Data Loss Prevention Strategy &
Security Incident Response Policy

Introduction

1. Comstack is committed to safeguarding the personal data and sensitive information entrusted to us by our merchants, customers, and users. This Data Loss Prevention Strategy and Security Incident Response Policy (the "Policy") outlines the measures and procedures that Comstack has implemented to prevent data loss and to respond effectively to any security incidents that may occur.

Data Loss Prevention Strategy

2.1. Risk Assessment: Comstack will conduct regular risk assessments to identify potential threats to the confidentiality, integrity, and availability of personal data and sensitive information.

2.2. Data Classification: Comstack will classify data based on its sensitivity, and apply appropriate security measures accordingly.

2.3. Access Controls: Comstack will implement strong access controls, including role-based access, to limit access to personal data and sensitive information to authorized personnel only.

2.4. Encryption: Comstack will use strong encryption for storing and transmitting personal data and sensitive information.

2.5. Data Backup and Recovery: Comstack will maintain regular data backups and a robust data recovery plan to ensure the availability of data in the event of a loss.

2.6. Training and Awareness: Comstack will provide regular training and awareness programs for employees to ensure they understand their roles and responsibilities in protecting personal data and sensitive information.

Security Incident Response Policy

3.1. Incident Detection: Comstack will employ a variety of security tools and monitoring systems to detect potential security incidents, including intrusion detection systems, log monitoring, and vulnerability scanning.

3.2. Incident Reporting: Comstack employees are required to report any suspected or confirmed security incidents immediately to the designated security incident response team.

3.3. Incident Response Team: Comstack will assign a security incident response team responsible for coordinating the response to security incidents.

3.4. Incident Response Plan: Comstack has established a detailed incident response plan that outlines the steps to be taken in the event of a security incident, including:

3.4.1. Assessing the scope, nature, and severity of the incident.

3.4.2. Containing the incident to minimize its impact on the organization.

3.4.3. Eradicating the cause of the incident and restoring affected systems and data.

3.4.4. Identifying and implementing measures to prevent similar incidents in the future.

3.4.5. Communicating with affected stakeholders, including merchants, customers, employees, and regulatory authorities, as appropriate.

3.5. Incident Documentation: Comstack will maintain a record of all security incidents, including their nature, scope, response actions taken, and lessons learned, to facilitate continuous improvement of the organization's data security practices.

3.6. Legal and Regulatory Compliance: Comstack will ensure compliance with all applicable legal and regulatory requirements related to security incidents, including timely notification of affected parties and reporting to relevant authorities.

3.7. Post-Incident Review: Following the resolution of a security incident, Comstack will conduct a post-incident review to evaluate the effectiveness of its response and to identify opportunities for improvement.

Policy Review and Updates

4.1. Comstack will regularly review and update this Policy to ensure that it remains effective in preventing data loss and responding to security incidents. Any updates to the Policy will be communicated to all employees and relevant stakeholders.

Compliance and Enforcement

5.1. All Comstack employees are required to comply with this Policy. Failure to do so may result in disciplinary action, up to and including termination of employment.

5.2. Comstack will conduct periodic audits and assessments to ensure compliance with this Policy and to identify areas for improvement.

By implementing this Data Loss Prevention Strategy and Security Incident Response Policy, Comstack demonstrates its commitment to protecting the personal data and sensitive information entrusted to us by our merchants, customers, and users.

‍