STATEM ENT OFCONTINUITY
Security and Business Continuity Overview
July 2023 | Version 7.5

1 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

TABLE OF CONTENTS

GENERAL NOTICE

41.

GOVERNANCE, RISK AND COMPLI ANCE

62.

DEFENCE-I N-DEPTH APPROACH

7

2.1
Data Protection
2.1.1 Data Classif ication
2.1.2 At rest
2.1.3 In transit
2.1.4 Encryption
2.1.5 Inf ormation access2.1.6 Client access2.1.7 Remote access2.1.8 Mobile and teleworking
2.1.9 Authentication
2.2
Application Security
2.3
System Security
2.3.1 Change management
2.3.2 Patch management
2.3.3 System Hardening
2.4
E-Mail Security
2.5
Anti-virus and Malware Protection
2.6
Network Security
2.7
Physical Security

7
8
8
8
8
8
9
9
9
9
9
9
10
10
10
10
10
10
10

3.

AWARE NESS

12

3.1

Awareness program

12

4.

SECURITY AUDITS

13

4.1
4.2
4.3
4.4

Vulnerability Assessments
Penetration Testing
Security Monitoring
Internal & External Audits

13
13
13
13

5.

HUMAN RESOURCES SECURITY

14

5.1
5.2

Employee Recruitment
Employment Termination

14
14

2 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

6.

BUSI NESS CONTINUITY

15

6.1
6.2
6.3
6.4
6.5

Resilienc e
Backups
Accessibility
Retention
Healt h and Saf ety

15
15
15
15
16

7.

INDUSTRY BENCHMARKS

17

DEFINITIONS AND ABBREVIATIONS18

REFERE NCE TO ASSOCIATE D DOCUMENTS

19

REVISION HISTORY AND RECORDS

20

3 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

GEN ER AL N OTIC E

This document falls under ISMS governance control. The following applies tothis document:•This document is controlled as part of Inf ormation Security department;•

No changes to this document are permitted without f ormal approval f rom the document owner;•

This document is classif ied, version controlled and regularly reviewed;•

Any questions regarding this document should be raised to the Owner;•

Distribution, modif ications and access must be addressed based on TMF Group’s inf ormation
classif ication;•

The version of this document can be f ound on the cover page;•

Revision details are described below;•

This document may be available in various languages; however, the version in the English
language will prevail.

4 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

CLASSIFICATION
PublicSTAKEHOLDERS
Owner

Information Security Department

Reviewer

Chief Security and Resilience Officer (CSRO)

ApproverManagement Board

Sponsor

Chief Operations and Technology Officer

REVIEW
PeriodAnnualLast review

19 July 2023

StatusFinal

Approval on

July 2023

Effective date

31 July 2023

CONTACT POINT
Contact

Global - Information Security

Details

Contact the team via Global-Information.Security@tmf-group.com

5 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

1. G O V E R N A N C E , R I S K A N D C O M P L I A N C E

TMF Group understands the criticality and sensitivity of the services it provides to its clients across theworld. We have a robust security assurance f ramework that combines people, process, and state -of the-art technology, to ensure we are secure and compliant.

Security
Governance

Risk
Management

OPERATIONSPLANNING

GOVERNANCE

Security
Operations

Strategy &Planning

Compliance &Assurance

Vendor Risk
Management

The Executive Committee (ExCo - senior management) of TMF Group is ultimately accountable forInformation Security at TMF Group. The ExCo establishes the Information Security policies, defines
security objectives, and provides strategic directions and steer for all security-related aspects of theorganization.
The Information Security Department, headed by the Chief Security and Resilience Officer (CSRO),
is responsible for the implementation, maintenance, monitoring, and review of the Information Security
Management System (ISMS), based on the ISO 27001 standard.

We follow a risk-based approach to Information Security. External and internal risks are assessed
periodically. The Information Security department prepares plans and processes, to achieve defined
security objectives.
As part of the Technical Design Authority (TDA), the Information Security Team validates the security
architecture for technology initiatives based on information security first design principles.

Security Operations focuses on securing our data and network, maintaining compliance to statutory,
regulatory, and contractual requirements and monitoring risks from third party service provider s.
A state-of-the-art, round the clock Security Operations Centre monitors the TMF Group network, todetect and respond to cyber security incidents. Vulnerabilities in the enterprise technology landscapeis scanned and remediated on an ongoing basis.
A global compliance program, aligned to ISO 27001, monitors, and maintains security compliance of
TMF offices and data centre. An independent assurance and accreditation program acts as the thirdline of defense.

