Cybersecurity Policy

Cybersecurity Policy

1. DEFINITIONS

All capitalized terms in this Policy shall have the meanings listed

down:

"Senior Management" means the management of Attrus, which is currently represented by a Board of Directors composed of three (3) officers;

“BSA” means the Bank Secrecy Act of the United States, as codified in various sections of Title 31 of the United States Code, including but not limited to 31 U.S.C. 5330, under which ATTRUS, as a Money Services Business (MSB), is subject to federal onboarding, reporting, and compliance requirements pursuant to the implementing regulations found in 31 CFR Chapter X;

“FinCEN” means the Financial Crimes Enforcement Network, a bureau of the U.S. Department of the Treasury that administers the Bank Secrecy Act and requires MSB onboarding pursuant to 31 U.S.C. 5330 and implementing regulations under 31 CFR 1010.100(t) and (ff), which provide the regulatory definition of "money services business," and 31 CFR 1022.380(b)(2), which mandates biennial onboarding renewal on or before December 31st;

“CFPB”: The Consumer Financial Protection Bureau, the U.S. federal agency responsible for consumer financial protection laws, including oversight of payment service providers under the Electronic Fund Transfer Act (EFTA) and Regulation E.

“GLBA”: The Gramm-Leach-Bliley Act (15 U.S.C. §6801 et seq.), which requires financial institutions to explain their information-sharing practices and to safeguard sensitive customer data under the FTC Safeguards Rule.

“PCI DSS”: The Payment Card Industry Data Security Standard, a set of security standards applicable to any entity that stores, processes, or transmits cardholder data.

“SOC 2”: Service Organization Control 2 — a framework developed by the AICPA for evaluating service organizations’ internal controls related to security, availability, processing integrity, confidentiality, and privacy.

“CFPB”: The Consumer Financial Protection Bureau, the U.S. federal agency responsible for consumer financial protection laws, including oversight of payment service providers under the Electronic Fund Transfer Act (EFTA) and Regulation E.

"Cybersecurity Area" has the meaning given in section 8.3 below;

"Information Assets" means Data and software, hardware, and in general the information systems used in the offer of Attrus's products and services and that instrumentalize and/or facilitate the development, receipt, transmission, handling, storage, traffic and/or disposal of information and Data;

"Multi-Factor Authentication (MFA)": Implemented process that requires two or more independent authentication factors to access sensitive resources, ensuring greater security in access.

"CIS CONTROLS" means "The 18 CIS Critical Security Controls", published by the Center For Internet Security, containing best practice guidelines for cybersecurity standards;

"Customers" means individuals and/or legal entities, as the case may be, who contract or use the products and services offered by Attrus;

"COBIT" means the Control Objectives for Information and Related Technology, developed by the Systems Audit and Control Association (ISACA), a set of business best practices for developing, organizing, and implementing information management and governance strategies;

"Employee" means any and all individuals or legal entities that have a position, function, position, corporate, employment, professional, labor or trust relationship with Attrus;

"Encryption" means the process of encoding information to make it inaccessible to unauthorized persons, ensuring the confidentiality and integrity of the data;

"Data" means, when collectively, Open Finance Data, Personal Data, Sensitive Personal Data, Confidential Information, Inside Information, and Sensitive Information;

"Open Finance Data" has the meaning given in section 7 below;

"Personal Data" has the meaning given in section 7 below;

"Sensitive Personal Data" has the meaning given in section 7 below;

"DDoS" (Distributed Denial of Service), an attack that overloads a server, service, or network with a large volume of traffic from various sources, causing unavailability of services;

"Cybersecurity Officer" means the officer responsible to the BCB for matters related to this Policy, as provided for in article 7 of Resolution No. 85/21;

"Elimination": exclusion of data or set of data stored in a database, regardless of the procedure employed, as provided for in article 5, item XIV of the LGPD;

"Attrus" means Attrus Instituição de Pagamento S.A., Attrus US LLC, FPay Internacional SA de CV., FPay Colombia SAS, or FacilitaPay Chile SPA, together or separately;

"Risk Management": Continuous process of identification, assessment and mitigation of security risks implemented, using recognized methodologies to ensure the protection of information assets.

