11. Personnel Security

11.1 Glesys ensures that it maintains sufficient cybersecurity competence within its organisation and that expectations are set for secure behaviour and adherence to applicable internal guidelines and procedure, supported by governance and accountability within the IMS.

11.2 The competence is proportionate to the Services provided and the associated risks, and Glesys ensures that its employees and direct suppliers and service providers, as applicable and relevant, understand and commit to their security responsibilities, as appropriate for the services and work to be performed, and in line with Glesys' applicable policies on information security, including but not limited to:

a) defined roles and accountability for security activities and compliance obligations;

b) dedicated training for individuals with leading positions within the company on cybersecurity governance and the obligations arising under the Cyber Security Rules;

c) background verification of employees and, as applicable, consultants, to the extent required by their roles and responsibilities and as permitted under applicable law, including data protection legislation, and as proportionate in relation to the classification of the assets and systems to which the individual will have access; and

d) procedures for termination or change of employment, ensuring that relevant network and information system security responsibilities and duties of such employees remain valid, e.g. continued confidentiality obligations.

11.3 Glesys personnel, including, as applicable, consultants, are expected to follow documented guidelines and report incidents and deviations through established processes. In the unlikely event of a breach of its network and information security policies, Glesys has established a formal disciplinary procedure, communicated to all personnel, for addressing any such breach. The procedure takes into account applicable legal requirements and is reviewed and updated as necessary to reflect changes in the regulatory or operational environment.