2026.1

Niche Studio is committed to ensuring all workforce members actively address security and compliance in their roles at Niche Studio. We encourage self management and reward the right behaviors. This policy specifies acceptable use of end-user computing devices and technology. Additionally, training is imperative to assuring an understanding of current best practices, the different types and sensitivities of data, and the sanctions associated with non-compliance.

Policy Statements¶

In addition to the roles and responsibilities stated earlier, Niche Studio policy requires all workforce members to comply with the Acceptable Use Policy for End-use Computing and HR Security Policy.

Niche Studio policy requires that:

(a) Background verification checks on all candidates for employees and contractors should be carried out in accordance with relevant laws, regulations, and ethics, and proportional to the business requirements, the classification of the information to be accessed, and the perceived risk.

(b) Employees, contractors and third party users must agree and sign the terms and conditions of their employment contract, and comply with acceptable use.

(c) Employees will go through an onboarding process that familiarizes them with the environments, systems, security requirements, and procedures Niche Studio has in place. Employees will also have ongoing security awareness training that is audited.

(d) Employee offboarding will include reiterating any duties and responsibilities still valid after terminations, verifying that access to any Niche Studio systems has been removed, as well as ensuring that all company owned assets are returned.

(e) Niche Studio and its employees will take reasonable measures to ensure no sensitive data is transmitted via digital communications such as email or posted on social media outlets.

(f) Niche Studio will maintain a list of prohibited activities that will be part of onboarding procedures and have training available if/when the list of those activities changes.

(g) A fair disciplinary process will be utilized for employees are suspected of committing breaches of security. Multiple factors will be considered when deciding the response such as whether or not this was a first offense, training, business contracts, etc. Niche Studio reserves the right to terminate employees in the case of serious cases of misconduct.

Controls and Procedures¶

HR Management and Reporting¶

Niche Studio uses Notion to manage its workforce personnel records.

Organization Structure¶

A reporting structure has been established that aligns with the organisation’s business lines and/or individual’s functional roles. The organisational chart is available to all employees via the Notion and/or posted on the internal web portal.

Job Functions and Descriptions¶

Position / Job descriptions are documented and updated as needed that define the skills, responsibilities, and knowledge levels required for certain jobs.

Performance Reviews and Feedback¶

Employees receive regular feedback and acknowledgement from their manager and peers. Formal performance reviews are conducted annually using Notion. Performance measures, incentives, and other rewards are established by management according to responsibilities at all levels, reflecting appropriate dimensions of performance and expected standards of conduct.

Acceptable Use of End-user Computing¶

Niche Studio requires all workforce members to comply with the following acceptable use requirements and procedures, such that:

(a) Per Niche Studio security architecture, all workforce members are primarily considered as remote users and therefore must follow all system access controls and procedures for remote access.

(b) Use of Niche Studio computing systems is subject to monitoring by Niche Studio IT and/or Security team.

(c) Employees may not leave computing devices (including laptops and smart devices) used for business purpose, including company-provided and BYOD devices, unattended in public.

(d) Device encryption must be enabled for all mobile devices accessing company data, such as whole-disk encryption for all laptops.

(e) Use only legal, approved software with a valid license installed through a pre-approved application store. Do not use personal software for business purposes and vice versa.

(f) Encrypt all email messages containing sensitive or confidential data.

(g) Employees may not post any sensitive or confidential data in public forums or chat rooms. If a posting is needed to obtain technical support, data must be sanitized to remove any sensitive or confidential information prior to posting.

(h) Anti-malware or equivalent protection and monitoring must be installed and enabled on all endpoint systems that may be affected by malware, including workstations, laptops and servers.

(i) All data storage devices and media must be managed according to the Niche Studio Data Classification specifications and Data Handling procedures.

(j) It is strictly forbidden to download or store any sensitive data on end-user computing devices, including laptops, workstations and mobile devices.