6 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

2. D E F E N C E - I N - D E P T H A P P R O A C H

At the highest level, TMF Group has drawn up a security management f ramework and a number ofpolicies, standards, procedures and guidelines including, but not limited to, a Business Continuity
Management Policy and an Inf ormation Security Policy. TMF Group ’s Inf ormation Security Policy is inline with requirements of ISO27001 standard. These policies, standards, procedures, and guidelines
are made available to all employees through the company’s Intranet. A mandatory Group Security
Awareness program is implemented to address annual training on the policy awareness f or all
employees. All employees are required to complete this upon joining and take a periodic ref resher. All
policies are reviewed at least annually.
Identity &AccessManagement
Antimalware

SystemSecurity
Application
Security

Email
Security

PhysicalSecurity
Network
Security

Data
Protection

TMF Group uses a multi-layered security approach involving data security, application security, systemsecurity, network access controls, monitoring and incident reporting, physical and environmental
security, and service availability controls.

2.1

Data Protection

TMF Group’s data security and protection controls f ocus on employee access to systems that houseclient data, regulatory compliance, and user roles.

7 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

2.1.1 Data Classification
To understand the sensitivity of inf ormation TMF Group has def ined the standard to address the data
into Public, Internal, Conf idential and Restricted category. Improved understanding leads to a higher
awareness of potential risks associated with specif ic inf ormation classes. Consequently, DataClassif ication allows TMF Group to understand risks associated with inf ormation and take appropriate
measures in bringing the risks to an acceptable level.

2.1.2 At rest
‘Data at rest’ is protected through restrictions on the access rights as described in section 2.1.5
Inf ormation access. Data is protected through proper access control and logical segregatio n.

2.1.3 In transit‘Data in transit’ is encrypted over the Internet. Various technologies are described in this document. For
email, this is described in section 2.4. For client access, see section 2.1. 6.

2.1.4 Encryption
Encryption is applied to ensure data conf identiality where deemed required . Data is encrypted at rest
when data is mobile like in the case of laptops, backups that stores client data. It should be noted that
not all data at rest is encrypted but at a minimum data is encrypted at rest when stored on laptops,
backups and removable media that stored client data. It may not be possible to encrypt data-at-rest
due to limitations related to application compatibility or interoperability.

2.1.5 Information access
Access to any inf ormation is granted using the principle of ‘Least Privilege’. Access control mechanisms
are applied to ensure only authorized personnel can have access to the required TMF or TMF’s clientdata.
TMF Group shall not process, transf er, modif y, amend or alter the Personal Data or disclose or permit
the disclosure of the Personal Data to any third party other than:-as necessary to process Personal Data to provide the Services and/or otherwise inaccordance with the documented instructions of Client, or
as required to comply with Data Protection Laws or other laws to which TMF Group is subject,in which case TMF Group shall (to the extent permitted by law) inf orm Client of that legal
requirement bef ore processing the Personal Data.

Inf ormation access shall be consistent with TMF Group’s Personal Data Protection Policy.

8 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

2.1.6 Client access
Bulk f ile transf ers may be needed between TMF Group and its clients. TMF Group of f ers an additional
service to provide secure f ile-sharing through TMF Group ShareFile, a commercial solution using strong
encryption.

2.1.7 Remote access
Remote access requires multi-f actor authentication, usually consisting of user-ID, password, and acertif icate or another f actor like OTP (One Time Password). Remote access is do ne through VPN or
remote desktop technologies.

2.1.8 Mobile and teleworking
All laptops are encrypted with AES 256. Mobile Application Management (MAM) has been implemented
to protect data on mobiles which includes remote wipe capabilities. Multi Factor Authentication (MFA)
is required on mobile devices.

2.1.9

Authentication

Authentication is based on a user-ID/password combination. Passwords must meet complexity
requirements that mandate a minimum number of characters and must contain alphanumeric as well
as special characters. Password change at regular intervals and password history is also enf orced.
TMF Group has a f ormally documented password security standard that is reviewed at least annually.
Administrative accounts f ollow the same password policy as regular accounts but require a password
with higher complexity requirements and the access of administrative accounts are reviewed
periodically.

2.2

Application Security

Periodic vulnerability scans based on OWASP Top 10 vulnerabilities and penetration tests are
conducted and appropriately remediated.

2.3

System Security

TMF Group desktops and servers are secured by hardening, vulnerability assessments and patch
management processes. Security policies based on industry -leading practices are enf orced centrally.
Accesses and audit logs are monitored.

9 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

2.3.1 Change management
TMF Group has constituted a Change Advisory Board (CAB). All technology changes shall be approvedby CAB. A record is maintained f or all changes. CAB includes representation f rom Inf ormation Security
team, to ensure inf ormation security aspects are reviewed bef ore rollout of any c hange. TMF Groupf ollows ITILv3 best practices f or its IT Change Management processes.