"Hardening" means a set of practices and techniques used to strengthen the security of systems and networks, reducing vulnerabilities and protecting against attacks;

"Incident" means any event that impacts or may impact the confidentiality, integrity and/or availability of the Information Assets;

"Confidential Information" has the meaning given in section 7 below;

"Inside Information" has the meaning given in section 7 below;

"Public Information" has the meaning given in section 7 below;

"ISO" stands for International Organization for Standardization;

"Malware" means malicious software designed to damage, exploit, or gain unauthorized access to systems and information, including but not limited to viruses, trojans, ransomware, and more;

"NIST" stands for National Institute of Standards and Technology;

"Open Finance" as provided for in article 2, item I of Joint Resolution No. 1/20;

"Partners and Service Providers" means individuals or legal entities that provide services of any nature to Attrus, commercial or not, remunerated or not, on an occasional or permanent basis, including, but not limited to, banking correspondents, participants in payment arrangements and other service providers in general;

"Patch Management" means the process of managing and applying software updates (patches) to fix security vulnerabilities and improve the performance and functionality of systems;

"Phishing" is a fraud technique in which attackers impersonate trusted entities to deceive users and obtain sensitive information, such as passwords and bank details;

"Incident Response Action Plan" means the Incident Response and Action Plan referred to in Article 6 of BCB Resolution No. 85/21;

"Policy" means this Cybersecurity Policy;

"Privacy Policy" means Attrus's privacy and Personal Data protection policy, as available at the following link: [https://www.Attrus.com /compliance];

"BCB Resolution No. 85/21" means BCB Resolution No. 85, of April 8, 2021, which provides for the cybersecurity policy and the requirements for contracting Cloud Computing Services to be observed by payment institutions and other institutions authorized to operate by the BCB;

"Joint Resolution No. 1/20" means Joint Resolution No. 1, of May 4, 2020, which provides for the implementation of Open Finance;

"Segregation of Duties" consists of the separation of activities between areas and people who are potentially conflicting or who have privileged information, in which the Employee cannot perform more than one function in the processes of authorization, approval, execution, control and accounting;

"Cyber Security" means the set of means and technologies employed in the defense of Information Assets, information systems, infrastructure, computer networks and/or personal devices, with the objective of preventing damage, theft, intrusion, alteration or destruction of information; and

"Web Application Security": Implementing security practices and tools to protect web applications from threats such as SQL injection, cross-site scripting (XSS), and other known vulnerabilities.

"Cloud Computing Services" means the Data processing and storage and cloud computing services provided to Attrus. For the purposes of BCB Resolution No. 85/21, cloud computing services cover the availability to Attrus, on demand and virtually, of at least one of the following services: (i) data processing, data storage, network infrastructure, and other computing resources that allow the contracting institution to deploy or run software, which may include operating systems and applications developed by the institution or acquired by it; (ii) implementation or execution of applications developed by the contracting institution, or acquired by it, using the service provider's computer resources; or (iii) execution, through the internet, of applications implemented or developed by the service provider, using the service provider's own computer resources.

2. GOALS

The purpose of this Policy is to establish: (i) the principles, guidelines and attributions related to Attrus's Cybersecurity, in order to ensure the confidentiality, completeness and availability of Attrus's data and systems; and (ii) the appropriate procedures to prevent, detect, reduce and respond to Incidents that may occur as a result of the offer of Attrus's products and services.

This Policy was prepared in accordance with Attrus's risk and business profile, taking into account the nature of its activities, the complexity of its products and services offered, and the sensitivity of the data and information under its responsibility.

