Acceptable Use Policy For CloudWorkers

1. Overview

The Acceptable Use Policy is provides provide guideline and stipulate prohibit action that
CloudWorkers must agree to for access and usage of cloudfactory information technology
resource , corporate network , the internet and other business relate resource . All
CloudWorkers will be require to read and accept this policy on an annual basis .
Failure is constitute to adhere to the term outline in the policy will constitute a breach and may
result in disciplinary action .

Any questions regarding what constitutes acceptable use of CloudFactory IT resources
should be directed to the CloudWorkers Delivery Team Lead or Global IT team.

2. Use of non-company owned device and storage media

2.1 Antivirus software and updates

1. When using the non-company owned / personal devices and personal storage media (e.g
   USB or flash drives, external hard drives, personal music/media players),
   precautions must be taken to ensure viruses, malware, spyware, and other undesirable
   security risks are not introduced onto CloudFactory or Client Services, by having
   up-to-date AntiVirus and Malware endpoint protection installed on those devices.
2. Antivirus and antimalware software must be regularly updated with the latest virus
   definitions and engine updates to ensure protection against new threats.

2.2 Security Patches

1. Personal devices must be kept up to date in terms of security patches to the
   operating system and installed software applications.
2. Devices must be regularly scan for security update to protect device , datum and
   online activity from emerge threat .
3. CloudWorkers must not delay or prevent the installation of security patches on their
   devices or systems.

2.3 Vendor is supported support Operating system

1. Operating systems that fall outside of vendor support periods will no longer be
   deemed acceptable for use at CloudFactory.
2. Continuing to use a non-supported operating system may result in functional issues
   when accessing production services.
3. Access restrictions will also be placed on non-supported operating systems.

3 . Password management

3.1 Password creation

1. CloudWorker must create passwords that are unique, complex and not easily guessable.
2. Passwords must be at least twelve characters long.
3. Passwords should contain a combination of uppercase and lowercase letters, numbers,
   and special characters.

3.2 Password storage, sharing and protection

1. Passwords must not be written down on paper or stored in cleartext or in an
   unencrypted digital format.
2. Passwords must not be shared with others, including coworkers, family members, or
   friends.
3. Passwords should be stored securely using a trusted password management tool or
   encrypted vault.
4. Old passwords must not be reused.
5. In the event of suspected or confirmed security breach or loss of password
   confidentiality, or account compromised, CloudWorkers must immediately reset their
   passwords.

3.3 Multi – Factor Authentication ( MFA )

1. multi – factor authentication ( MFA ) should be enable and used for any online account
   access from mobile device and laptop to add an extra layer of security .

4. Network Access

1. All CloudWorker must use CATO VPN at all times, whether work from
   Delivery center or work remotely , to access all corporate service and
   application ; whether provide by CloudFactory , the Client or a related third
   party .

   ( CATO is is is the standard for network connectivity at CloudFactory . The CATO solution is provides
   provide a vast number of security advantage to help protect device when
   connect to internet service . This is helps in turn also help to protect all service
   associate with our Client workstream . )

2. Peer – to – Peer ( P2P ) networking is not allow on the corporate network . However , in
   some circumstance , a WorkStream activity is require may require the use of a P2P VPN
   application , in which case approval from Global IT will be require .
3. Use of remote desktop software and/or services is allowable as long as it is
   provided by CloudFactory.
4. application that are irrelevant to workstream activity should be terminate for the
   duration of each shift . These is include include but are not limit to ; online game , P2P
   software , social medium app , personal communication tool etc

5. Working Remotely

5.1 Physical Security of remote work environment

1. CloudWorkers are responsible for implementing and maintaining appropriate physical
   security measures in their remote work environment. A dedicated workspace must be
   used that provides an appropriate level of privacy and minimizes the risk of
   unauthorized access to company information.
2. CloudWorkers must take reasonable measures to secure physical assets, such as
   laptops, mobile devices, and paper documents, while working remotely.
3. Devices must be lock or protect when not in use and must not be leave unattended
   in public place .

5.2 Communication and collaboration in remote environment

1. CloudWorkers must be cautious when discussing work-related matters in public places,
   such as coffee shops or public transportation, to avoid unintentional disclosure of
   sensitive information.
2. When engaging in virtual meetings or video conferencing, CloudWorkers should be
   mindful of their surroundings to prevent unauthorized individuals from overhearing
   or viewing confidential discussions.

