6.1. Assets Inventory:
6.1.1. Information security officer shall ensure having an up to date inventory of information systems
such as, software, servers, appliances, devices, tools, tokens, communication links, which are in
use in Everlast Wellness Medical Center The inventory shall also highlight the information
systems that were de-commissioned.
6.1.2. Access to the information systems inventory shall be restricted to information security officer,
Quality Manager (if any) and the Managing Director and shall be shared strictly on a need to know basis.
6.1.3. All IT assets must be assigned with owner/custodian who must maintain perpetual inventory
control, a record of the new location and new equipment custodian of all equipment issued to
others.

6.2. Capacity Management:
6.2.1. Information security officer shall ensure the availability of adequate capacity of IT resources to
deliver the required IT services pertaining to their areas of operations.
6.2.2. Information security officer shall conduct forecasting reviews to anticipate future needs of IT
requirements for delivering the IT services in alignment with the strategic direction of Everlast
Wellness Medical Center and upcoming projects and initiatives. These capacity requirements shall
be documented as IT capacity plans.
6.2.3. Information security officer shall continuously monitor, analyze and evaluate the performance and
capacity of all IT infrastructure and services, to ensure that no excessive systems resources are
consumed and there is no significantly degrading systems response time.

6.3. Change Management:
6.3.1. Changes to IT infrastructure shall be carried out in compliance with the Everlast Wellness
Medical Center Change Management Procedures
6.3.2. Change Management provides a process to apply changes, upgrades, or modifications to the
environment. This covers any and all changes to hardware, software or applications. It also
includes modifications, additions or changes to the LAN/WAN, Network or Server hardware and
software, or any other environmental components such as Medical Devices or Equipment. The
policy is in place to ensure that any change that affects one or all the environments that relies on
to conduct normal business operations are protected. Everlast Wellness Medical Center
Information Technology Information Security Officer designated staff will follow Change
Management Process defined in Change Management Policy

6.4. Antivirus Management/Protection:
6.4.1. Information security officer shall ensure that Antivirus software is installed on all information
systems connected to Everlast Wellness Medical Center network.
6.4.2. Everlast will ensure that detection, prevention and recovery controls to protect against malware
have been implemented. Controls against malicious code include but not limited to:
6.4.2.1. a strict prohibition on the use of unauthorized software
6.4.2.2. our operating systems are updated promptly when updates which affect robustness
against malicious code are issue
6.4.2.3. up-to-date malicious code detection and repair software where available – the checks
against malicious code that this software carries out include: • checking any files on
electronic or optical media, and files received over networks before use • checking
electronic mail attachments and downloads for malicious code before use • checking web
pages for malicious code • Gateway Level Protection

6.5. Backup Management:
6.5.1. Backup requirements shall be identified for all information systems connected to Everlast Wellness
Medical Center corporate network.
6.5.2. Backup of information/data shall be performed as per the backup and archival requirements identified by the information security officer

6.6. Clock Synchronization:
6.6.1. All systems clocks shall be synchronized using Network Time Protocol (NTP) to ensure the
accuracy of audit logs.
6.6.2. Users shall be restricted from changing the systems time.

6.7. Patch Management:
6.7.1. Information security officer shall ensure that all information systems have the latest stable security
patches installed to mitigate the risks associated with vulnerabilities that may exist in the currently
installed versions. This includes all servers, desktops, laptops, applications, databases, medical
devices, network devices, security devices and other IT systems etc.
6.7.2. Prior to deployment of patches in information systems, patches shall be validated and tested
including security patches and system upgrade patches.
6.7.3. Information security officer shall ensure that a roll-back plan is identified before deploying any
patch.
6.7.4. Timelines for patch implementation shall be defined and agreed with the respective information
Systems Owners and business owners.
6.7.5. Information security officer shall keep record of the current level of patches deployed with respect
to the information systems. The patch management shall be performed in compliance with the
Entity Patch Management Procedures

6.8. Wireless Network Security:
6.8.1. The management and maintenance of Wireless Infrastructure management shall be carried out by
The information security officer in coordination with Third Party I.T Service contractor (if any)
6.8.2. The information security officer shall liaise with Third Party I.T Service contractor (if any) to be
responsible of configuring the wireless infrastructure as per the Entity Wireless security policy.

6.9. Remote Access Security:
6.9.1. Provision of remote access shall be provided based on the need to know and need to use basis
and after necessary approval.
6.9.2. System administrators or clinic manager with admin rights shall only grant remote access to
authorized personnel as per the Entity Remote Access Policy.
6.9.3. Remote access shall only be done in an attended session approach NOT (Unattended)
6.9.4. System administrators or clinic manager with admin rights shall configure remote access in
alignment with the Entity Remote Access Policy.