As a licensed payment institution in Brazil, regulated by the Central Bank of Brazil (BCB), Attrus affirms that its policies are grounded in the key regulations established by the BCB. The credibility of our license and the oversight provided by the BCB reinforce the reliability and robustness of our compliance measures, which apply across all jurisdictions in which we operate.

3. SCOPE

This Policy is applicable to all Attrus Employees, as well as its Partners and Service Providers that provide Cloud Computing Services.

4. CYBERSECURITY STRATEGY

Information is one of Attrus's main assets. Thus, the institution defines its Cybersecurity strategy in order to ensure the confidentiality, integrity, availability, and security of the Data and Cybersecurity systems implemented by the institution. This strategy is based on the detection, prevention, monitoring and response to incidents and strengthens Cybersecurity risk management and the construction of a robust foundation for Attrus's increasingly digital future.

To achieve this goal, we use the expanded perimeter protection strategy. This concept considers that information must be protected regardless of where it is, whether internally, in an affiliate, in Partners and Service Providers that provide Services or in an international unit, throughout its life cycle, from collection to disposal.

5. CYBERSECURITY PRINCIPLES

Our commitment to the proper treatment of Attrus's information, Clients and the general public is based on the following principles:

- Confidentiality: ensure that access to information is obtained only by authorized persons, according to the internal classification of the Data in question;

- Availability: ensuring that authorised persons have access to information whenever it is needed; and

- Integrity: to ensure the accuracy and completeness of the information and the methods of its processing, as well as transparency in dealing with the stakeholders involved.

In a technical breakdown of these pillars as our infrastructure, it is possible to raise ourselves in relation to each one:

Confidentiality: We have implemented role-based access controls (RBAC) and multi-factor authentication (MFA) to ensure that only authorized users have access to sensitive information, especially payment data.

Availability: We adopt redundancy and failover practices at AWS, including regular backups and disaster recovery testing, to ensure the continuous availability of payment services.

Integrity: We have implemented mechanisms that ensure that payment transaction data remains complete and unaltered, ensuring the integrity of the information.

6. GUIDELINES

This Policy, the Privacy Policy and other related documents must be protected against unauthorized changes and available in a place accessible to Employees. Such documents must be reviewed annually by Attrus, in order to ensure their compliance with the applicable legislation and regulations in the United States of America (which includes guidelines issued by CNCiber), as well as with national and international market standards.

Any deviations from this Policy, in Brazil or in units abroad, must be periodically reported by the Legal Department to Attrus's executive committees, compliance committee and other risk committees.

Attrus has the following guidelines:

a) the elaboration of Incident scenarios considered in business continuity tests;

b) the definition of procedures and controls, at levels of complexity, scope and precision compatible with those used by Attrus, aimed at the prevention and treatment of Incidents involving Partners and Service Providers that handle Information Assets or that are relevant to the conduct of the institution's operational activities;

c) the classification of the Data as to its relevance;

d) definition of the parameters to be used in the evaluation of the relevance of the Incidents; and

e) reviewing our policies on a quarterly basis to ensure compliance with legislation and best practices in the payments industry.

7. CYBERSECURITY PROCESSES

To ensure that the Data processed is adequately protected, Attrus adopts the following internal processes:

a) Information Asset Management

Information Assets, according to their criticality, must be identified, inventoried, kept up to date, have an owner, disposed of securely and be protected against improper access. Protection can be physical (e.g. rooms with controlled access) and logical (e.g. shielding or hardening configurations, patch management, authentication and authorization). The Information Assets of Attrus, Customers and the general public must be treated ethically and confidentially and in accordance with current laws and internal rules, promoting the proper use and preventing undue exposure of information.

b) Classification of the Relevance of Information Assets

Information Assets must be classified according to their legal nature, and all Information Assets processed, stored and/or maintained in the cloud are assigned a classification level according to the operator of the Information Asset, its legal nature, importance to the business, access restriction and the impacts in case of misuse of the Information Assets.

Based on the classification of the Information Asset, the compatible and necessary protections must be established throughout the life cycle of the information, which includes: its generation, its handling, its storage, its transport and its Disposal.