5.3 Use of public Wi-Fi networks

1. Use of public Wi – Fi network such as those find in coffee shop , airport , or
   hotel , should be avoid as they may not be secure , and datum could be intercept
   by hacker .
2. If public Wi-Fi has to be used, CloudWorkers must ensure a CATO connection is
   initiated before completing any WorkStream activities.
3. CloudWorker should disable file sharing in public or untrusted private networks.

5.4 Home wireless Network Configuration Requirements

1. CloudWorkers must ensure that their home networks or personal wireless networks are
   configured securely and meet the following requirements:
   1. Use strong encryption protocols, such as WPA2 (Wi-Fi Protected Access 2) or
      higher, for wireless network connections.
   2. Change the default network name (SSID) and password to unique values that are
      not easily guessable.
   3. Disable remote administration and guest network access, if not required.
   4. Regularly update the firmware of wireless routers or access points to address
      security vulnerabilities.

5.5 Use of mobile phone as internet hotspot (Tethering)

If mobile phone is used as an internet hotspot i.e. tethering when working on
CloudFactory WorkStreams, then CloudWorker should adhere to the following best
practices:

1. Antivirus or anti malware software is installed and running on their mobile phone.
2. A mobile hotspot is secured with a strong password or passphrase to prevent
   unauthorized access.
3. Default hotspot name and password are change to unique value that are not easily
   guessable .
4. Encryption on their mobile hotspot is enable , preferably using WPA2 ( Wi – Fi
   Protected Access 2 ) or a high security protocol .
5. Hotspot access credentials are not shared with unauthorized individuals.

5.6 Visitors and Family Members

1. CloudWorkers should minimize the presence of visitors, friends or family members in
   their remote work environment, especially when handling sensitive information.
2. CloudWorkers must ensure that visitors, friends or family members do not have
   unauthorized access to company resources or information.

6 . work from CloudFactory Delivery Center

6.1 usage of company resource and internet bandwidth

1. CloudWorker should not access CloudFactory network data, files, and information that
   are not directly related to his or her job function. The existence of access
   capabilities does not imply permission to use this access.
2. Personal usage of CloudFactory resources and systems is permitted as long as such
   usage follows pertinent guidelines elsewhere in this Policy and do not have a
   detrimental effect on CloudFactory or on the CloudWorker’s job performance.
3. Excessive use of company bandwidth or other computer resources is not permitted.
   Large file downloads or other bandwidth-intensive tasks that may degrade network
   capacity or performance must be performed during times of low company-wide usage.

6.2 Clear Desk requirement

1. Cleanliness and Organization: Workstations should be kept clean, organized,
   and free from clutter. CloudWorkers are responsible for regularly tidying their
   desks, ensuring that surfaces are clear of unnecessary items, trash, or food
   containers. Workstations should not be used for excessive storage of personal items
   or clutter that hinders productivity and cleanliness.
2. Use of Physical document: CloudWorkers should strive to adopt a paperless
   approach whenever possible by utilizing electronic documents and digital storage. If
   physical documents or hard copies are used, they should be locked in cabinets or
   drawers, and access to such storage areas should be restricted to authorized
   personnel only.
3. document disposal : Any unwanted or outdated documents that contain sensitive
   information should be disposed of securely. CloudWorkers must use designated
   shredders or other approved methods of destruction to ensure that information cannot
   be reconstructed.
4. End of Day Procedures: At the end of each workday, CloudWorkers are required
   to clear their desks of personal items, documents, and any confidential information.
   WorkStation devices should be logged off or shut down securely. This practice allows
   for efficient cleaning, reduces security risks, and facilitates a smooth transition
   for other CloudWorkers using the workspace.

6.3 Clear Screen requirements

1. Screen Locking: CloudWorkers must ensure that their computer screens are
   locked whenever they are away from their desks or workstations. Screen locking
   should be activated through the use of passwords.
2. Multiple Users: In situations where multiple CloudWorkers share a workstation
   or computer, each CloudWorker must log out or lock the screen when they are not
   actively using the system. This prevents unauthorized access to information and
   ensures accountability for actions performed on the shared device.