(k) Mobile devices are not allowed to connect directly to Niche Studio production environments.

Employee Screening Procedures¶

Niche Studio publishes job descriptions for available positions and conducts interviews to assess a candidates technical skills as well as culture fit prior to hiring.

Background checks of an employee or contractor is performed by HR/operations and/or the hiring team prior to the start date of employment.

Employee Onboarding Procedures¶

A master checklist for employee onboarding is maintained by HR/Facilities.
It is published in the HR system or the HR folder on Niche Studio’s internal file sharing site.

The HR Representative / Facility Manager is responsible to create an Issue in the Notion HR & Facilities project to initiate and track the onboarding process. The onboarding process should include the following IT/Security items:

1. Training.

   • New workforce member is provided training on Niche Studio security policy, acceptable use policy, and given access to the Employee Handbook.
   • Records of training and policy acceptance is kept in the HR system (currently Notion).
   • The training and acceptance must be completed within 30 days of employment.

2. Access.

   • Standard access is provisioned according to the job role and approval as specified in the HR onboarding Notion ticket.
   • Non-standard access requires additional approval following the access request procedures.
   • Request for modifications of access for any Niche Studio employee can be made using the procedures outlined in the Access Establishment and Modification policy and procedures.

3. System configuration.

   • The end-user computing device (e.g. workstation or laptop) may be provisioned by IT to install necessary software, malware protection, security agents, and setting system configurations.
   • Users in a technical role, such as Development, may choose to self configure their system. In this case, the user is given configuration guidelines defined by IT and Security. The system must have the required security configuration and endpoint agents installed for monitoring and to ensure compliance.

Employee Exiting/Termination Procedures¶

A master checklist for employee existing/termination is maintained by HR/Facilities. It is published in the HR system or the HR folder on Niche Studio’s internal file sharing site.

1. The Human Resources Department (or other designated department), users, and their supervisors (HR) are required to notify Security upon completion and/or termination of access needs and facilitating completion of the “Termination Checklist”.

2. HR are required to notify Security to terminate a user’s access rights if there is evidence or reason to believe the following (these incidents are also reported on an incident report and is filed with the Privacy Officer):

   • The user has been using their access rights inappropriately;
   • A user’s password has been compromised (a new password may be provided to the user if the user is not identified as the individual compromising the original password);
   • An unauthorized individual is utilizing a user’s User Login ID and password (a new password may be provided to the user if the user is not identified as providing the unauthorized individual with the User Login ID and password).

3. Security will terminate users’ access rights immediately upon notification, and will coordinate with the appropriate Niche Studio employees to terminate access to any non-production systems managed by those employees.

4. Security audits and may terminate access of users that have not logged into organisation’s information systems/applications for an extended period of time.

Employee Issue Escalation¶

Niche Studio workforce members are to escalate issues using the procedures outlined in the Employee Quick Reference. Issues that are brought to the Escalation Team are assigned an owner. The membership of the Escalation Team is maintained by the Chief Executive Officer or his delegate.

Security incidents, particularly those involving sensitive data, are handled using the process described in Incident Response. If the incident involves a breach of sensitive data, the Security Officer will manage the incident using the process described in Breach Notification. Refer to Incident Response for a list of sample items that can trigger Niche Studio’s incident response procedures; if you are unsure whether the issue is a security incident, contact the Security team immediately.

It is the duty of the incident owner to follow the process outlined below:

1. Create an Issue in the Notion Security Project.
2. The Issue is investigated, documented, and, when a conclusion or remediation is reached, it is moved to Review.
3. The Issue is reviewed by another member of the Escalation Team. If the Issue is rejected, it goes back for further evaluation and review.
4. If the Issue is approved, it is marked as Done, adding any pertinent notes required.
5. The workforce member that initiated the process is notified of the outcome via email.

