Information Security Policy

1. Introduction

Trio recognizes that information is one of its main assets and must therefore be adequately protected.

This Information Security Policy (PSI) was prepared in compliance with Resolução BCB nº 85 (Central Bank of Brazil Resolution No. 85), of April 8, 2021, reflecting Trio's commitment to complying with the applicable legal and regulatory rules, and establishes the principles, guidelines and responsibilities for ensuring the confidentiality, integrity, availability and authenticity of the information processed by the organization.

The objective is to minimize risks and to prevent, detect and reduce exposure to security incidents, ensuring the continuity of operations, the protection of corporate information and compliance with applicable laws and regulations, as well as to promote a culture of information security among employees, service providers and partners.

This PSI is supplemented by specific Policies (such as Passwords, Information Classification, Backup, and Identity and Access Management, among others), which establish guidelines, responsibilities and technical and operational controls related to information security.

2. Terms and definitions

2.1. When referred to in this Policy, the following terms shall have the following meanings:

2.1.1. IT/IS Area: Information Technology / Information Security Area.

2.1.2. Assets: All resources that have value to the organization and must be protected. These may include: information, applications, equipment, people, etc.

2.1.3. Backup: The process of creating backup copies of data, systems or files to ensure that they can be recovered in the event of loss, failure or incident.

2.1.4. Cloud Computing: A model for providing and consuming technology services (such as servers, storage, databases and networks) delivered on demand over the internet.

2.1.5. Encryption: The process of transforming readable information into encoded data to protect it against unauthorized access.

2.1.6. Incidents: Events that compromise, or have the potential to compromise, the integrity, confidentiality or availability of assets, data or systems.

2.1.7. LGPD: Lei Geral de Proteção de Dados (Brazil's General Data Protection Law), which establishes rules for the processing of personal data.

2.1.8. Logs: Automatic records of activities performed in applications. They are essential for monitoring, auditing, troubleshooting, etc.

2.1.9. OWASP Top 10: A standard awareness document for developers that lists and explains the most critical security risks in web applications.

2.1.10. Patches: Software updates that fix flaws or vulnerabilities or improve functionality.

2.1.11. Contingency / Business Continuity Plan: A set of documented procedures to ensure that the company's critical processes can continue operating or be quickly recovered in the event of failures, interruptions or disasters.

2.1.12. Principle of least privilege: A user should have only the access and permissions strictly necessary to perform their duties

2.1.13. PSI: Política de Segurança da Informação (Information Security Policy).

2.1.14. Secure By Default: A principle under which a system or software is delivered already configured with the strictest possible levels of security.

2.1.15. Secure By Design: A software engineering approach in which security requirements and controls are incorporated from the initial planning and architecture phase of the solution.

3. Scope

3.1. This policy applies to Trio, covering all systems, processes, information and assets. Compliance with it is mandatory for all partners, shareholders, officers, members of the Board of Directors, users, employees, temporary employees, third parties, interns and apprentices, hereinafter referred to as “employees”.

4. Principles and guidelines

4.1. The fundamental principles of the PSI are:

4.1.1. Confidentiality: Access to information restricted solely to authorized persons.

4.1.2. Integrity: Ensuring that information is correct, complete and not improperly altered.

4.1.3. Availability: Ensuring access to information and systems whenever necessary for operations.

4.2. To support these principles, Trio adopts the following commitments:

4.2.1. Asset Management: Establish controls for the identification, registration, classification, use, monitoring and protection of the organization's assets throughout their life cycle, in order to ensure the security, integrity, availability and traceability of corporate information.

4.2.2. Information Protection and Classification: Establish controls for the classification, handling, storage, sharing and protection of corporate information according to its level of sensitivity (public, internal, confidential or restricted), as defined in the Information Classification Policy, in order to ensure the confidentiality, integrity and availability of the organization's information.

4.2.3. Identity and Access Management: Establish controls for granting, changing, reviewing and revoking access to corporate assets and systems, following the principle of least privilege and segregation of duties, with periodic reviews and monitoring of access, as defined in the Identity and Access Management Policy.

4.2.4. Personal Data Privacy: Establish a process for processing personal data in compliance with the LGPD and other applicable regulations.

4.2.5. Passwords and Authentication: Use secure credentials, which may not be shared, in accordance with the Password Policy.

4.2.6. Devices and Network: Ensure that equipment, systems and other technology assets are used and managed in accordance with Information Security and Information Technology standards, through the definition, implementation and maintenance of secure configurations and the continuous application of mechanisms for protecting, monitoring and controlling the corporate infrastructure and network, ensuring the confidentiality, integrity, availability and reliability of the organization's technology environment.

4.2.7. Backups and Retention: Establish encrypted backup copies of critical data, with retention periods defined in the Backup and Retention Policy.

4.2.8. Incident Management: Establish processes for the identification, recording, analysis, handling of and response to information security incidents, including impact assessment and notification of regulators, institutions authorized to operate by the Central Bank of Brazil and data subjects, where applicable, in order to reduce impacts and ensure the continuity of the organization's operations.

