Sentosa Cove

Cyber Security Plan C&W is in compliance with the government’s Third Party Management Policy. Our IT infrastructure is managed and governed by a set of security policies that define the requirements to protect both C&W and our client’s data. Requirements to comply to these policies falls on each employee. This is inclusive of any C&W employee (full time, temporary, or intern) or vendor (third party organizations, contractors, or consultants), or clients (client employees, contractors, or vendors) who develop, implement, manage, or host C&W systems or have access to C&W’s data.

• Information Security Policy (high view overarching security policy) • Appropriate Use Policy (intended for C&W users) • Safe Harbor Supplemental Policies • Login, Password & Session Standards

• Information Security Policy (high view overarching security policy) • Appropriate Use Policy (intended for C&W users) • Safe Harbor Supplemental Policies • Login, Password & Session Standards

Definition of these policies are closely aligned with CORBIT 5.0, ISO 27002, ISO 27001, SOX and other certifications. These documents are reviewed yearly to ensure they stay current to industry and regulatory requirements. We employ a multi-faceted security program responsible for protecting both confidential company information and client data. C&W also employs a multi-faceted security program responsible for protecting both confidential company information and client data. For example, C&W’s Global and regional risk committees, composed of senior leaders and stakeholders from the business including CFOs, COOs, CIOs, HR, Legal & Compliance, etc., will provide governance for risk, internal audit, control and compliance of the organization.

These committees: • Provide input and monitor risk

• Review the Information Security Program • Support annual business certification processes

• Review internal audit plans and results • Discuss control or security incidents • Review key compliance or regulatory matters

53