Whistleblower Policy and Process¶

The Niche Studio requires all workforce members to observe high standards of business and personal ethics in the conduct of their duties and responsibilities. All workforce members must practice honesty and integrity in fulfilling their responsibilities and comply with all applicable laws and regulations.

(a) Reporting Responsibility. Each workforce member is required and encouraged to report serious concerns so that Niche Studio can address and correct inappropriate internal conduct and actions. This includes

• questionable or improper accounting or auditing matters,
• violations and suspected violations of company policies or ethics, or
• suspected violations of law or regulations that govern Niche Studio’s operations

(b) Acting in Good Faith. Anyone filing a written complaint concerning a violation or suspected violation must be acting in good faith and have reasonable grounds for believing the information disclosed indicates a violation. Any allegations that prove not to be substantiated and which prove to have been made maliciously or knowingly to be false will be viewed as a serious disciplinary offense.

(c) Confidentiality. Insofar as possible, the confidentiality of the whistleblower will be maintained. However, identity may have to be disclosed to conduct a thorough investigation, to comply with the law, and to provide accused individuals their legal rights of defense.

(d) No Retaliation. Workforce members, in good faith, reporting a concern under the Whistleblower Policy shall NOT be subject to retaliation or adverse employment consequences. Moreover, any workforce member who retaliates against someone who has reported a concern in good faith is subject to disciplinary actions up to and including termination of employment.

(e) Reporting. Reports of concerns may be filed directly with the company CEO, COO, and/or the Compliance Officer. Additional reporting procedure details can be found in the employee handbook.

Employee Performance Review Process¶

Formal performance reviews are conducted annually using Small Improvements.

• 360 feedback is collected from team members working directly with the employee
• Employee provides their own self assessment for both performance outcome and behavior
• Manager reviews employee self-assessment and peer feedback, and documents the final review and rating
• The final review and rating is reviewed and signed by both the employee and their manager

Continuous Education and Skills Development¶

Niche Studio provides employees the opportunity to attend conferences, trade shows, and/or ongoing training/studies relevant to their job function and business objectives.

Bullying, Harassment and Discrimination¶

Niche Studio acknowledges the right of workers to a working environment free of bullying, harassment and discrimination, and is committed to providing staff with a healthy and positive working environment in which all staff are treated with dignity and respect. Niche Studio is entitled to undertake reasonable management action in a reasonable way.

Definitions¶

In this policy, the following terms have the following meaning:

Bullying has the definition prescribed in the Fair Work Act 2009 (Cth) and means repeated unreasonable behaviour by an individual towards a worker which creates a workplace health and safety risk.

Discrimination has the definition prescribed in the state and federal discrimination legislation and means any circumstance where a person or group of persons is treated less favourably because of their background or characteristics including gender, race, age or disability.

Harassment has the definition prescribed in state discrimination legislation and means unwelcome or unsolicited behaviour towards a person that a reasonable person would consider offensive, humiliating or intimidating.

Bullying, harassment and discrimination¶

Niche Studio does not permit or tolerate any form of bullying, harassment or discrimination.

Niche Studio obligations¶

• Promote a fair and tolerant workplace and treat all staff fairly and with respect.
• Promote a diverse and inclusive workplace.
• Develop and maintain appropriate human resources procedures.
• Ensure and maintain compliance with applicable legislation.
• Provide necessary information, training and education to staff.
• Take all complaints seriously, document all incidents and thoroughly investigate all incidents and complaints.
• Take appropriate disciplinary action against any staff member who engages in bullying, harassment or discrimination.
• Respect and prioritise the health and wellbeing of staff and offer counselling and support to staff involved.

Employee obligations¶

• Comply with this policy.
• Assist Niche Studio to create a positive and harassment-free workplace.
• Understand the different forms of bullying and harassment and endeavour to treat all colleagues with equal respect.
• Report all witnessed incidents of bullying, harassment or discrimination and encourage colleagues to report instances.
• Attend all Niche Studio training sessions.
• Follow reasonable and lawful instructions.