2.3.2 Patch management
Security patches are reviewed and tested. Patches are applied to the systems af ter testing and due
approvals as per process. TMF Group has deployed a to ol to push patches to its technology landscape.
Patch management process addresses the requirements f or critical patch rollout as may be needed, asa result of specif ic security advisories.

2.3.3 System Hardening
TMF maintains Hardening standards f or key technologies that are utilised in its technology landscape.

2.4

E-Mail Security

All incoming and outgoing emails are routed through a secure email gateway that provides protection
against malware, spam, phishing & spoof ing. TMF Group has enabled TLS (Transport Layer Security)
on its mail gateway to encrypt email during transit. Forced TLS is available wherever supported byclients.

2.5

Anti-virus and Malware Protection

Endpoints are protected through next-gen endpoint detection and response sof tware, including antimalware capabilities.

2.6

Network Security

TMF Group implements industry best practices in the design and conf iguration of its network and utilises
industry leading network equipment to provide a secure and reliable platf orm.

2.7

Physical Security

strategic data centres or IT secure areas are housed in f ire-proof rooms. The of f ices are equipped withclimate control systems, early warning and detection systems and appropriate extinguishing equipment.
Furthermore, critical areas such as the IT room and main entrances are protected using a proximity
10 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

card-based access control system. CCTV equipment monitors these areas on a 24x7 basis. Of f ices
have Intruder alarms installed or physical guards on duty during of f -hours to detect/prevent
unauthorised access to the premises.

11 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

3. A W A R E N E S S

3.1

Awareness program

TMF Group encourages its employees to keep themselves inf ormed through the Organisation’s
Intranet. All employees are expected to go through an annual Security Awareness Training program.
Special notif ications by email and through the Intranet ensure that all employees are made aware ofchanges in security and high-risk situations. Employees are guided through the TMF Group Code of
Conduct, Employee Handbooks, onboarding process and Mandatory Trainings Programmes at the
beginning of their employment.

12 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

4. S E C U R I T Y A U D I T S

4.1

Vulnerability Assessments

TMF Group perf orms quarterly internal vulnerability scans . The results of the scans are aggregated into
an internal report. Actions and justif ications of the potential vulnerabilities are recorded, and remediation
is done based upon the criticality.

4.2

Penetration Testing

Annual penetration tests on critical assets are conducted by an independent third party.

4.3

Security Monitoring

TMF Group has a round the clock monitoring service that collect and analyses the event logs f rom TMF
Group’s IT environment. TMF Group has deployed state of the art tools f or security monitoring. Incidents
identif ied by the Global Security Operations Centre (GSOC) are addressed per d ef ined Security IncidentManagement Procedure.

4.4

Internal & External Audits

Internal and external audits are conducted at least annually covering Inf ormation Security based on ISO
27001 standard.

13 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

5. H U M A N R E S O U R C E S S E C U R I T Y

People are of ten the weakest link in the security chain. Here is an overview of the measures taken at
TMF Group to keep the workf orce committed to security.
Prospective employees are screened prior to their employment, by conducting
antecedence checks and referral checks to the extent permitted by law in each country.

Employees and contractors are provided with an Information Security awarenessbriefing at the time of onboarding.

Information Security awareness trainings are aligned to our values. Periodic training isprovided to staff on behavioral aspects of Security such as information classificationand handling, clear-desk and clear-screen policy, password security, secure email andinternet etiquette, malware and phishing attacks, social engineering, security incident
reporting etc.

To sustain the awareness and behavior levels of staff, periodic awareness campaigns
and roadshows are conducted.

5.1

Employee Recruitment

TMF Group is committed to hiring and attracting top talent to the organisation and is expecting
employees to adhere to high standards of conduct and behaviour. All TMF Group colleagues need tocomplete a background check as part of the new hire onboarding process. Employees may also be
asked to complete f urther checks as and when required. All background checks will be carried out inaccordance with local law and legislation.

5.2

Employment Termination

When employees leave the organisation, all previously granted access rights are promptly and properly
revoked, ensuring access to the business inf ormation is saf eguarded.

14 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

6. B U S I N E S S C O N T I N U I T Y

Business Continuity f eatures in TMF Group’s top priorities. The Management Board and Supervisory
Board support the need f or robust Business Continuity measures f or the benef it of employees,
stakeholders, and customers. As most inf ormation within TMF Group is processed digitally, the f ocusof the continuity measures lies in that area.

6.1

Resilience

TMF Group uses various geographically spread commercial data centres where all critical applications
are hosted. All connectivity between the data centres is redundant to ensure near 100% uptime.
All critical network components are internally redundant (dual power supplies, dual network interf aces,etc.). Critical equipment is attached to UPS’s that are regularly tested and ref reshed.