Importantly, we have implemented encryption of data at rest and in transit, use of VPNs, and TLS for communications, ensuring the security of payment data on AWS.

Information Assets are classified as follows:

- Confidential Information: consists of information and data made available to Attrus that are subject to confidentiality duties based on a contract or legal instrument to which Attrus is a party (e.g., Confidentiality Agreements, Partnership Agreements with a confidentiality clause, among other possible documents). The improper disclosure of Confidential Information may lead to lawsuits, image risks, duties to indemnify Partners and Service Providers, among other net and illiquid losses, according to the applicable contractual instrument;

- Personal Data: consists of information related to an identified or identifiable natural person, as defined by article 5, item I, of the LGPD. The leakage of Personal Data or processing of Personal Data without the proper legal basis may lead to: (i) imposition of administrative penalties on Attrus by the ANPD (e.g., warning, fine, deletion of the Personal Data to which the infraction refers, partial suspension of the database to which the infraction refers, suspension and/or partial or total prohibition of the exercise of the Personal Data processing activity, as applicable); (ii) reputational damage to Attrus before the national and international public; (iii) duties to indemnify the persons who hold the Personal Data leaked, if so determined by the judiciary; (iv) duties to indemnify any Partners and Service Providers that provide Cloud Services; and/or (v) costs to Attrus with Partners and Service Providers (e.g., external lawyers);

- Sensitive Personal Data: consists of any Personal Data that deals with racial or ethnic origin, religious conviction, political opinion, membership in a union or organization of a religious, philosophical or political nature, data related to health or sex life, genetic or biometric data, when linked to a natural person, as provided for in article 5, item II, of the LGPD. The leakage of Sensitive Personal Data or processing of Sensitive Personal Data without the proper legal basis may lead to: (i) imposition of administrative penalties on Attrus by the ANPD (e.g., warning, fine, deletion of the Personal Data to which the infraction refers, partial suspension of the database to which the infraction refers, suspension and/or partial or total prohibition of the exercise of the activity of processing Personal Data, as applicable); (ii) reputational damage to Attrus before the national and international public; (iii) duties to indemnify the persons who hold the Personal Data leaked, if so determined by the judiciary; (iv) duties to indemnify any Partners and Service Providers that provide Cloud Services; and/or (v) costs to Attrus with Partners and Service Providers (e.g., external lawyers);

- Open Finance Data: consists of any and all data or information or set of data and information shared in the Open Finance environment between a participating institution and Attrus, or between Attrus and third parties not participating in Open Finance, pursuant to Joint Resolution No. 1/20 and Circular No. 4,015/20. The leakage of Open Finance Data or the processing of Open Finance Data without the proper legal basis may lead to: (i) the imposition of administrative penalties on Attrus and/or its Senior Management, as applicable, by the ANPD (e.g., warning, fine, deletion of the Personal Data to which the infraction refers, partial suspension of the database to which the infraction refers, suspension of the Personal Data processing activity, as applicable) and/or by the BCB (e.g., public warning, fine, prohibition to provide certain services and/or to perform certain activities, disqualification to act as administrator, or revocation of the authorization to operate, depending on the seriousness of the infraction); (ii) reputational damage to Attrus before the national and international public; (iii) duties to indemnify other Open Finance participants and/or the people who hold the leaked Open Finance Data, if so determined by the judiciary; (iv) duties to indemnify any Partners and Service Providers that provide Cloud Services; and/or (v) costs to Attrus with Partners and Service Providers (e.g., external lawyers);