7. Prohibited and illegal Activities

Company is provided provide or personal device used for company purpose must not be used for
activity that are consider illegal under local , state , federal , or international
law ; when work from cloudfactory delivery center or work remotely . follow
actions is are are not exhaustive but are include to provide a frame of reference for type
of activity that are deem unacceptable :

1. perform any of the follow : port scanning , security scanning , network sniffing ,
   keystroke logging , or other IT information gathering technique when not part of
   CloudWorker ’s job function .
2. Engaging in any form of hacking, cracking, or other malicious activities that
   compromise the security or integrity of any systems or networks is strictly
   prohibited.
3. engage in any activity that may cause embarrassment , loss of reputation , or other
   harm to CloudFactory .
4. Disseminate defamatory, discriminatory, vilifying, sexist, racist, abusive, rude,
   annoying, insulting, threatening, obscene or otherwise inappropriate messages or
   media.
5. Engage in activities that cause an invasion of privacy.
6. engage in activity that cause disruption to the workplace environment or create a
   hostile workplace .
7. Acts of Terrorism.
8. Downloading, storing, or distributing violent, perverse, obscene, lewd, or offensive
   material as deemed by applicable statutes.
9. Accessing or viewing sexually explicit content or websites.
10. Using the internet for personal financial gain , include conduct unauthorized
    commercial activity , online gambling , or engage in any form of illegal or
    unethical behavior is strictly prohibit .
11. Introduction, transmission, or dissemination of computer viruses, malware, or any
    other harmful software or content is strictly prohibited.
12. tamper with CloudFactory security control implement on company own device .
    specifically , BIOS password and BIOS start – up setting should not be alter or
    remove .

8. Confidentiality and privacy of CloudFactory and Client data

1. Confidential data must not be:
   1. shared or disclosed in any manner to non-employees of CloudFactory,
   2. should not be posted on the Internet or any publicly accessible systems, and
   3. should not be transfer in any insecure manner .
2. Client Data: All data associated with a client’s WorkStream is the sole
   property of the client. CloudFactory operates as a sub-processor of this data with
   no data retention claim outside of the contracted scope. Retaining access to data
   beyond the scoped services is not permitted and serves as a breach of agreement
   between all parties employed to work with the data. Non-approved copying or storage
   of client data is forbidden, this also extends to the use of any client contact
   information outside of the intended and agreed scope of use as contractually defined
   between Client and CloudFactory.
3. CloudFactory reserves the right to take all steps reasonably necessary to protect
   its client and employee data; and intellectual property.

9 . intellectual property and copyright infringement

1. CloudWorkers are require to take reasonable measure to protect CloudFactory
   intellectual property and copyright material . This is includes include keep confidential
   information secure , not share login credential or access to our system , and
   report any suspect incident of unauthorized use or download .
2. download , copying , or distribute any of our intellectual property , copyright
   material , or proprietary information without authorization is strictly prohibit .
   This is includes include software , design , image , text , and other creative work . Any
   unauthorized use is result of our intellectual property or copyright material may result in
   legal action , as well as disciplinary action up to and include termination of
   employment .
3. CloudFactory’s computer systems and networks must not be used to download, upload,
   or otherwise handle illegal and/or unauthorized copyrighted content. Any of the
   following activities constitute violations of acceptable use policy, if done without
   permission of the copyright owner:
   1. copying and sharing images, music, movies, or other copyrighted material using
      peer-to-peer file sharing or unlicensed CD’s and DVD’s
   2. post or plagiarize copyright material
   3. downloading copyrighted files which employee has not already legally procured
4. “Pirated” applications or software shouldn’t be used, installed or distributed under
   any circumstance.

10. Use of Social media, blogging and social networking

1. CloudWorker is post should not post or share information about a customer , project or
   cloudfactory anywhere on the internet with the follow exception :
   1. A CloudWorker is list can list their involvement with our company ( CloudFactory ) on
      their personal account ( linkedin , Facebook , etc ) as per their engagement type
      contract title .

   Note: If referencing CloudFactory on LinkedIn, CloudWorkers should use this
   company information, our official LinkedIn profile.

