Policy Document

ISMS Policy

Information Security Management System Policy

SparkSupport Infotech Pvt. Ltd is committed to safeguarding the confidentiality, integrity, and availability of all information assets, ensuring that information security risks are identified and managed effectively. As part of our continuous commitment to securing our information systems, we have implemented an Information Security Management System (ISMS) in line with the ISO/IEC 27001:2022 standard.

For SparkSupport Infotech Pvt. Ltd CTO Prem Sai

Date: 24/06/2025

Action Guideline

1. Sparksupport prevents leakage, destruction, and illegal use of all information relating to the customers, vendors, management etc. and builds the system to secure the confidentiality, integrity and availability of the information for daily operations. 2. Company recognizes the value of the private information of all staff and secures it. 3. Sparksupport establishes a contingency plan to secure continuation of the business, assuming occurrences of a natural disaster, terrorism, a large-scale infection disease etc. 4. Company provides all staff with proper education and training to maintain and improve the effectiveness of the information security management system 5. Company builds and manages an organization which grasps incidents, audits its operations and effectiveness of the information security management system, and attempts its continuous improvement.

To secure its information assets and its customer, Spark support shall deploy procedures to maintain confidentiality, integrity, and availability of all information assets. Business objectives and goals of Sparksupport are

Key Objective 1: Provide high quality services to our clients. Goal 1 – Client Satisfaction Score of more than 98 % Goal 2 – On time Delivery Goal 3 – No defects of showstopper/critical type in first release to the client. Key Objective 2: Continuous focus on employee satisfaction and competency development so as to reduce and stabilize employee attrition. Goal 1 – A minimum of 3 man-days training in a year per employee. Goal 2 – Employee satisfaction survey score of greater than 95 % Key Objective 3: Continual improvement of services to our internal & external customers. Goal 1 – Key process performance improvement of at least 10% per annum in all departments Key Objective 4: To secure its information assets and of its customers, shall deploy procedures to maintain confidentiality, integrity and availability of all information assets. Goal 1 – Number of security incidents of high severity to maintain nil in total security incidents. Key Objective 5: To have year on year revenue increase while maintaining profitability. Goal 1 – Revenue growth of >=40% with respect to the previous financial year To meet these business goals, ISMS objective is defined.

ISMS Objectives

Protect information from deliberate or unintentional unauthorized acquisition or unauthorized access Maintain confidentiality of information. Maintain integrity of information by protecting it from unauthorized modification. Ensure availability of information to authorized users when needed Meet regulatory and legislative requirements Produce, maintain, and test Business Continuity plans as far as practicable. Train all staff on information security Report and investigate all breaches of information security and suspected weaknesses Monitor Risk Treatment Plan and measure effectiveness of selected controls. When planning how to achieve its information security objectives, the organization shall monitor

When planning how to achieve its information security objectives, the organization shall monitor

Uptime of servers and networks Achievement of preventive maintenance planned schedule Closure of non-conformities in defined time frame Conducting of defined number of awareness programs as per the process Monitoring of security incidents as per the process of incident management Mock drills of BCP as per process and achievement of targets Review of risks as per defined process and closure of actions as per last review The templates for each one of them is defined and frequency and thresholds for each of them is defined in the template. For monitoring and analysis following

The templates for each one of them is defined and frequency and thresholds for each of them is defined in the template. For monitoring and analysis following

Monitoring and measurement of the controls shall be done as per the process mentioned in the template. The System Administrator, either himself or through one of the data center employees, shall be responsible for monitoring and measurement of controls. The results from monitoring and measurement shall be analyzed and evaluated at least on a monthly basis. However, this analysis can be conducted earlier depending on exigencies, as decided by the System Administrator. The System Administrator shall analyze and evaluate these results.