- Confidential Information: consists of all active and passive operations and services provided to the Client that are subject to the banking secrecy provided for in LC No. 105/01. The leakage of Confidential Information without legal basis may lead to: (i) conviction of certain persons for the crime of breach of confidentiality described in article 10 of LC No. 105/01; (ii) imposition of administrative penalties on Attrus and/or its Senior Management, as applicable, by the BCB (e.g., public warning, fine, prohibition to provide certain services and/or to perform certain activities, disqualification to act as administrator, or revocation of the authorization to operate, depending on the seriousness of the infraction); (ii) reputational damage to Attrus before the national and international public; (iv) duties to indemnify the persons who hold the leaked Confidential Information, if so determined by the judiciary; (v) duties to indemnify any Partners and Service Providers for which they provide Cloud Services; and/or (vi) costs to Attrus with Partners and Service Providers (e.g., external lawyers);

- Pix Data: consists of any and all Personal Data leaks within the scope of Pix (instant payment arrangement instituted by the BCB). The leakage of Pix Data (e.g., Pix keys, among others) may lead to: (i) the imposition of penalties by the BCB described in the Pix Penalties Manual (which can be accessed at the following link: https://www.bcb.gov.br/estabilidadefinanceira/exibenormativo?tipo=Resolu%C3%A7%C3%A3o%20BCB&numero=177); (ii) reputational damage to Attrus before the national and international public, in view of the obligation to disclose said leak to the Central Bank and to its entire base of Customers holding prepaid payment accounts; (iii) duties to indemnify the holders of the leaked Pix Data if so determined by the judiciary; (iv) duties to indemnify any partner institutions within the scope of Pix and/or Partners and Service Providers that provide Cloud Services; and/or (v) costs to Attrus with Partners and Service Providers (e.g., external lawyers);

- Internal Information: consists of information intended for internal use at Attrus, but which has a low level of criticality. Unauthorized disclosure may have a low impact on Attrus, its shareholders, Clients and/or Partners and Service Providers. The information classified as internal includes, for example, Attrus's internal policies and procedures; and

- Public Information: consists of other information that does not clearly fit into any of the seven (7) classifications above. The disclosure of public information must be authorized by the area responsible for public relations/marketing of Attrus. The unauthorized disclosure of Public Information is not expected to materially negatively affect Attrus, its shareholders, Customers and/or Partners and Service Providers.

c) Information Asset Access Management

Concessions, reviews and exclusions of access must be carried out based on Attrus's corporate tools and processes. Accesses must be traceable, in order to allow the individual identification of the Employee or Partner and Service Provider who has accessed or altered Information Asset(s), allowing their accountability. The granting of access must comply with the criterion of least privilege, in which Employees and/or Partners and Service Providers must have access only to the information resources essential for the full performance of their activities. Segregation of Duties must permeate all critical processes, preventing a single person responsible from being able to execute and control the process throughout its life cycle. The identification of any Employee must be unique, personal and non-transferable, qualifying him or her as responsible for the actions performed. The password is confidential, personal and non-transferable information, it must be used as an electronic signature, and its sharing is prohibited.

d) Cyber Risk Management

Cyber risks must be identified through an established process for analysis of threats, vulnerabilities, probabilities and impacts as applicable to the Information Assets and to Attrus, so that appropriate safeguards are recommended. The recommendations are discussed in the appropriate internal means, with exclusive access to the responsible Employees and in accordance with Attrus's risk management policy. The technologies in use by Attrus must be in versions supported by their manufacturers and duly updated. Any exceptions must be approved by the competent authority or have compensatory controls.

Technical information on the subject:

Patch Management: We establish a patch management cycle, including vulnerability testing and patching within defined timeframes, ensuring the protection of payment systems.

Penetration Testing: We conduct bi-annual penetration testing to identify and mitigate security vulnerabilities.

e) Risk Management of Service Providers and Partners

The Partners and Service Providers hired by Attrus must be classified considering some criteria, according to an internal document (KYE KYP and KYS Manual). Depending on the classification, the Partner and Service Provider will undergo a risk assessment, which may include on-site validation of IS controls, remote evaluation of evidence or other assessments, in addition to the follow-up of any corrections and improvements implemented by the Partners and Service Providers. Partners and Service Providers must report the relevant incidents (as defined in item 7.f of this Policy), related to Attrus's information stored or processed by them in compliance with legal and regulatory determinations.

f) Incident Handling

The Cybersecurity Area monitors the security of Attrus's technological environment, analyzing events and alerts to identify possible Incidents. The Incidents that are identified by the alerts are classified in relation to the impact, according to the criteria adopted by Attrus.

