TO LABS AB Trust Center

Organization assets are labeled and have designated owners.

Where applicable, Organization marks information system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information. Exemptions must be approved by management and remain in a specific controlled area.

Organization authorizes and records the entry and exit of systems at datacenter locations.

Equipment maintenance is documented and approved according to management requirements.

Organization performs business contingency and disaster recovery tests on a periodic basis and ensures the following: • tests are executed with relevant contingency teams • test results are documented • corrective actions are taken for exceptions noted • plans are updated based on results

Organization identifies the business impact of relevant threats to assets, infrastructure, and resources that support critical business functions. Recovery objectives are established for critical business functions.

Budgets for infrastructure capacity are established based on analysis of historical business activity and growth projections; purchases are made against the established budget and plans are updated on a quarterly basis.

Organization configures redundant systems or performs periodic backups of data to resume system operations in the event of a system failure.