Complaints¶

• Staff who believe they have been bullied, harassed or discriminated against are encouraged to notify Nathan Mussig (HR).
• Niche Studio must treat all complaints seriously.
• Niche Studio must respect the dignity of all complainants and maintain confidentiality and privacy in all complaints, investigations and outcomes.

Concerns may also be raised through the Whistleblower Policy and Process, or escalated using the Employee Issue Escalation process described in this section.

Disciplinary action¶

A breach of this policy may result in disciplinary action against an Employee, including termination of employment, consistent with the Non-Compliance Investigation and Sanctions process.

Phone, Internet and Social Media Use¶

Niche Studio requires all use of work phones, mobile phones, internet, email and social media to be appropriate, productive and lawful. This policy complements the Acceptable Use of End-user Computing requirements above, which govern device security, encryption, anti-malware and approved software; this section addresses conduct, communications and personal use.

Employee communications¶

All Employee communications by phone, email or social media must:

• be professional, respectful, appropriate and courteous; and
• not be detrimental to the reputation or operations of Niche Studio.

Employees must respect and maintain the privacy of all client data collected via phone or email and comply with any applicable privacy legislation or policies of Niche Studio.

Phones¶

1. Employees may have access to or be allocated with a phone. Phones must only be used for business purposes and to fulfil the Employee’s duties.
2. Occasional use of Niche Studio phones for urgent personal matters is acceptable.

Mobile phones¶

1. Employees may be provided with a Niche Studio mobile phone to fulfil their duties.
2. Niche Studio mobile phones must only be used for business purposes and to fulfil the Employee’s duties including:
   1. communicating with clients and staff;
   2. accessing the internet for work-related purposes; and
   3. accessing work calendars, diaries or apps utilised by Niche Studio.
3. Employees must not use Niche Studio mobile phones to take photographs, other than as directed or required by Niche Studio.
4. Employees must not use Niche Studio mobile phones whilst driving.
5. Occasional use of personal mobile phones or company mobile phones for urgent personal matters is acceptable.

Internet / email¶

Employees may be provided with email and internet facilities. The internet must only be used for business purposes and to fulfil the Employee’s duties including:

• research;
• use of Niche Studio apps, software and websites;
• online services offered by Niche Studio; and
• as requested or authorised by Niche Studio.

Email must only be used for business purposes and to fulfil the Employee’s duties including:

• communication with clients, staff and contractors;
• to promote Niche Studio; and
• appropriate sharing of files and resources.

Employees must utilise any sign off or disclaimer required by Niche Studio when sending emails.

Employees must not use the Niche Studio email address for activities or purposes that might compromise IT security such as subscriptions, social media, junk mail, bill payments, online purchases or as a recovery email address.

Employees must not use personal social media during work hours, with the exception of break times.

Employees must not utilise internet or email:

• to disclose private or confidential information of Niche Studio;
• to research, download or transmit material that is offensive, defamatory, illegal or contrary to any policies of Niche Studio;
• in any manner that compromises Niche Studio’s IT security;
• for improper, illegal or inappropriate activities;
• in a manner contrary to laws such as discrimination or criminal laws such as abuse; or
• in a manner that otherwise exposes Niche Studio to liability or loss.

Limited and reasonable use of internet and email for personal use is acceptable provided it does not impact on performance or compromise Niche Studio.

The Employee must report any inappropriate use of internet or email witnessed, and any emails received that are unsolicited, inappropriate or offensive.

For device security, encryption, anti-malware, password management and approved software obligations, refer to the Acceptable Use of End-user Computing requirements and approved software.

Niche Studio property¶

1. Employees must take reasonable care of all Niche Studio resources and equipment utilised in the course of their duties including phones, computers, laptops, tablets and electronic equipment.
2. Employees must use Niche Studio property properly and securely.
3. Upon termination of employment Employees must return all Niche Studio property, equipment and devices, cease using Niche Studio email and remove all Niche Studio programs and information from personal devices.