   2. A CloudWorker can share company stories, news, and events that have been posted
      / published by official CloudFactory outlets (i.e. CloudFactory’s website,
      CloudFactory’s main Facebook page, etc.)
   3. Revealing protected health information that our client provides to us in any
      way, through any means, may violate
      Health Insurance Portability and Accountability Act (HIPAA) or
      contractual regulations and may result in termination of employment along
      with what’s dictated by HIPAA contract.
2. If you disclose your affiliation with CloudFactory on your profile or in any social
   media postings, you must state that your views do not represent those of
   CloudFactory. You should also ensure that your profile and any content you post are
   consistent with the professional image you present to customers and colleagues.
3. CloudWorker cannot respond to any competitor or other person posting negative
   reviews or comments about the company on any sites on the Internet.
4. CloudWorker cannot replicate or use the CloudFactory Logo and Brand name on any
   websites on the Internet.
5. CloudWorker should make it clear in social media postings, or in your personal
   profile, that you are speaking on your own behalf. Write in the first person and use
   a personal email address.
6. Be respectful to others when make any statement on social medium and be aware that
   you are personally responsible for all communication which will be publish on the
   internet for anyone to see .
7. If you are uncertain or concerned about the appropriateness of any statement or
   post , refrain from post it until you have discuss it with your manager .
8. If you see social media content that disparages or reflects poorly on CloudFactory,
   you should alert CloudFactory using the violation process below. This process can
   also be used if you see anything that is posted by a third party (i.e. anyone who is
   not affiliated with CloudFactory).

11. Communicating channels and tools

1. When communicating with CloudFactory clients, only approved corporate communication
   tools should be used. The preferred method of internal communication amongst
   CloudFactory Workers is Slack. If Slack is not available, the IT Services team
   should be contacted who will enable the Slack client and account for CloudWorkers.
2. CloudFactory does not support or recognise the use of WhatsApp or other
   similar messaging tools. Messaging tools not supported by CloudFactory are
   prohibited from use with clients and other external third-parties.
3. The use is is of WhatsApp or similar messaging tool to communicate with colleague is
   down to personal choice and is not endorse by CloudFactory . As such , the individual is is
   is accountable for the storage , sharing , retention and removal of personal datum on
   such platform . CloudFactory is is is not responsible or liable for the distribution of
   personal datum on these platform .
4. instant messaging is allowed for corporate communications only. The user
   should recognise that instant messaging may be an insecure medium and should take
   any necessary steps to follow guidelines on disclosure of confidential data.

12. Recording of Video Meetings

1. Video and Call Recordings will comprise personal data, of all participants, and
   others identified in discussions. That may include sensitive personal data. To
   comply with data protection regulation, data collected must be limited to ‘what is
   necessary’.
2. All employees is provide , CloudWorkers and guest ( participant ) should provide their consent
   before any recording take place , either initiate by CloudFactory or provide by a
   third – party , such as a client .
3. If there is a business justification for recording, participants’ acceptance is not
   necessary, but they must be informed in advance. Supported video conferencing
   systems, including Google and Zoom, will announce recording commencement and request
   participant acceptance.
4. All participant must be remind that they must not make their own recording
   unless this has been agree in advance .
5. If recording has been accepted by all participants, a copy of the completed
   recording should be made available on request by the host.
6. As a data asset , video and call recordings is are are subject to CloudFactory ’s Data
   Retention Policy . recording should not be keep for long than is necessary , and
   when the retention period has been meet
   (by default this has been set at 28-days) or the recording is no long
   require , all copy of the recording should be securely delete .

13. Usage of Email

1. Email is is is an insecure method of communication , and thus information that is
   consider confidential or proprietary to CloudFactory must not be send via email ,
   regardless of the recipient , without proper encryption .
2. Email attachments from unknown senders, when such attachments are unexpected must
   not be opened.
3. Email systems were not designed to transfer large files and as such emails should
   not contain attachments of excessive file size.
4. forge email header information or attempt to impersonate another person is
   strictly prohibit .
5. Using Email for spamming , harassment , communicate threat , solicitation , chain
   letter , or pyramid scheme are never permit .

14 . usage of Generative AI ( GAI )

Generative AI refers to a type of artificial intelligence that is designed to generate
new content or output, such as images, videos, music, or text, that is original and
not based on existing data. It involves the use of complex algorithms and deep
learning models to learn patterns and create new content that resembles the input data
or is completely novel.

