Statement of Policy

Tekai is committed to conducting business in compliance with all applicable laws, regulations, and company policies. Tekai has adopted this policy to outline the security measures required to protect electronic information systems and related equipment from unauthorized use.

Objective

This policy and associated guidance establish the roles and responsibilities within Tekai, which is critical for effective communication of information security policies and standards. Roles are required within the organization to provide clearly defined responsibilities and an understanding of how the protection of information is to be accomplished. Their purpose is to clarify, coordinate activity, and actions necessary to disseminate security policy, standards, and implementation.

Applicability

This policy is applicable to all Tekai infrastructure, network segments, systems, and employees and contractors who provide security and IT functions.

Audience

The audience for this policy includes all Tekai employees and contractors who are involved with the Information Security Program. Awareness of this policy applies for all other agents of Tekai with access to Tekai information and infrastructure. This includes, but is not limited to partners, affiliates, contractors, temporary employees, trainees, guests, and volunteers. The titles will be referred collectively hereafter as "Tekai community".

Roles and Responsibilities

Roles	Responsibilities
Board of Directors	Oversight of Cyber-Risk and internal control for information security, privacy and complianceConsults with Executive Leadership to understand Tekai IT mission and risks and provides guidance to align business, IT, and security objectives

Executive Leadership	Approves Capital Expenditures for Information Security and Privacy programs and initiativesOversight over the execution of the information security and Privacy risk management program and risk treatments Communication Path to Tekai Board of DirectorsAligns Information Security and Privacy Policy and Posture based on Tekai's mission, strategic objectives and risk appetite
ITManager	Oversight over the implementation of information security controls for infrastructure and IT processesResponsible for the design, development, implementation, operation, maintenance and monitoring of IT security controls Ensures IT puts into practice the Information Security Framework Responsible for conducting IT risk assessments, documenting identified threats and maintaining risk registerCommunicates information security risks to executive leadership Reports information security risks annually to Tekai's leadership and gains approvals to bring risks to acceptable levels Coordinates the development and maintenance of information security policies and standardsWorks with applicable executive leadership to establish an information security framework and awareness programServe as liaison to the Board of Directors, Law Enforcement, Internal Audit and General CounselOversight over Identity Management and Access Control processes
Principal Engineer	Oversight over information security in the software development processResponsible for the design, development, implementation, operation, maintenance and monitoring of development and commercial cloud hosting security controlsResponsible for oversight over policy development related to systems and software under their controlResponsible for implementing risk management in the development process aligned with company goals
Compliance Manager	Responsible for compliance with the company's contractual commitmentsResponsible for maintaining compliance with relevant data privacy and information security laws and regulations (e.g. GDPR, CCPA) Responsible for adherence to company adopted information security and data privacy standards and frameworks including SOC 2, ISO 27001 and Microsoft Supplier Data Protection Requirements (DPR)
Lead, CustomerSuccess	Oversight and implementation, operation and monitoring of information security tools and processes in customer production environmentsExecution of customer data retention and deletion processes in accordance with company policy and customer requirements
Systems Owners	Maintain the confidentiality, integrity and availability of the information systems for which they are responsible in compliance with Tekai policies on information security and privacy Approval of technical access and change requests for non-standard access to systems under their control

Tekai Employees, Contractors, temporary workers, etc.	Acting at all times in a manner which does not place at risk the health and safety of themselves, other person in the workplace, and the information and resources they have use ofHelping to identify areas where risk management practices should be adoptedTaking all practical steps to minimize Tekai's exposure to contractual and regulatory liabilityAdhering to company policies and standards of conduct Reporting incidents and observed anomalies or weaknesses
CIO	Ensuring employees and contractors are qualified and competent for their rolesEnsuring appropriate testing and background checks are completed Ensuring that employees and relevant contractors are presented with company policies and the Code of Conduct (CoC)Ensuring that employee performance and adherence the CoC is periodically evaluatedEnsuring that employees receive appropriate security training
COO	Responsible for oversight over third-party risk management process Responsible for review of vendor service contracts

Policy Compliance

The IT Manager will measure the compliance to this policy through various methods, including, but not limited to—reports, internal/external audits, and feedback to the policy owner. Exceptions to the policy must be approved by the IT Manager in advance. Non-compliance will be addressed with management and Human Resources and can result in disciplinary action in accordance with company procedures up to and including termination of employment.

Version	Date	Description	Author	Approved by
1.0	01.03.2025	First Version	Lucas

Page tree

Information Security Roles And Responsibilities