We have established a communication protocol for security incidents, including notifications to competent stakeholders, ensuring transparency and appropriate response.

For its degree of relevance, aspects such as the classification of Information Assets, the impact on the financial system and the compromise of customer data and the general public will be considered. Incidents must be immediately reported to the Cybersecurity Officer and the compliance committee, who will determine the method of communication to the applicable parties and execute the applicable action plans.

All Incidents go through a process of treatment and communication, where all information pertinent to the Incidents is recorded, such as cause, impact, classification, etc. The general lines and practices of these procedures will be established by the Cybersecurity Area.

We have implemented an integrated continuous monitoring system (SIEM) on AWS for security incident detection and response, and we perform real-time log analysis to identify suspicious activity and respond quickly to incidents, ensuring the security of transactions.

Information on Incidents that may impact certain financial institutions and/or participants in the Brazilian payment system will be shared by Attrus, but provided that the institutions in question have signed a bilateral agreement with Attrus in this regard, aiming to collaborate with the mitigation of risk in accordance with legal and regulatory determinations.

The Compliance Area will prepare an annual report containing the relevant Incidents that occurred in the period, actions carried out to prevent and respond to Incidents and results of continuity tests. This report must be submitted to the Senior Management, in accordance with legal and regulatory determinations. In order to improve the ability to respond to Incidents, Attrus performs business continuity tests simulating scenarios of critical Cybersecurity incidents, which can compromise the availability and/or access of Information Assets. Every Employee must be proactive and diligent in identifying, communicating to the Cybersecurity Area and mitigating risks related to Cybersecurity.

g) Cybersecurity Awareness

Attrus promotes the dissemination of the principles and guidelines of this Policy through awareness and training programs to strengthen the internal culture of Cybersecurity. Periodically, awareness campaigns or training are made available, which can be in person or online, related to the confidentiality, integrity and availability of Information Assets. These campaigns are conveyed through e-mails, corporate portal, e-learning, media and/or social networks to Employees and Partners and Service Providers.

h) Governance with the Business and Technology Areas

Initiatives and projects in the business and technology areas must be aligned with the principles and guidelines of Cybersecurity.

i) Physical Security of the Environment

The physical security process establishes controls related to the granting of physical access to environments, according to the criticality of the information handled in these environments, as described in the internal documents.

j) Security in the Development of Application Systems

The system development process must ensure adherence to this Policy, Attrus's internal documents and good security practices. The production environments must be segregated from the other environments and with access only via application for previously authorized people or by approved tools.

k) Log Recording

It is mandatory to record logs or audit trails of the computing environment, for all platforms, in order to identify: who made the access, when the access was made, what was accessed and how it was accessed. This information must be protected from modification and unauthorized access.

l) Cybersecurity Program

Attrus's Cybersecurity Program is guided by the following principles:

- current regulations, in particular:

BCB Resolution No. 85/21 of the BCB;

BCB Resolution 4,658;

BCB Resolution 4,752;

LGPD - Law No. 13,709/2018.

- best market practices and guidelines issued by CNCiber;

- world scenarios;

- risk analysis carried out by Attrus.

