Cybersecurity Policy

Mitigating Unauthorized Changes to Account Information and Fund Diversion

Dear Team,

As part of Circuit Assembly’s commitment to safeguarding our organization from cyber threats and maintaining the utmost security of our financial transactions, we are pleased to introduce the following cybersecurity policy. This policy outlines the measures we will implement to mitigate the risk of unauthorized persons attempting to fraudulently divert funds through changes to account information, including ACH, wire transfer, or bank account details.

1. Scope: This policy applies to all employees, contractors, vendors, and any third parties accessing our financial systems. It is mandatory for all relevant personnel to adhere to the guidelines described herein.
2. Account Information Changes and Fund Diversion Mitigation: To prevent unauthorized changes to account information and potential fund diversion, the following security measures will be strictly enforced:

2.1. Verbal Confirmation: Any requests for changes to account information, payment instructions, or fund transfers must be verified through a verbal confirmation process. When such a request is received, the concerned department or individual handling the transaction will be required to confirm the legitimacy of the request by calling the requester’s contact information on record. Verbal confirmation must be obtained from an authorized individual before proceeding with any changes.

2.2. Two-Factor Authentication (2FA): Wherever possible, we will implement Two-Factor Authentication (2FA) for access to financial systems and sensitive information. This additional layer of security will reduce the risk of unauthorized access to crucial financial data.

2.3. Phishing Awareness Training: All employees and relevant stakeholders will undergo regular phishing awareness training to recognize and report suspicious emails or communication attempts that could potentially lead to unauthorized access or fund diversion.

2.4. Segregation of Duties: To minimize the risk of internal fraud, a clear segregation of duties will be maintained within the organization. No single individual should have complete control over financial transactions or account information changes.

2.5. Incident Response Plan: In the event of a suspected or confirmed fraudulent attempt to divert funds or unauthorized changes to account information, a robust incident response plan will be activated immediately. The incident response team will assess the situation, take necessary actions to contain the threat, and report the incident to the appropriate authorities if required.

2.6. Vendor Due Diligence: For third-party vendors handling sensitive financial transactions on our behalf, a thorough due diligence process will be carried out before engaging their services. This will include assessing their cybersecurity measures and compliance with industry best practices.

1. Responsibilities:

3.1. Management: The management team will be responsible for ensuring the effective implementation and continuous review of this cybersecurity policy.

3.2. Employees: All employees are responsible for adhering to the policy guidelines, promptly reporting any suspected security incidents, and participating in cybersecurity awareness training.

1. Policy Compliance: Failure to comply with this cybersecurity policy may result in disciplinary action, up to and including termination of employment or contract, as appropriate.
2. Policy Review: This policy will be reviewed and updated as necessary to stay aligned with the ever-evolving cyber threat landscape and technological advancements.
3. Contact Information: If you have any questions or concerns regarding this policy or its implementation, please contact the IT Security department at [Contact Email/Phone].

We appreciate your cooperation and commitment to upholding the security standards at Circuit Assembly. By working together, we can effectively mitigate cyber threats and safeguard our organization’s financial well-being.