6.2

Backups

TMF Group makes daily backups of all its data. Daily backups are retained f or f our weeks. Monthly andyearly backups are in place. Yearly backups are retained f or a maximum period as legally permitted in
the local legislation. To ensure that backups are available at all times, backup tapes are encrypted andstored at certif ied, prof essional storage companies, specialising in tape storage (wherever possible).

6.3

Accessibility

TMF Group utilises a robust and secure network solution f or providing connectivity. This solution allows
of f ices to communicate with each other and, where necessary and authorised. For continuity purposes
this solution of f ers TMF Group the opportunity to service its clients f rom any other location in the world.
In addition, the organisation has a secure remote access solution. This remote access solution allows
employees to access their work environment f rom virtually any location in the world. The environmentis encrypted and access is based on a multi-f actor authentication.

6.4

Retention

TMF Group has the obligation to have data available, in accordance with local legal requirements. In
majority of cases, this obligation remains even af ter the service to a client has ended. TMF Group
ensures that all data is retained as long as it is legally required by the local legislation.

15 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

6.5

Health and Safety

As corporate responsibility is a key value of the TMF Group, the organisation cares f or the welf are,health and saf ety of its employees, clients and visitors within its of fices.
Managing Health and Saf ety is also considered as an integral part of the risk management of TMF
Group. For these reasons, Health and Saf ety are key priorities f or the organisation.

16 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

7. I N D U S T R Y B E N C H M A R K S

We constantly benchmark ourselves with the industry leading processes.

ISO 27001
C E R T I F I C AT I O N

ISAE 3402
SOC1 TYPE 2
AUDITSBITSIGHT
SECURITYR AT I N G

All our offices are aligned to thestandard, with almost all officescertified against the Standard.

TMF Group has in place an ISAE
3402 SOC 1 Type 2 audit
programme in most of the offices, toensure independent validation of our
key IT controls and processes and tohelp clients meet regulatory andcompliance requirements.

BitSight Security Rating is anindependent benchmark of anorganisation’s
cyber
security
performance, assessing externalfacing interfaces and its security
performance.
TMF Group uses BitSight rating tobenchmark its Cyber Security
posture in line with the Industry.

17 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

D EFIN ITION S AN D ABBR EVIATION S

TERMDEFINITION

CAB

Change Advisory Board

CSRO

Chief Security and Resilience Officer

ExCo

Executive Committee

GSOC

Global Security Operations Centre

HR

Human Resources

ISMS

Information Security Management System

KPI(s)Key Performance Indicator(s)MAM

Mobile Application Management

MFA

Multi-factor Authentication

OTP

One-time Password

TDA

Technical Design Authority

TLS

Transport Layer Security

18 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

R EFER EN C E TO ASSOC IATED D OC U MEN TS

RELATED POLICIESInformation Security policy
Business Continuity Policy
Establishment of ISMSAll ISMS documentation
Code of Conduct
TMF Group Policy Library

19 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5

R EVISION H ISTOR Y AN D R EC OR D S

VERSIONDATE

AUTHORDETAILS

112-Aug-2010

Michiel Benda

Initiation of document230-Nov-2010

Michiel Benda

Additional

330-Aug-2011

Michiel Benda

Additional

417-Mar-2013

Michiel Benda

Version based on merger

4.1

21-Feb-2014

Michiel Benda

Minor rewording, no new version applied.

505-Mar-2015

Michiel Benda

Update to reflect improvement in IT security and ISO
compliance

620-Jun-2017

David Holman

Review post-restructure

6.1

22-Jun-2017

Mark Belgrove

Minor changes
requirements

6.2

19-Jul-2017

Mark Belgrove

Added risk to organisation structure

6.3

07-Sep-2018

Devender Kumar

Organisation structure updatedtopassword

length/complexity

9.3 Internal & External Audits included
7.0

13-Sep-2019

Devender Kumar

Document structure and graphics revised; no materialchanges

7.1

19-Jul-2020

Nitin Dhande

Added section 2.1.1, 2.1.10 and 2.3.3

7.2

09-Dec-2021

Anuj Tewari

Reviewed with RSO’s, and CSRO, made amendments
in 2.1.4, 2.3.3, 5.1, 6.4 and minor changes.

7.3

01-Jul-2022

Anuj Tewari

Annual review with minor changes on 2.1.4; 2.1.5 2.1.9
and 4.4, 6.3

7.4

27-Apr-2023

Group Risk & Compliance

Minor changes that reflect the new setup of TMF’s twotier board

7.5

19-Jul-2023

Anuj Tewari, Rohit Rajput &Alvaro Guerrero

Annual review; minor updates and rephrasing

20 Statement of Continuity
Security and Business Continuity Overview| July 2023 | Version 7.5