According to their importance, the actions carried out within the scope of the Cybersecurity Program are divided into:

- Critical Actions: consists of emergency and immediate corrections to mitigate imminent risks;

- Sustainable Actions: short/medium-term initiatives to mitigate risk in the current environment, keeping the environment safe, respecting Attrus's risk appetite and allowing long-term/structuring actions to be carried out;

- Structural Actions: medium/long-term initiatives that address the root cause of risks and prepare the company for the future.

m) Perimeter Protection

To protect Attrus's infrastructure against an external attack, the institution must use, at least, tools and controls against: DDoS attacks, Spam, Phishing, APT/Malware, invasion of network devices and servers, application attacks and external scans. To mitigate the risk of information leakage, preventive tools installed on mobile devices, workstations, e-mail service, WEB browsing service, printing service, in addition to the use of Encryption for data at rest and in transport should be used. In order to increase protection, the physical or logical connection to Attrus's corporate network is not allowed by unmanaged or non-approved private equipment.

Relevant technical information:

We use the service of a 24/7 SOC team hired (Access Security) that monitors our environment and responds to security incidents. The tool we use is the Wazuh SIEM (https://wazuh.com/), which serves in the following layers:

System and application logs.

•Intrusion detection.

-File integrity.

-Vulnerabilities.

•Real-time alerts.

-Cloud security.

-Incident responses.

8. DUTIES AND RESPONSIBILITIES

8.1. Senior Management

Senior Management is responsible for observing and ensuring compliance with this Policy, in addition to its approval, and must ensure that the Cybersecurity Director and the Cybersecurity Area have the necessary tools and resources to enforce this Policy, considering the opinions issued by these internal agents.

8.2. Director of Cybersecurity

Attrus's Cybersecurity Director works closely with Attrus's managers and Employees who are involved in the protection of Information Assets and must report directly to Senior Management, as well as manage and ensure that the Cybersecurity Area performs its functions in accordance with this Policy and other internal rules of Attrus.

In addition, the Director of Cybersecurity is responsible for:

a) prepare, together with the Compliance and Cybersecurity Areas, information security policies, standards and procedures, if necessary;

b) identify areas of concern and implement appropriate changes as needed;

c) coordinate and supervise compliance with policies and procedures related to the confidentiality, integrity and security of Information Assets;

d) to make decisions at the last level regarding this Policy and, together with the other members of the Senior Management, to approve the content of this Policy;

e) coordinate, annually, a formal risk assessment to identify new threats and vulnerabilities and identify appropriate controls to mitigate any new cybersecurity risks;

f) review, annually, information security policies and procedures to maintain adequacy in light of emerging business requirements or security threats; and

g) keep the Incident Response Action Plan updated and disseminated to the necessary Employees.

8.3. Cybersecurity Area

The Cybersecurity Area, in accordance with the provisions of Resolution No. 85/21 and with the best market practices, uses ISO 27001, ISO 27002, ISO 27005, ISO 27032, CIS CONTROLS, NIST and other frameworks such as COBIT as a reference, it is responsible for the implementation of the information security structure and management of related processes and risks.

In addition, the Cybersecurity Area is responsible for:

a) propose suggestions for improvement to this Policy, suggestions for Cybersecurity standards and procedures, as necessary;

b) ensure Attrus's compliance with this Cybersecurity Policy, rules and procedures;

c) act as a central coordination department for the implementation of Cybersecurity policies, action plans and procedures;

d) promote awareness programs, training, and training of Employees on Cybersecurity;

e) create, maintain and distribute incident response and escalation procedures;

f) monitor and analyze security alerts and distribute information to appropriate information security, technical, and business unit management personnel;

g) review logs;

h) control and monitor access to restricted areas and sensitive data; and

i) perform access management, access matrix, granting and revocation of access to Information Assets.

9. DURATION, HISTORY OF CHANGES AND DISCLOSURE OF THIS POLICY

This Policy must be documented and reviewed annually or within a shorter period, in order to comply with the provisions of Resolution No. 85/21, as amended, as well as the applicable laws and regulations or changes in Attrus's practices that justify updating the document.

Attrus discloses to the general public, in clear and easily accessible language, a summary of this Policy that can be accessed on its website.

Attrus will retain the version of this Policy for a period of five (5) years at the disposal of the BCB. All documents and information stored by Attrus may be submitted to the BCB, if it requests them during the respective retention periods.

*** ***