to assist in clearing products being imported by Tufin through a customs
office. The agent has been told that the application will be delayed in the customs office because there is a
mistake on the paperwork. When the customs officer becomes aware of the importance of the items clearing
through his department, he tells the agent that he will overlook the mistakes on the paperwork if he is given acash payment. The agent advises Tufin of the position, and he is given a sum of cash which he uses to pay off
the customs officer to clear the items.
This would be a breach of the ABC Policy by the agent and Tufin. A Third Party has been used by Tufin to makean improper payment to a government official to influence his actions and cause him to act improperly for the
benefit of Tufin.

8.

WORKING WITH THIRD PARTIES

8.1

Rules



Tufin expects Business Associates and Third Parties to adopt a "no bribes" policy which correspondswith internationally accepted best practice guidelines, and for applicable Business Associates andThird Parties to comply with the ABC Policy when conducting business on Tufin's behalf in any
capacity.



Tufin forbids Business Associates and Employees from using Third Parties to undertake any activity
which they are prohibited from engaging under the ABC Policy and ABC Handbook.

Prior to engaging Business Associates and Third Parties to act on Tufin's behalf, due diligence mustbe performed on them to assess the bribery and corruption risk of working with them. Where a risk
is reasonably identified or suspected, you must seek advice (with the company’s officers referenced
above) before proceeding with the engagement.

Business Associates and Third Parties should be supervised and monitored to ensure they arecomplying with the ABC Policy. Where breaches are identified, immediate remedial action must be
taken. This may require prompt termination of the relevant contract.



No payments should be made through or to a Business Associates or Third Party if you know orsuspect that all or part of the payment will be used for a purpose which violates the ABC Policy.



Do not allow Business Associates or Third Parties to represent Tufin in high risk situations without
proper supervision, e.g. in dealings with government officials.

8.2

Guidance

You should exercise caution when dealing with Business Associates and Third Parties, especially when they are
helping you to market or promote Tufin's business, obtain or retain business, or engaging with governments orPage 14 of 22

government officials. As an example, if the Business Associate or Third Party were to pay a bribe to obtainbusiness for themselves which subsequently benefitted Tufin, Tufin could be vulnerable to prosecution for
failing to prevent bribery by persons acting on its behalf, regardless of where in the world the bribe took place.
When undertaking due diligence on Business Associates and Third Parties prior to engagement, you must
establish whether they:

have any record or a reputation for corruption, including whether they are being investigated orprosecuted for any corruption-related offence, or have been convicted / sanctioned;

have a reputation for corruption;

have been disbarred from practice, if the third party is a lawyer or other professional; orare related or closely connected to a government official who will be involved with, or can influence
the process for which, the third party has been engaged.

When engaging a Business Associate or Third Party to act on behalf of Tufin, the following principles should beapplied:

compliance with the ABC Policy should be made a condition of the contract of engagement;

payments must be reasonable and accurately reflect the value of the services to be provided by theBusiness Associate or Third Party;

the Business Associate or Third Party should have a proven track record in the business discipline andgeographical location concerned;

we should know whether the Business Associate or Third Party has any connections to government or
government officials;

the services to be rendered by the Business Associate or Third Party must be legitimate, and the natureof the services, as well as the price, must be accurately described in a written contract;

the written contract must contain provisions such as covenants and undertakings from the Business
Associate or Third Party that it will not engage in bribery or corrupt activity; payment restrictions;termination rights; and covenants that the Business Associate or Third Par ty will indemnify Tufin frombreaches of applicable anti-bribery and corruption laws if allowed by such laws; andpayments should not be made to unnamed accounts or offshore locations unconnected with theBusiness Associate or Third Party or the country where the work is carried out, unless there are
genuine and legitimate business reasons for doing so.

Practical Example:
Tufin wants to secure a contract to sell its software to the Ministry of Defence ("MoD") in a new jurisdiction.
Tufin engages an agent to make an introduction to the procurement officer in the MoD currently contemplating
Page 15 of 22

to whom to award a contract. Tufin is aware that the agent has a reputation for paying bribes and running his
business in an unethical way, and the agent is selected because he is a close family member of the MoD
procurement officer.
This would be a breach of the ABC Policy. Due diligence checks would have revealed that this agent was a highbribery and corruption risk and could expose Tufin to risk of prosecution if the agent were to pay a bribe toobtain the licence for Tufin.