6.10.Back-Up Management
6.10.1. Everlast IT have implemented backup procedures to ensure that backup copies of information,
software and system images are taken and tested to ensure that all essential information and
software can be recovered following a disaster or media failure. Documents will be archived as per
business and legal requirements. Everlast will follow the Back-up and retention Policy
(EVERLAST/ADM/ITD/P&P/006)

6.11.Information Systems Security:
6.11.1. All default accounts of information systems shall be renamed (where possible) and the default
passwords shall be changed.
6.11.2. System administrators or clinic manager with admin rights shall have unique administration
accounts separate from the normal accounts that are used for activities not related to systems
administration.
6.11.3. Minimum and only required administrative privileges shall be assigned to admin accounts to carry
out the required administration tasks.
6.11.4. Passwords of all High privilege accounts’ such as administrator, root etc. shall be set with at least
10 characters and complexity as per the Entity Password Policy.
6.11.5. Information security officer shall be responsible to verify the usage of information systems high
privilege accounts once in every three months.
6.11.6. System administrators or clinic manager with admin rights shall not change privileges to any
account without proper authorization and approvals as per the Entity Access Control Policy.
6.11.7. Any change in the configuration of information systems shall be done as per the Entity change
management procedure where proper approval is obtained.
6.11.8. System administrators or clinic manager with admin rights of Domain controllers shall not change,
create or delete group policies without getting proper authorization and approvals.
6.11.9. System administrators or clinic manager with admin rights shall harden the information systems
as per the approved minimum-security baseline requirements

6.12.Security Assessment and Vulnerability Management:
6.12.1. Information security officer is responsible for conducting periodic vulnerability assessments and
penetration tests on the IT management.
6.12.2. Third party I.T Service contractor or (I.T in house at the time) shall facilitate information security
officer efforts when conducting a vulnerability assessment or a penetration testing exercise.
6.12.3. Third party I.T Service contractor or (I.T in house at the time) shall address the vulnerabilities
identified through the security assessments in coordination with information security officer
6.12.4. Third party I.T Service contractor or (I.T in house at the time) shall have minimum security baseline
(hardening) documents for all critical IT information systems such as servers operating systems,
applications, databases, network and security devices etc.,
6.12.5. The security baseline documents shall be updated periodically to address the latest vulnerabilities.
6.12.6. The information security officer shall review and sign-off on the baseline documents.
6.12.7. System administrators or clinic manager with admin rights shall implement the applicable security
baseline documents on all IT information systems prior to deployment.
6.12.8. System administrators or clinic manager with admin rights shall also ensure that the information
systems under their responsibility conform to these baselines requirements on an ongoing basis

6.13.General Usage
6.13.1. All electronic communication resources provided by Everlast Wellness Medical Center shall be
used for official purpose only.
6.13.2. Users shall refrain from using the official electronic communication resources for personal
communications/correspondences.
6.13.3. All official electronic communication correspondences, unless otherwise specified, shall be
treated as Restricted
6.13.4. All electronic communication correspondences must be properly addressed to the intended
recipient.
6.13.5. All Users shall be held responsible for any misuse of electronic communication correspondences
from their accounts, if proven to be as an intentional act from the User.
6.13.6. Users shall refrain from initiating or participating in any electronic communication or newsletters
not related to the job duties, such as forwarding chain emails whether commercial or with personal
amusement and entertainment content
6.13.7. Using the email to send or forward large attachments containing graphics/objects/video files that
can result in disruption of email services is prohibited.
6.13.8. Users shall make use of authorized file sharing tools, such as file servers or document
management tools, provided by Everlast to share huge official attachments.
6.13.9. Users shall refrain from sending information, software, files or attachments that are illegal or
unauthorized, or include any defamatory, offensive, racist or obscene remarks.
6.13.10. Users shall refrain from accessing or using any electronic communication account of other Users,
unless it is authorized/delegated by the account owner with proper business justification and this
shall be requested from and processed formally by the responsible unit in Everlast and without
sharing the password of the account.
6.13.11. Users shall refrain from using personal emails for official communications/correspondences.
6.13.12. Users shall be responsible for the protection of any local copy of mailboxes stored in their laptop
or desktop.
6.13.13. Users shall promptly report any kind of security incidents on the electronic communication
resources as per the Everlast Information Security Incident Management Process
6.13.14. Users shall refrain from configuring automatic forwarding of official emails to non-Everlast hosted
email system.
6.13.15. official email distribution lists or group mailing lists (where appropriate) shall be created in
coordination with responsible section/team of electronic communication systems.