Investigations¶

1. If Niche Studio suspects an Employee is contravening this policy, Niche Studio is entitled to monitor the Employee’s use of phones or internet.
2. All emails sent from a Niche Studio email address are considered the property of Niche Studio and may be accessed in the event of an investigation or litigation.

Disciplinary consequences¶

1. A breach of this policy may result in Niche Studio placing restrictions on an Employee’s phone or internet use or requiring an Employee to return a Niche Studio phone or device.
2. Excessive personal use of Niche Studio resources or devices may result in disciplinary action, including termination of employment.
3. A breach of this policy that constitutes illegal conduct may be deemed serious misconduct and lead to termination of employment.
4. A breach of this policy may otherwise lead to disciplinary action, including termination of employment.
5. Niche Studio may seek compensation or reimbursement from an Employee for costs incurred by Niche Studio as a result of a breach of this policy.

Obligations outside workplace including social media and online behaviour¶

1. Employees must take care of Niche Studio property when working remotely and only utilise secure wi-fi. See also the Working from Home requirements.
2. Employees must not represent or communicate on behalf of Niche Studio online or in forums, social media posts, blogs or podcasts without prior consent or authorisation of Niche Studio.
3. All social media posts by Employees that reference or promote Niche Studio must be professional, respectful, courteous and align with the values of Niche Studio.
4. Niche Studio discourages the expression of personal opinions online, where such expressions might identify an employee as associated with Niche Studio or might bring Niche Studio into disrepute.
5. Niche Studio may request an Employee delete/remove a social media post that it considers:
   1. detrimental to Niche Studio;
   2. a breach of confidentiality or privacy;
   3. illegal, offensive, defamatory or discriminatory;
   4. contrary to the values of Niche Studio;
   5. a conflict of interest; or
   6. contrary to this policy.

Such request will operate as a lawful and reasonable direction.

Confidentiality¶

Employees must respect and maintain the confidentiality of clients, employees and staff in all phone and electronic communications.

Work Health and Safety (WHS)¶

Niche Studio recognises the importance of a safe and healthy working environment and strives to provide a workplace that is as safe as reasonably possible to its employees, contractors, staff, volunteers and visitors.

Niche Studio is committed to complying with its obligations as set out in applicable state and federal occupational health and safety legislation.

Niche Studio obligations¶

• Ensure and maintain compliance with applicable workplace health and safety legislation.
• Establish and implement safe work practices and/or risk control measures and provide necessary information, training and education to staff on such practices.
• Maintain policies of public liability insurance and workers compensation insurance.
• Inform contractors, volunteers, third parties and visitors of applicable safe work practices, risk control measures, safety procedures or systems of work.
• Consult and engage with staff on issues of workplace health and safety.
• Provide adequate facilities (including safety equipment and PPE), resources and supervision to staff.
• Develop emergency procedures.
• Regularly perform risk assessments, inspect plant and equipment and review safe work practices to monitor and improve safety.
• Maintain a system for reporting and investigating workplace incidents.
• Take all complaints seriously, document all incidents and thoroughly investigate all reported hazards and incidents.
• Respect and prioritise the health and wellbeing of staff.
• Communicate important safety matters to staff.

Staff obligations¶

• Attend all training sessions, read all safety information disseminated and use equipment in accordance with manufacturer instructions (where applicable).
• Wear PPE where required.
• Do not use equipment without training.
• Follow reasonable and lawful instructions.
• Take adequate breaks.
• Report identified hazards and risks as soon as possible.
• Report all injuries and incidents as soon as possible to their manager.
• Take reasonable care for own safety and the safety of others.
• Notify Niche Studio as soon as possible if unable to work due to injury or illness.
• Co-operate in any emergency evacuation in either a drill or emergency situation, as directed.