9.

HOW DO WE PREVENT BRIBERY AND CORRUPTION?

9.1

Good PracticeTufin is committed to international standards of good practice in combating bribery and corruption. This meansthat we will take appropriate steps to ensure that:

We do not directly or indirectly (through third parties or otherwise) offer, promise, give, request or accept abribe or other undue advantage (including gifts and hospitality) in order to improperly obtain or retain
business or any other business advantage.



We do not give in to demands to make improper or illegal payments to government officials, or theemployees of business associates.

We do not engage or remunerate Business Associates or Third Parties that engage in bribery or corruption
on our behalf.



We conduct risk-based due diligence on all Third Parties who will be conducting business on our behalf.

We promote Employee and Third Party awareness of, and compliance with, the ABC Policy throughappropriate communication of the ABC Policy, training programmes and disciplinary procedures.



We only give gifts and provide hospitality which adhere to the Local Gifts and Hospitality Procedure (seeSection 5) and only provide charitable and educational donations and sponsorships that adhere to theprinciples discussed in detail at Section 6.



We ensure that Business Associates and Third Parties acting on our behalf are aware of, and will follow,
our ABC Policy.

9.2

How can you spot bribery & corruption risks?

You should familiarise yourself with the ABC Policy and ABC Handbook. In addition, these are some common
indicators of corruption which you should note, but the list is by no means exhaustive:The request for abnormal cash payments.



Pressure exerted for payments to be made urgently or ahead of schedule.



Requests for payments which do not match the level of services being provided by Business Associatesor Third Parties.
Page 16 of 22

Payments being made through unrelated third parties / offshore countries, e.g. software or services
supplied to a customer based in country 'X' but payment is being received from a different company
based in country 'Y'.

Expensive gifts being given or received.



A colleague who is reluctant to take time off (even if ill) or who insists on dealing with specific Third
Parties him / herself - they may be worried that improper activity or an improper business relationshipwith a Third Party will be uncovered if someone else takes over their workload.



Abuse of the decision-making process or delegated powers in specific cases.

Unexplained preference for certain distributors or re-sellers.



The failure of government officials or customers to follow their own required processes (including
contracting processes) when contracting with Tufin.

Invoices being agreed to in excess of contractual terms without reasonable cause.

Missing documents or records regarding meetings or decisions.

Internal procedures or guidelines not being followed.



Making funds available for high value expenses relating to Business Associates or Third Parties e.g.
charities or school fees.

9.3

Important points to rememberDo remain alert to the risks of bribery and corruption.



Do not engage in any transaction which would lead to a breach of good practice, the ABC Policy or the
ABC Handbook.

Do seek further guidance if you have any queries or concerns related to any of the activities addressed inthis document.



Do seek further guidance immediately if you are being asked to do something which makes you
uncomfortable, seems unusual or which you suspect might be illegal, even if "everyone else is doing it".



Do not attempt to persuade anyone else to do something improper or illegal, even if "everyone else is doingit".



Do not ignore concerns you might have about improper or illegal activity, or otherwise "look the otherway". Report your concerns.

Tip: Whether it is for given or received gifts or acts of hospitality, and even if it is done within the boundaries
set by law, always do the “Newspaper Test”: before acting, ask yourself if this gift or hospitality could bereported in the media, without harming the reputation of Tufin and/ or the recipient.

Page 17 of 22

10.

WHAT TO DO IF YOU HAVE A QUERY OR CONCERN?

It is important that you understand the ABC Policy and the contents of the ABC Handbook. Any breaches ofanti-bribery and corruption laws governing our operations may have severe consequences for you and Tufin.
10.1

QueriesIf you have any queries in relation to the ABC Policy or the ABC Handbook or the applicable laws, pleasecontact:your immediate supervisor or manager;

the Vice President of Finance;

10.2

Breaches

If you suspect, or believe that the ABC Policy or the ABC Handbook has been, or is being breached, you havean obligation to report your concerns to someone who can deal with the situation. You must not ignore yourconcerns. Immediately contact:your immediate supervisor or manager;

the Vice President of FinanceYour concerns will be taken seriously and investigated quickly. Where permitted by local law, your anonymity
will be protected if you wish. You can be absolutely sure that Tufin will not tolerate retaliation directed against
anyone who makes such a report. We will protect anyone who makes a legitimate report. However, anyone who
files a report with the intention of spreading lies or to threaten or damage any Employee's, Business Associate’sor Third Party’s reputation, will be subject, among others to disciplinary action.

