REMOTE ACCESS POLICY

1. OBJECTIVES

1.1 To establish guidelines specifically pertaining to remote access to MBB’s internal network. Preventing
unauthorized access to company data from insecure networks is of utmost importance to MBB.

1.2 This policy is designed to ensure authorized Managers can securely connect without fear of threat and to
provide the Company with an additional means of monitoring and controlling access to the internal
network.

2. SCOPE

2.1. This policy applies to Managers and IT personnel who do the network monitoring and documentations.

3. POLICY STATEMENT

3.1 Authorized users must protect their login credentials and must not share them with anyone for any reason.

3.2 All inbound connections to MBB’s internal networks must pass through an access control point before the
user can reach a login banner.

3.3 Remote users must be required to authenticate before being granted access to company information.

3.4 Remote access must be logged in a central database and kept for a period of at least 30 days. Access logs
must be reviewed regularly.

3.5 Secure remote access must be strictly controlled with encryption and strong pass-phrases.

3.6 Authorized Users shall protect their login and password.

3.7 While using a company-owned computer to remotely connect to MBB's corporate network, Authorized
Users shall ensure the remote host is not connected to any other network at the same time.

4. REVIEW AND MODIFICATION

4.1. This policy shall be reviewed once a year or as deemed necessary by the document owner or as dictated
by the relevance of this policy to changes in business requirements.

4.2. All other existing policy, guidelines, and procedures contrary to or inconsistent with the above provisions
shall be modified accordingly.

4.3. As when conditions warrant, the document owner will modify this policy, its supporting standards,
guidelines, and procedures in order to respond more appropriately to the requirements and needs of the
business.