Information Security and Data Privacy Policies

Scope of Sonata’s Policies

These policies apply to all employees, contractors, interns, business units, and third-party service providers who access or process Sonata’s information or IT assets. It covers all physical and digital environments, including on-premises systems, cloud platforms, mobile applications, and digital interfaces.

All users are required to follow these policies to ensure secure and compliant handling of information across Sonata and its subsidiaries.

Approach & Methodology

Sonata adopts a harmonized approach to its IMS, integrating clause-level requirements across ISO 27001, ISO 27701, ISO 22301, ISO 20000-1, and ISO 9001.

Methodology for Integrated Management System

Integrated Management System Policy

Sonata is committed to safeguarding the confidentiality, integrity and availability of its company and clients’ data, intellectual property, and employees’ personal information at all times. It ensures uninterrupted business operations and compliance with our contractual, legal, and regulatory obligations.

Every employee, contractor, and stakeholder associated with our business is personally accountable and responsible for ensuring compliance with these objectives.

Lead by Example

Raise awareness, inspire others, and take decisive action to safeguard and enhance the security posture of data, information, intellectual property, and related assets. Continuously improve our practices in information security, privacy, business continuity, and IT service management.

Adopt a Zero Trust Security Framework

Assume no implicit trust and verify every access request continuously and rigorously, ensuring strict authentication and authorization for all users and devices. Protect data integrity and privacy through robust security controls and continuous monitoring to mitigate cybersecurity risks effectively.

Uphold Data Security and Privacy Standards

Adhere strictly to data security and privacy standards, ensuring compliance with all relevant privacy regulations and standards. Utilize company and client data, as well as intellectual property, solely for their intended purposes, accessing or managing data only with explicit authorization. Implement robust security controls, policies, and procedures to identify, protect, detect, respond to, and recover from cybersecurity risks, safeguarding both data integrity and privacy in accordance with local and international laws.

Ensure Resiliency

Establish and maintain comprehensive, adaptive strategies that safeguard our organization’s critical functions and services. This encompasses ensuring uninterrupted customer service, fortifying internal infrastructure, and implementing robust Business Continuity Plans (BCP).

Commit to Service Excellence

Implement efficient, adaptive processes and technologies that ensure the highest quality of IT services. This includes enhancing service delivery, improving incident response, and maintaining robust service continuity. By ensuring alignment with strategic goals, operational priorities, and customer expectations, we drive mutual success and satisfaction. Through continuous improvement, proactive monitoring, and stakeholder engagement, we aim to support our organization's goals and deliver exceptional value to our customers.

Stay Alert and Respond with Agility

Remain vigilant against potential threats such as ransomware or theft. Proactively prevent security breaches and minimize their impact if they occur, promptly reporting any security vulnerability, unusual behavior, or breaches for immediate action.

Sonata Information Security Policy

Sonata commits to ensuring:

• Information is accessed only by authorised users and systems.
• Information and services remain accurate, consistent, and reliable.
• Information and systems are accessible when required by business or clients.
• Personal data is processed fairly, lawfully, transparently, and securely.
• Services continue with minimal downtime during disruptions.
• All contractual, legal, regulatory, and stakeholder obligations are met.
• Proportionate controls based on risk assessment, threat intelligence, and business impact are applied.
• IMS – through monitoring, measurement, audits, and management reviews – are enhanced.

The IMS Policy is built on the following principles:

• Security by Design - Embed security, privacy, and continuity in all solutions, projects, and services from inception.
• Least Privilege & Zero Trust - Limit access to minimum required and continuously validate trust.
• Defence in Depth - Apply la`yered security across people, processes, and technology.
• Accountability & Traceability - Maintain clear ownership, audit trails, and evidence for all IMS activities.
• Stakeholder Assurance - Provide confidence to clients, regulators, and partners through transparency and assurance.
• Integration - Ensure information security, IT service management, privacy, and continuity objectives support each other within a unified IMS framework.