INFORMATION SECURITY COMMITMENT

Parkway Projects Limited is committed to safeguarding the confidentiality, integrity, and availability (CIA) of all information assets in line with applicable legal, regulatory, and contractual requirements. Our Information Security Management System (ISMS) provides a structured framework for the secure processing, storage, and exchange of information, ensuring compliance, protecting stakeholder trust, and preserving the organization’s reputation. In support of this commitment, Parkway Projects Limited aligns its Information Technology investments with organizational objectives and industry best practices. We operate in accordance with ISO/IEC 27001 and PCI DSS standards to strengthen business continuity, cyber resilience, protection of information assets, and the effective delivery of value from IT investments.

Policy Objectives:

Parkway Projects Limited is committed to aligning its information security and risk management frameworks with its organizational strategy. The establishment, implementation, and continual improvement of the Information Security Management System (ISMS) enable effective identification, assessment, and treatment of information security risks as part of the enterprise risk management framework.

Key elements of this commitment include:

Conducting regular information security risk assessments
Maintaining a Statement of Applicability and risk treatment plans
Implementing business continuity and contingency planning
Ensuring secure data backup and recovery processes
Enforcing access control and identity management measures
Establishing incident detection, reporting, and response procedures

All employees and relevant external parties are required to comply with this policy and associated security controls. Mandatory information security awareness and training programs are provided, with appropriate documentation maintained for staff and applicable third parties.

Information security incidents or policy breaches must be reported promptly. Violations of this policy may result in disciplinary action, up to and including termination of employment or contractual agreements. Where applicable, breaches may be subject to legal action in accordance with the Cybercrimes (Prohibition, Prevention, etc.) Act, 2015.