Cybersecurity Policy

1. Intent and Scope

(a) This cybersecurity policy (policy) provides the basis of cybersecurity management within FS Spagnolo & Co (Aust) Pty Ltd (Company).

(b) Effective protection of business information creates a competitive advantage, both in the ability to preserve the reputation of the Company and in reducing the risk of the occurrence of negative events and incidents.

Meeting the Company’s legislative requirements.
Keeping data and documents confidential as required by the Company and its stakeholders.
Ensuring the integrity of the Company’s data and IT systems.
Upholding the Company’s reputation as a trusted recipient of data.
Maintaining storage and back-up systems that meet the needs of the Company and its employees, contractors, volunteers, vendors and anyone else who may have any type of access to the Company’s systems, software, hardware, data and/or documents (collectively referred to as the Participants).

2. Responsibilities

(a) This policy applies to all Participants who are given access to the Company’s systems, software, hardware, data and/or documents.

(b) All Participants are responsible for protecting business information and systems. Where there is any doubt about the security of any action, the Participants should take a cautious approach and avoid any potential risks.

3. Authorisation and Access

Managers should exercise caution when:

Sharing information and documents with the Participants.
Authorising the Participants to enter and control information systems.
Giving the Participants access to information systems.
Implementing role-based access controls with documented approval workflows for sensitive client financial data and maintaining audit logs of all system access.

As a general rule, managers should follow a need-to-know basis. If there is any uncertainty regarding how information and documents should be shared, contact the Cybersecurity Officer at fsspagnolo@spagnolo.net.au.

4. Password and Authentication Requirements

(a) To avoid the Participants’ work account passwords being compromised, these best practices are advised for setting up passwords:

Passwords set up by an administrator must be uniquely and randomly generated, then immediately changed by the user.
Change passwords every 90 days and avoid reusing previous 10 passwords.
Use at least 8 characters (must contain capital and lower-case letters, numbers and symbols).
Do not write down password and leave it unprotected.
Do not exchange credentials when not requested or approved by supervisor.

(b) Change passwords when there is any possibility that an existing password may have been compromised.

(d) Multifactor authentication tools should be used where possible.

5. Email Security

Emails can contain malicious content and malware. In order to reduce harm, the Participants should employ the following strategies:

Do not open attachments or click any links where content is not well explained.
Check the email addresses and names of senders.
Search for inconsistencies.
Block junk, spam and scam emails.
Avoid emails that contain common scam subject lines such as prizes, products and money transfers.
Where an email requests financial payment, confirmation of password, or prompts to login to a Company system, extreme care should be taken to ensure that it is genuine, such as by calling the sender.

If the Participant is not sure that an email, or any type of data is safe, the Participant should contact the Cybersecurity Officer at fsspagnolo@spagnolo.net.au.

6. Device Security and Using Personal Devices

(a) Logging in to any work accounts on personal devices such as mobile phones, tablets or laptops, can put FS Spagnolo & Co (Aust) Pty Ltd data at risk. FS Spagnolo & Co (Aust) Pty Ltd does not recommend accessing any FS Spagnolo & Co (Aust) Pty Ltd data from personal devices. However, if this cannot be avoided, the Participants are obligated to keep their devices in a safe place and not exposed to anyone else.

(b) The Participants are recommended to follow these best practice steps:

Keep all electronic devices’ passwords secure and protected.
Logging into accounts should only be performed through safe networks.
Install security updates on a regular basis.
Upgrade antivirus software on a regular basis.
Never leave devices unprotected and exposed, particularly in public spaces.
Lock computers when leaving the desk.
When accessing trusted external systems, all applicable guidelines must be complied with.

(c) It is recommended that any Internet of Things (IoT) devices are kept segregated from Company systems unless they have been approved by an IT specialist for use.

(d) The Participants must not use unauthorised devices on their workstations, unless they have received specific authorisation from the Cybersecurity Officer.

(e) Any devices deemed no longer suitable for use must be disposed of in a secure way to ensure all information is permanently removed.

7. Transferring Data

Data transfer is a common cause of cybercrime. The Participants should follow these best practices when transferring data:

Avoid transferring personal information such as customer data and employee information (this includes anything that can or may identify an individual including first name, last name, age, address and email address).
Adhere to the relevant personal information legislation including the Australian Privacy Principles.
Data should only be shared over authorised networks.
If applicable, destroy any sensitive data when it is no longer needed.
Encrypt all sensitive data transfers using industry-standard protocols (minimum TLS 1.2 or AES-256 encryption) and ensure encrypted storage for client financial records and personally identifiable information.

8. Working Remotely

When working remotely, all the cybersecurity policies and procedures must be followed.