Responsibilities¶

Nathan Mussig (Responsible Person) is the staff representative responsible for reporting significant WHS issues, trends or results to the partners (Mikael Wedemeyer and Nathan Mussig).

Alcohol and drugs¶

• Staff and visitors must present to the workplace sober and free from alcohol, drugs and prohibited substances.
• Niche Studio will direct any person under the influence of drugs or alcohol to immediately leave the workplace.
• Niche Studio is entitled to perform random drug and/or alcohol testing.
• A staff member required to take prescription medication that might impact on their ability to perform their role safely must inform Niche Studio immediately.

Smoking¶

• The workplace and such other locations directed by Niche Studio, such as Niche Studio vehicles, are smoke-free workplaces.
• Smoking is not permitted at any time at the workplace unless Niche Studio designates a designated smoking area.

Dress code and hygiene¶

Niche Studio expects staff to attend the workplace in a tidy and presentable manner.

First aid / WHS officer¶

• Niche Studio has a WHS Officer(s) who is accredited in first aid.
• Niche Studio will make first aid kits available and accessible to all staff.
• The First Aid Officer will keep first aid records.

Investigations¶

Niche Studio will thoroughly assess and investigate all hazards and incidents and take all required or recommended follow up actions.

Working from home arrangements¶

Staff may only work from home with prior approval and authority from their supervisor, and must comply with the Working from Home requirements below, including taking all reasonable steps to ensure a safe working environment at home and completing any self-assessment Niche Studio requests.

Injuries¶

• Staff members must immediately report injuries sustained by themselves or others. The first priority is medical attention. The injured staff member or nearest colleague should contact a first aid provider or for serious injury, call an ambulance.
• The injured staff member’s manager must write a report fully detailing the nature of the injury and all surrounding circumstances. The report must be provided to Nathan Mussig (Responsible Person) and included in the relevant WHS register.
• Serious injuries must be reported to the appropriate authorities immediately.
• Niche Studio will support any staff member returning to work from injury.
• If an Employee is injured at work, Niche Studio will follow relevant medical advice and offer suitable duties where possible.
• Niche Studio will collaborate with medical providers to complete suitable duties and graduated return to work plans.

Confidentiality¶

Niche Studio will respect and maintain the confidentiality of any staff member experiencing an illness or injury.

COVID-19¶

• Employees, contractors, visitors, volunteers or third parties experiencing symptoms of COVID-19 or any other significant infectious disease must not attend the workplace premises and must notify their supervisor immediately.
• Staff members who have been exposed to COVID-19 must follow the reasonable and lawful directions of Niche Studio.
• Niche Studio is entitled to implement practices and procedures for managing and monitoring COVID-19.

Schedule of practices and procedures¶

All relevant safe work practice statements or instructions are attached to this policy.

Working from Home¶

Niche Studio acknowledges that working from home arrangements can assist employees achieve a work life balance and manage personal responsibilities.

Niche Studio approval¶

Employees may only work from home with prior authorisation from Niche Studio. Not all roles and occupations will be suited to working from home.

Niche Studio may disapprove or withdraw a request to work from home on reasonable business grounds.

Niche Studio is entitled to withdraw approval to work from home at any time if an Employee breaches this policy or Niche Studio has genuine concerns relating to performance or conduct.

Working from home arrangements will be reviewed regularly to ensure that the arrangement is working for the Employee and Niche Studio and to determine whether any changes need to be made.

Health and safety obligations¶

• Niche Studio is entitled to request an employee complete a home-work environment self-assessment prior to approving a request to work from home. Such assessment may consider the suitability of furniture, ergonomic equipment, lighting, electrical safety and emergency exits.
• Niche Studio is entitled to request a proper or external workplace health and safety assessment of an employee’s home-work environment.
• Unless Niche Studio directs or requires an employee to work from home or unless otherwise agreed, Niche Studio will not cover the cost of any facilities, utilities or equipment required to support an employee working from home.