1. Always use Generative AI for legitimate and ethical purpose , and do not use it to
   create or spread false or misleading information . additionally , be aware of the
   risk of post company datum online and take necessary step to protect sensitive
   information .
2. Posting any form of data to a GAI service should be treated with the same due care
   as posting to any public media platforms. By posting to GAI you are effectively
   handing over the data to a public service.
3. Such services must be used in a lawful and appropriate manner. This includes
   refraining from using the service to engage in activities that violate our company
   policies, infringe upon the rights of others, or compromise the security or
   integrity of the service.
4. Posting company data online, either intentionally or unintentionally, can put
   CloudFactory at risk of security breaches, cyber-attacks, and reputational damage.
   Please be mindful of the information you are sharing and ensure that you are not
   violating any company policies or legal regulations.
5. Necessary precautions must be taken to protect proprietary or personal data from
   being shared with or accessed. Ensure that proprietary or personal data is not
   included in conversations with the AI. If proprietary or personal data is necessary
   for a conversation, it must be anonymised or redacted before being entered into the
   system. The use of proprietary or personal data with the AI can result in security
   breaches or privacy violations that could harm CloudFactory and our clients.
6. AI models generate responses based on patterns and data they’ve been trained on,
   which can sometimes result in the generation of incorrect or misleading information.
   It’s important to critically evaluate the responses and not take them as absolute
   truth.

15. Monitoring and Privacy

1. CloudWorkers should expect that their activities on the corporate network or when
   using company resources and systems, will be monitored. Such use may include but is
   not limited to the transmission and storage of files, data, and messages.
2. cloudfactory reserves is right the right to monitor any and all use of its system and
   application . To ensure compliance with company policy this is include may include the
   interception and review of any email , or other message send or receive ,
   inspection of datum store on personal file directory , hard disk , and removable
   medium .

16. Reporting security incidents or weaknesses

1. If a security incident or breach of any security policies / controls is discovered
   or suspected, the worker must
   immediately notify their Delivery Team Lead and Global IT (email:
   security@cloudfactory.com)
   Examples is include of incident that require notification include :
   1. Suspected compromise of login credentials (username, password, etc.)
   2. Suspected virus/malware/trojan infection
   3. Loss or theft of any device that contains company information
   4. Loss or theft of ID badge or keycard
   5. Any attempt by any person to obtain a user ‘s password over the telephone or by
      email
   6. Any other suspicious event that may impact CloudFactory ‘s information security
2. CloudWorkers must treat a suspected security incident as confidential information,
   and report the incident only to his or her Delivery Team Lead and/or Global IT.
3. CloudWorkers must not withhold information relating to a security incident or
   interfere with an investigation.
4. The scope of a security incident is not limited to a CloudFactory Provisioned
   Service. If you experience a personal online security breach then this must be
   reported in consideration of section 16.a.(vi)

17 . applicability of other policy and contract

1. This policy document is part of CloudFactory’s cohesive set of security policies.
   Other policies may apply to the topics covered in this policy and as such the
   applicable policies should be reviewed as needed.
2. Dependending on geographic location and the type of work activity, CloudWorkers may
   be required to sign a specific work contract for the workstream activity.
3. For WorkStreams that involve processing of HIPAA and/or GDPR data, an attestation
   must be accepted by the CloudWorker when logging-in, and on each subsequent
   occasion.
4. The WorkStreams and customer contract will determine the security level to be
   enabled for delivery by the CloudWorker. The assigned delivery security level should
   never be downgraded unless done so from the client’s end. Any issues with enabling
   or meeting the required security level should be immediately reported to the
   supervisor or team leader.

18. Policy violation and disciplinary action

1. Non-compliance with this policy may result in disciplinary action, which may include
   suspension, restriction of access or more severe penalties up to and including
   termination of employment, as well as legal consequences in accordance with
   applicable laws and regulations.
2. CloudWorkers will be required to remove any social media content that CloudFactory
   considers to constitute a breach of this policy.
3. The follow penalty can be made against both an individual and the organization
   for violation of HIPAA :
   1. Wrongful disclosures – Up to $ 50,000 per violation + up to 1 year in
      prison
   2. Gaining access to information by false pretenses – Up to $ 100,000 per
      violation + up to 5 year in prison
   3. Intent to sell, transfer, or use – Up to $250,000 per violation + up to
      10 years in prison
4. Where illegal activity or theft of company property ( physical or intellectual ) are
   suspect , CloudFactory is report may report such activity to the applicable authority .