Basic Policy on Information Security
Announcements1. The company recognizes all information owned or managed by the company, as well as all network hardware and software
and the human and material resources necessary to manage them (hereinafter referred to as "Information Infrastructure") as important management resources,
and in order to properly manage and protect them, we establish the following Basic Policy on Information Security.
2. Manage information in compliance with laws and regulations concerning information, as well as rules, standards, and procedures established based on this Basic Policy.
3. Information security refers to the following for information and information infrastructure (hereinafter referred to as information assets):
(1) A state where only authorized persons can access (confidentiality)
(2) A state where information is accurate (integrity)
(3) Always maintain a state where information assets are available for use at all times (availability), and formulate and execute necessary measures
4. Investigate and identify information assets to be protected, analyze and evaluate risks, and formulate and implement risk countermeasures.
5. The Chief Information Security Officer and Information Management Supervisors shall regularly monitor that information security is operated within the company in accordance with prescribed laws, regulations, rules, and standards
or procedures.
6. In the unlikely event that an information leak or infringement on information assets occurs or the risk thereof becomes significant,
respond promptly and appropriately to prevent the expansion of damage and implement effective recurrence prevention measures.
7. The Chief Information Security Officer shall, based on the results of operational monitoring, changes in laws and regulations concerning information, changes in information assets,
review information security in accordance with the occurrence of information leakage accidents or infringements, and other changes in internal and external circumstances,
and maintain effective security as much as possible at all times.
8. The Chief Information Security Officer shall provide information security education and training to all officers and employees
regularly to raise awareness.
9. When outsourcing operations, the company shall require subcontractors to implement information security measures conforming to this Policy and obligate them to do so
through contracts or other means.
October 1, 2025 NOMURA MEDIAS Co., Ltd.