Employee obligations¶

When working from home, employees must:

• Maintain a safe working environment in accordance with any approved employer or self-assessment.
• Take reasonable care for their own health and safety.
• Work diligently and fulfil all duties and expectations.
• Be contactable during office hours via phone and email.
• Continue to follow the Work Health and Safety requirements and any instructions issued by Niche Studio.
• Take reasonable care of all Niche Studio equipment and assets and ensure such items are kept in a secure location.
• Comply with the Niche Studio IT policies and procedures, including the Acceptable Use of End-user Computing and Access requirements.
• Use secure wi-fi.
• Follow any reasonable and lawful directions of Niche Studio.
• Report all injuries or incidents.
• Complete all working from home training or education modules offered by Niche Studio.
• Participate in all staff meetings remotely.
• Notify Niche Studio as soon as possible if unable to work due to injury or illness.
• Ensure that appropriate care arrangements are in place for any dependents.

Tasks not permitted from home¶

Without prior consent or approval of Niche Studio, the employee must not:

• Hold face to face meetings with clients;
• Work in locations or in a manner not approved by Niche Studio;
• Take Niche Studio documents or information to locations other than the work premises or the approved home-work environment.

Communication¶

If an Employee has any issues or concerns about their working from home arrangement, they should raise this with Nathan Mussig (HR) or the partners to allow for the situation to be reviewed.

Non-Compliance Investigation and Sanctions¶

Workforce members shall report non-compliance of Niche Studio’s policies and procedures to the Security Officer or other individual as assigned by the Security Officer. Individuals that report violations in good faith may not be subjected to intimidation, threats, coercion, discrimination against, or any other retaliatory action as a consequence.

1. The Security Officer promptly facilitates a thorough investigation of all reported violations of Niche Studio’s security policies and procedures. The Security Officer may request the assistance from others.

   • Complete an audit trail/log to identify and verify the violation and sequence of events.
   • Interview any individual that may be aware of or involved in the incident.
   • All individuals are required to cooperate with the investigation process and provide factual information to those conducting the investigation.
   • Provide individuals suspected of non-compliance of the Security rule and/or Niche Studio’s policies and procedures the opportunity to explain their actions.
   • The investigator thoroughly documents the investigation as the investigation occurs. This documentation must include a list of all employees involved in the violation.

2. Violation of any security policy or procedure by workforce members may result in corrective disciplinary action, up to and including termination of employment. Violation of this policy and procedures by others, including business associates, customers, and partners may result in termination of the relationship and/or associated privileges. Violation may also result in civil and criminal penalties as determined by federal and state laws and regulations.

   • A fair disciplinary process will be utilized for employees are suspected of committing breaches of security. Multiple factors will be considered when deciding the response such as whether or not this was a first offense, training, business contracts, etc.
   • Niche Studio reserves the right to terminate employees in the case of serious cases of misconduct.
   • A violation resulting in a breach of confidentiality (i.e. release of sensitive data to an unauthorized individual), change of the data integrity, or inability to access data by other users, requires immediate termination of the workforce member from Niche Studio.

3. The Security Officer facilitates taking appropriate steps to prevent recurrence of the violation (when possible and feasible).

4. In the case of an insider threat, the Security Officer and Privacy Officer are to set up a team to investigate and mitigate the risk of insider malicious activity. Niche Studio workforce members are encouraged to come forward with information about insider threats, and can do so anonymously.

5. The Security Officer maintains all documentation of the investigation, sanctions provided, and actions taken to prevent reoccurrence for a minimum of seven years after the conclusion of the investigation.

6. When the Security Officer identifies a violation and begins a formal sanction process, they will notify the appropriate management or supervisors within 24 hours. That notification will include 1) identifying the individual sanctioned, 2) the reason for the sanction, and 3) specific procedures for service or account restriction / revocation or other disciplinary actions as required.

Warning Notice Template