CYBER INCIDENT RESPONSE & CYBER FRAUD MANAGEMENT POLICY

This Policy establishes the framework for preparing for, detecting, reporting, assessing, containing, investigating, recovering from and learning from cyber incidents and cyber-enabled fraud affecting JSR ALL-IN-ONE SOLUTIONS PRIVATE LIMITED, its customers, gift cards/vouchers, systems, applications, APIs, data or third-party services.

• Provide a structured and timely response to cyber incidents.
• Protect customers, transactions, voucher balances and information assets.
• Contain threats and minimise operational, financial and data impact.
• Preserve relevant evidence for investigation and authorised reporting.
• Coordinate incidents with payment, PPI, banking, merchant and technology partners.
• Restore affected services securely and prevent recurrence.

This Policy applies to employees, contractors, systems, applications, websites, APIs, cloud services, endpoints, databases, payment integrations, gift-card/voucher platforms, third parties and any cyber event affecting Company operations.

• Unauthorised system or account access
• Credential compromise
• Phishing and social engineering
• Malware or ransomware
• Data leakage or suspected data breach
• API abuse or application attack
• Website or service compromise
• Gift-card/voucher theft or unauthorised redemption
• Payment-related cyber fraud
• Denial-of-service or service disruption
• Insider security incident
• Third-party cyber incident

Incidents shall be classified according to potential or actual impact, including customer impact, data sensitivity, financial loss, operational disruption, regulatory significance, system criticality and scope.

Management shall designate appropriate personnel from Information Security, Technology, Risk/Fraud, Compliance, Operations, Legal, Finance and Customer Support as required. External specialists may be engaged where appropriate.

Employees, contractors and relevant partners shall report suspected cyber incidents immediately through approved channels. No employee shall knowingly suppress or delay escalation of a material security incident.

1. Preparation
2. Detection and reporting
3. Initial assessment and triage
4. Containment
5. Investigation and evidence preservation
6. Eradication
7. Recovery and validation
8. Closure and lessons learned

The response team shall determine what happened, affected systems, likely attack vector, customer impact, data involved, ongoing threat, financial impact and immediate containment requirements.

• Disable compromised accounts or credentials where appropriate.
• Isolate affected systems or endpoints.
• Block malicious indicators or traffic where feasible.
• Restrict suspicious voucher or transaction activity where justified.
• Preserve evidence before destructive remediation where practicable.

Investigations shall collect and analyse relevant logs, transaction information, authentication records, system events, communications, device information and other evidence proportionate to the incident. Forensic specialists may be engaged where required.

Relevant digital and documentary evidence shall be preserved with appropriate integrity and access controls. Evidence handling shall be documented for material incidents.

• Identify affected accounts, transactions or vouchers.
• Apply appropriate holds, blocks or account-security actions.
• Coordinate with relevant payment/PPI/bank/merchant partners.
• Assess customer impact and potential financial loss.
• Preserve evidence and escalate through fraud and AML/KYC channels where appropriate.

Where personal, customer, credential, transaction or confidential information may have been compromised, the incident shall be assessed promptly and handled in accordance with applicable legal, contractual, privacy and regulatory requirements.

• Secure potentially compromised accounts where appropriate.
• Support credential resets or security actions.
• Review suspicious transactions or voucher activity.
• Provide approved customer communications where required.
• Coordinate refunds, reversals or other protective measures where applicable.

A cyber incident affecting a material vendor, PPI, bank, payment processor, merchant or technology provider shall be assessed for impact on Company operations and customers. The relevant partner shall be required to provide appropriate information and cooperation under contractual arrangements.

Incident communications shall be controlled by authorised personnel. Material incidents shall be escalated to Management, Information Security, Technology, Risk/Fraud, Compliance, Legal and other functions according to severity. External communications shall be made only by authorised persons.

Where a legal, regulatory, contractual or law-enforcement reporting obligation applies, the designated responsible function shall coordinate reporting within applicable requirements and preserve supporting evidence.

Affected systems shall be restored using secure recovery procedures. Before returning systems to normal operation, appropriate validation shall confirm that the threat has been contained and security controls are functioning.

Material incidents shall undergo a post-incident review covering root cause, control gaps, response effectiveness, customer impact, financial impact and corrective/preventive actions.

Lessons from incidents shall be incorporated into security controls, fraud rules, training, monitoring, architecture, vendor requirements and business continuity arrangements where appropriate.

Incident records shall include incident date/time, reporter, affected systems, classification, actions, evidence, decisions, communications, impact, recovery and closure information.

Incident information shall be shared on a need-to-know basis. Investigation details, credentials, security weaknesses and other sensitive information shall be protected from unauthorised disclosure.

Relevant personnel shall receive periodic incident-response training. Tabletop exercises, simulations or technical drills may be conducted based on risk and criticality.

The Company may engage cybersecurity, forensic, legal, payment, technology or other specialist support during material incidents, subject to appropriate confidentiality and contractual controls.

Exceptions to this Policy shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory and contractual requirements shall continue to apply.

This Policy shall be reviewed at least annually and after material cyber incidents or significant changes to systems, products, partners, threats or applicable requirements.