4.2.9. Digital Certificate Management: Establish controls for managing the life cycle of digital certificates, covering issuance, renewal, storage, revocation and monitoring, in order to ensure the authenticity, integrity and security of corporate communications, transactions and systems.

4.2.10. Contingency and Continuity Plan: Maintain contingency and business continuity plans aimed at the rapid recovery of the organization's critical processes, systems and services. The plans must ensure the capacity to respond to incidents, outages and crisis situations, establishing the guidelines for developing the incident scenarios considered in business continuity tests, in order to minimize operational impacts and ensure the security of information.

4.2.11. Encryption: Ensure the protection of sensitive information through appropriate encryption mechanisms, both at rest and in transit, using market-recognized algorithms and protocols. The management of cryptographic keys must be controlled, with restricted access and defined life cycles.

4.2.12. Secure Development

I. Adoption of secure development practices throughout the entire systems life cycle, including security requirements analysis and code review.
II. Market-recognized guidelines must be followed, such as the OWASP Top 10, as well as secure by design and secure by default principles, ensuring that security controls are incorporated from the conception of the solutions.
III. Security tests on critical systems must be performed periodically, at least annually. Vulnerabilities identified must be recorded, classified by risk and addressed through an action plan with defined deadlines and follow-up until they are resolved.

4.2.13. Intrusion Prevention and Detection: Implement mechanisms for the prevention, detection and continuous monitoring of threats and security events, in order to quickly identify, block and respond to unauthorized access attempts, suspicious behavior and anomalous activities that may compromise the organization's assets and information.

4.2.14. Information Leakage Prevention: Implement information leakage prevention mechanisms, through technical and procedural controls aimed at protecting sensitive and confidential data, in order to reduce the risks of extraction, sharing, copying, improper exposure, loss of or unauthorized access to corporate information, whether intentional or accidental.

4.2.15. Protection Against Malicious Software: Ensure the use of mechanisms for protection against malicious software on the organization's technology assets, in order to reduce risks related to the compromise of assets, service outages and improper exposure of corporate information.

4.2.15. Cyber Intelligence: Continuously monitor cyber threats, collecting and analyzing relevant information to anticipate risks, identify trends and support information security decision-making. Reliable sources must be used.

4.2.16. Risk Management

I. Establish ongoing processes for the identification, analysis, evaluation, treatment, monitoring and communication of risks related to information security and technology, considering operational, financial, reputational, regulatory and business continuity impacts.
II. Ongoing identification, analysis, evaluation and treatment of risks related to information security and technology, considering business, financial, reputational, operational and regulatory compliance impacts.
III. The risks identified must be documented, classified and tracked through treatment plans, assignment of owners and periodic reviews, in order to reduce the organization's exposure to threats and vulnerabilities that may compromise its assets and corporate information.

4.2.17. Technology Supplier Assessment and Monitoring: Assess and monitor suppliers that have access to the organization's information or systems, ensuring that they meet information security and privacy requirements. Contracts must be entered into with specific security, confidentiality and data protection clauses.

4.2.18. Cloud Computing: Adopt appropriate security controls when using cloud services, including access management, data protection, activity monitoring and compliance with legal and regulatory requirements. The shared responsibility model between the organization and the service provider must be taken into account.

4.2.19. Secure Systems Integration: Ensure that integrations between corporate systems and services are carried out using appropriate security controls, in order to protect the information transmitted between internal and external environments.

4.2.20. Logs and Audit: Generate, protect and analyze records of relevant events, in accordance with the Log Management Policy.

4.2.21. Culture and Awareness

I. Establish ongoing information security awareness initiatives, ensuring that employees understand and apply good practices and their responsibilities in protecting information.
II. Implement training programs and periodic assessments of personnel.
III. Ensure senior management's commitment to promoting a culture of security, risk management and continuous improvement of the processes, controls and procedures related to information security and cybersecurity.

5. General provisions

5.1. Non-compliance with this PSI may result in disciplinary measures, in accordance with legislation and internal rules.

5.2. Managers must ensure that their teams are aware of and in compliance with this PSI.

5.3. The Information Security area is responsible for reviewing this Policy and proposing updates.

5.4. Senior management is responsible for its approval.

5.5. This Policy will be reviewed periodically, at least once a year, or whenever there are significant changes in IT processes, risks or the organizational structure, or relevant legal, regulatory or operational changes.

6.1. Backup and Retention Policy
6.2. Information Classification Policy
6.3. Business Continuity Policy
6.4. Encryption Policy
6.5. Secure Development Policy
6.6. Equipment Policy
6.7. Information Asset Management Policy
6.8. Identity and Access Management Policy
6.9. Incident Management Policy
6.10. Log Management and Audit Policy
6.11. Risk Management Policy
6.12. Technology Supplier Risk Management Policy
6.13. Vulnerability Management Policy
6.14. IT Governance Policy
6.15. Cyber Intelligence Policy
6.16. Privacy Policy
6.17. Network Security Policy
6.18. Password Policy
6.19. Hardening Policy