9. Company Systems

(a) When accessing the internet from any system set up by the Company:

Participants must use the standard process and not bypass any security measure.
Reasonable care must be taken in relation when downloading documents and transmitting data over the internet. Access only trusted websites.

(b) When accessing accounts on Company systems:

User accounts on work systems are only to be used for the business purposes of the Company and not to be used for personal activities.
Participants are responsible for protecting all confidential information used and/or stored on their accounts. This includes their user logins and passwords. Participants are prohibited from making unauthorised copies of such confidential information and/or distributing it to unauthorised persons outside of the Company.
Participants must not purposely engage in any activity with the intent to: harass other users; degrade the performance of the system; divert system resources to their own use; or gain access to Company systems for which they do not have authorisation.

10. General Security Requirements

(a) Participants must not install unauthorised software. The Company may at any time introduce a whitelist of approved/trusted programs. If this occurs then only these programs may be used by the Participants.
(b) Participants should stay up-to-date with any other Company-wide recommendations, such as recommended browser settings.
(c) Participants should perform daily backups of important new/changed data, software and configuration settings.
(d) Participants must not attempt to turn off or circumvent any security measures.
(e) Participants must report any security breaches, suspicious activities or issues that may cause a cyber security breach to the Cybersecurity Officer immediately, and await their instructions regarding the appropriate response to the breach.
(f) Upon reporting a security breach, Participants must preserve all relevant evidence and logs, refrain from further system access unless authorised by the Cybersecurity Officer, and document the incident details including time of discovery, affected systems, and potential data exposure for regulatory compliance purposes.
(g) Within 24 Hours of discovering a critical security breach involving client financial data or personal information, Participants must escalate the incident to senior management and commence client notification procedures in accordance with Australian Privacy Principles, ensuring regulatory reporting obligations are fulfilled within required timeframes.

11. Other Companies Policies

This Policy must be followed in conjunction with the Company’s Privacy Policy. All policies are accessible via the company intranet at https://intranet.spagnolo.net.au/policies or by contacting the office manager at the Ascot Vale office.

12. Training

All Participants must maintain working knowledge of basic cybersecurity protocols. All new Participants will be given training on cybersecurity.

13. Disciplinary Action

If this policy is breached, one or more of the following disciplinary actions will take place:

(a) Incidents will be assessed on a case-by-case basis.
(b) In case of breaches that are intentional or repeated or cases that cause direct harm to the Company, Participants may face serious disciplinary action, including termination of your employment, engagement or services.
(c) Subject to the gravity of the breach, formal warnings may be issued to the offending Participants.

14. Review

The Company will periodically review this policy and update as required to ensure the continued security of the Company. It is important for those to whom this policy applies to stay up-to-date with changes to this policy, as this is a rapidly-changing area of technology.

15. Third-Party Vendor Security Management

The Company must conduct security assessments of all third-party vendors handling client financial data, including cloud-based accounting platforms, payroll processors, and SMSF administration systems. All vendor contracts must include data protection clauses, audit rights, and incident notification requirements within 24 Hours of any security breach. The Company must maintain a register of approved vendors and conduct annual security reviews to ensure ongoing compliance with this Policy and professional standards applicable to accounting and corporate advisory services.

16. Remote Access Security Controls

All remote access to company systems and client data must be conducted through an approved Virtual Private Network (VPN) with encryption enabled. Employees must enrol devices accessing company systems in Mobile Device Management (MDM) software, maintain current operating system updates and antivirus protection, and enable automatic screen lock after 5 Minutes of inactivity. Access to sensitive client financial data from personal or unmanaged devices is strictly prohibited unless the device meets minimum security standards and has been approved by management.

17. Vendor Security Assessment Criteria and Compliance Framework

All third-party vendors must demonstrate SOC 2 Type II certification or equivalent security accreditation, maintain minimum professional indemnity and cyber liability insurance of $1 Million, and provide evidence of annual penetration testing and encryption standards meeting AES-256 or higher. Vendor contracts must include mandatory breach notification within 24 Hours with detailed incident reports, quarterly compliance reviews with documented security controls, data deletion procedures upon contract termination, and adherence to Australian Privacy Principles and applicable accounting profession standards. The Company must document all vendor assessments and maintain evidence of ongoing compliance verification.

18. Remote Access Monitoring and Compliance

The company will maintain audit logs of all remote access sessions recording IP addresses, timestamps, accessed data categories, and device identifiers for a minimum of 1 Month. Devices must undergo annual security recertification to verify compliance with minimum security standards including current operating system versions, updated antivirus definitions, and enabled encryption. Any device failing to meet security standards or attempting unauthorised access will be automatically blocked and subject to remote data wiping where MDM capabilities permit, with the employee required to complete security training before access restoration.