Cybersecurity Policy Manual

1. Purpose

This Cybersecurity Policy establishes the principles, controls, and procedures governing the protection of Ammire Legacy's information systems, data assets, and digital infrastructure.

The objective is to:

• Safeguard customer and institutional data
• Protect AI systems and cloud infrastructure
• Ensure regulatory compliance
• Maintain operational resilience

2. Scope

This policy applies to:

• All employees, contractors, and partners
• AmmirePIX and AMMIRE Legacy Card systems
• Cloud infrastructure
• APIs and integrations
• End-user data and institutional data

3. Security Governance Structure

• Board Oversight: Cyber risk reviewed quarterly
• CEO: Executive accountability
• Data Protection Officer (DPO): Regulatory oversight
• Security Lead (or outsourced provider): Technical enforcement

4. Information Classification

5. Access Control Policy

• Role-Based Access Control (RBAC)
• Least Privilege Principle
• Multi-Factor Authentication (MFA)
• Access reviews conducted quarterly
• Immediate revocation upon termination

6. Encryption Standards

• AES-256 encryption at rest
• TLS 1.2+ encryption in transit
• Encrypted backups
• Secure key management protocols

7. Secure Development Lifecycle (SDLC)

• Code review before deployment
• Dependency vulnerability scanning
• AI model validation testing
• Staging environment testing prior to release
• Regular penetration testing (annual minimum)

8. Incident Response Plan

In the event of a security incident:

1. Detection & containment within 24 hours
2. Internal assessment
3. Regulatory notification within 72 hours (if required)
4. Customer notification (if high risk)
5. Post-incident remediation review

All incidents logged and reviewed by executive leadership.

9. AI Security Controls

• Human-in-the-loop validation
• Bias monitoring in OCR extraction
• Secure training data storage
• Restricted access to training datasets

10. Business Continuity & Disaster Recovery

• Encrypted daily backups
• Cloud redundancy
• Recovery Time Objective (RTO): 24 hours
• Recovery Point Objective (RPO): 12 hours

11. Vendor Security Management

All third-party vendors must:

• Sign data processing agreements
• Demonstrate security certifications or equivalent safeguards
• Undergo risk assessment prior to integration

12. Security Awareness Training

All personnel must complete:

• Annual cybersecurity training
• Phishing awareness training
• Data protection compliance training

13. Policy Review

This policy shall be reviewed annually or following major regulatory or operational changes.