10.3

Responsibilities

Everyone is personally responsible for:


their ethical and professional conduct generally and for compliance with the Employee Handbook (ifemployed in the United States), the ABC Policy and the ABC Handbook;obtaining advice and guidance where necessary; andreporting all breaches of the Employee Handbook (if employed in the United States), the ABC Policyor ABC Handbook, and / or any ethical or professional misconduct, whether committed personally orby others.

All Tufin Employees are personally responsible for:

monitoring compliance in respect of all business matters that they are managing or supervising; andPage 18 of 22

monitoring compliance by everyone involved in matters they are managing or supervising (thisincludes Third Parties working for and on behalf of Tufin).

In addition to the above, all Employees must lead by example:
showing commitment to compliance;

remaining alert to bribery and corruption risks; and

promoting awareness and compliance within Tufin and externally with our Business Associates or
Third Parties.

Page 19 of 22

11.

GLOSSARY OF TERMS

Agent

A representative who normally has authority to make commitments on behalf of theprincipal represented. The terms "representative," "consultant" or "intermediary" arealso often used.

Bribery

The offering, promising, giving, requesting or accepting of a payment, inducement or
reward for an act which is illegal, unethical or a breach of duty, which is given with
the intention of obtaining or retaining business, or an advantage in the course ofbusiness.

Business Associate

Any business partner or anyone engaged by us to do business on Tufin's behalf, e.g.
agents, resellers, distributors or consultants

Charitable donation

Any contribution, made in cash or in kind, to support a non-profit organisation, charity
or private foundation.

Corruption

The misuse of entrusted power/breach of duty for personal gain.

Due diligence

An investigation of a company or person prior to signing of a contract in order toevaluate what level of risk is involved in doing business with that company or person.

Facilitation payments

Usually small payments, also known as "grease payments" - non-discretionary
payments made to government or public officials to speed up a routine governmental
action or process, e.g. work permits or customs clearance.

Gift

Goods, services or loans given as a mark of friendship, or appreciation. A gift is
usually given without expectation of consideration or value in return. A gift shouldhave no role in the business process other than that of marking and enhancing relations
or promoting the giver’s enterprise by incorporating a logo or message on apromotional item such as a calendar.

Government official

Primarily an officer or employee of a government (e.g. civil servants, local
government and the armed forces) but also includes;
 an officer or employee of a “public international organisation” or any
person acting in an official capacity for or on behalf of such public
international organisation (e.g. the United Nations, the World Bank, theEuropean Commission); an employee of a company or other business entity in which agovernmental body has an ownership interest and / or over which suchgovernmental body may, directly or indirectly, exercise a dominant
influence (e.g. state owned commercial enterprises); a political party or a member of a political party or a candidate forpolitical office; and any person known or suspected to be a close family member or associateof any of the above, or companies who are controlled by close family
members or associates of any of the above.

Hospitality

Includes entertaining, meals, receptions, tickets to entertainment, social or sporting
events, participation in sporting events. Such activities are usually given or received
Page 20 of 22

to initiate or develop relationships between business people. The distinction between
hospitality and gifts can be blur, especially where the giver of the hospitality does notattend and act as host. Hospitality should not be given or received in order to exert an
improper or illegal influence in the award or retention of business.
Inducements or
rewards

Inducements and rewards can take the form of cash, gifts, favours, loans, fees, rewards
or any financial or other advantage.

Kickback

A form of bribery in which a percentage of the revenues from a contract or otherfinancial award is improperly returned to the person awarding that contract or benefit.

Political donation

Any contribution, made in cash or in kind, to support a political cause. Contributions
in kind can include gifts of property or services, advertising or promotional activities
endorsing a political party, the purchase of tickets to fundraising events andcontributions to research organisations with close associations with a political party.

Sponsorship

Financial or other support for individuals. For example, supporting a visa applicationor paying for schooling or higher education.

Third Parties

For this purpose, includes business associates, contract staff, joint ventures,consultants, agents, representatives, intermediaries, resellers, distributors andcontractors.

Page 21 of 22