Information Security Policy and Program

Published Internal Security Framework and Daily Operations Baseline

TikTok Shop | Data Security and Privacy Review
Version 1.0 | Effective 23 July 2026 | Owner: IT and Operations

Control Question

Does your organization have a published information security policy or program? Yes.

Program Statement

NoxInfluencer maintains an effective and mandatory information security program governing risk, assets, data protection, access, endpoints, networks, secure development, service providers, vulnerabilities, incidents, resilience, awareness, exceptions, and assurance. This policy is published internally for operational use and is reviewed at least annually and upon material change.

Evidence Boundary: This document establishes the security framework. Detailed system inventories, configurations, findings, incident files, and access records remain restricted and are maintained separately.

SECTION 1 | GOVERNANCE

Scope, Ownership, and Security Framework

Document ID: NI-SEC-ISP-001

Status: Effective and mandatory

Owner: IT and Operations

Review: Annual and event driven

Purpose and Applicability

This policy provides the organization-wide baseline for protecting information, systems, services, personnel, customers, partners, and TikTok Shop Protected Data against unauthorized access, disclosure, alteration, loss, misuse, or disruption.

Applies to: Employees, contractors, applications, infrastructure, data, devices, facilities, cloud resources, and approved third parties.

Security Objectives

• Confidentiality: information is accessible only to authorized parties.
• Integrity: information and systems remain accurate, complete, and traceable.
• Availability: critical services can operate and recover within approved priorities.
• Privacy: personal data is processed under documented lifecycle controls.
• Accountability: owners, approvals, actions, exceptions, and evidence are recorded.
• Compliance: applicable legal, contractual, and partner obligations are addressed.

Accountability

Management: Approves the framework, resources, priorities, material risk acceptance, and accountability.

IT and Operations: Owns security policies, baseline controls, monitoring, access governance, evidence, and operational response.

Engineering and Service Owners: Protect systems and data throughout design, development, release, operation, change, and retirement.

Privacy and Business Owners: Define approved processing purpose, obligations, data handling, customer commitments, and escalation needs.

Personnel and Contractors: Follow policies, use approved systems, protect credentials, complete required training, and report concerns promptly.

SECTION 2 | RISK AND INFORMATION

Risk, Assets, and Data Protection

Risk Management

• Identify threats, vulnerabilities, likelihood, impact, owners, and existing controls.
• Prioritize treatment according to exposure, criticality, data sensitivity, and business impact.
• Track mitigation, acceptance, avoidance, or transfer decisions to closure.
• Material exceptions require an owner, compensating controls, approval, and expiry.

Asset Management

• Maintain accountable ownership for material systems, data stores, services, devices, and dependencies.
• Apply approved configuration, patching, access, monitoring, backup, and retirement requirements.
• Remove access and securely handle information when assets or services are retired.
• Review material inventory and coverage gaps periodically and upon change.

Data Protection

• Classify information according to confidentiality, integrity, availability, privacy, and contractual impact.
• Collect, access, share, retain, and export only what an approved purpose requires.
• Use secure transport and encryption at rest for covered sensitive records.
• Delete or de-identify information when authorized purpose and required retention end.

Information Handling Baseline

Class, Typical Scope, and Minimum Handling

Public: Approved for public disclosure. Minimum handling: integrity and publication approval; no confidential content.

Internal: Routine business information for authorized personnel. Minimum handling: authenticated access; approved collaboration and storage.

Confidential: Customer, commercial, operational, security, or restricted business data. Minimum handling: need-to-know access, controlled sharing, secure transport and storage.

Restricted: Credentials, authorization tokens, sensitive personal data, secrets, and high-impact security records. Minimum handling: strong encryption, least privilege, MFA where applicable, logging, and tightly controlled export.

SECTION 3 | PREVENTIVE CONTROLS

Identity, Infrastructure, and Endpoint Security

Identity and Access

• Unique accounts, role-based authorization, least privilege, and need-to-know access.
• MFA for privileged cloud administration and other supported high-risk access.
• Manager or owner approval, periodic access review, and prompt revocation on role change or termination.
• Emergency access is exceptional, attributable, time limited, and reviewed after use.
• Credentials, tokens, and secrets must not be shared or stored in ordinary documents or code.

Network and Cloud

• Private network segmentation and restrictive ingress for internal services and data stores.
• Only approved internet-facing services are exposed; unnecessary ports and broad rules are prohibited.
• Administrative paths use authenticated, authorized, and monitored access controls.
• Cloud resources follow approved ownership, configuration, logging, monitoring, and change practices.
• Security-sensitive topology and identifiers are disclosed only on a need-to-know basis.

Endpoint and Workplace

• Company endpoints use supported protection, security updates, screen locking, and approved software.
• Anti-malware and host-security controls remain enabled where supported.
• Personnel protect devices from unauthorized physical access and report loss or compromise promptly.
• Sensitive data must not be copied to unapproved devices, removable media, or personal storage.
• Remote work follows the same confidentiality, access, and device-security baseline.

Cryptography and Secrets

• Official TikTok Shop API exchanges use HTTPS protected by TLS 1.2 or higher.
• Persisted authorization tokens and invitation records are encrypted at rest.
• Keys and secrets are separated from protected data and restricted to approved services or personnel.
• Sensitive values are excluded or redacted from ordinary logs, tickets, screenshots, and collaboration tools.
• If required protection is unavailable, sensitive processing stops rather than using an insecure fallback.

SECTION 4 | SECURE OPERATION

Development, Change, Monitoring, and Providers

Secure Development and Change

• Define security and privacy requirements before material design or integration changes.
• Use source control, peer review, tested changes, controlled deployment, and rollback where feasible.
• Do not place production secrets or unrestricted personal data in source code, test fixtures, or ordinary logs.
• Use sanitized, masked, synthetic, or minimum necessary data in non-production environments.
• Review dependency, permission, exposure, logging, retention, and abuse risks before release.
• Record and approve emergency changes, then conduct timely retrospective review.

Logging and Monitoring

• Monitor material authentication, administrative, application, host, network, and security events where supported.
• Protect logs from unauthorized access and exclude or redact sensitive payloads and secrets.
• Review critical alerts promptly and escalate suspected compromise through incident response.
• Monitor security-agent health, coverage gaps, vulnerabilities, and material service availability.
• Retain relevant operational and security evidence according to legal, contractual, incident, and policy needs.
• Restrict detailed findings and raw evidence to authorized operational or security personnel.

Third-Party and Service-Provider Security

Before use: Assess purpose, data, location, access, security, subcontracting, resilience, incident, return, and deletion requirements.

Contract: Apply appropriate confidentiality, data protection, security, notification, audit, and termination obligations.

Access: Provide only the minimum data, integration permission, and system access required for the approved service.

Monitor: Maintain an accountable owner and review material providers, service changes, incidents, and unresolved risks.

Terminate: Revoke access, recover assets, and require return or deletion of information where applicable and feasible.

SECTION 5 | DETECTION AND RESPONSE

Vulnerabilities, Incidents, and Resilience

Vulnerability and Threat Management

• Use approved monitoring, security alerts, vendor advisories, and supported vulnerability scanning.
• Validate findings and prioritize by severity, exploitability, exposure, asset criticality, and data impact.
• Assign owners and target dates; actively exploited exposure receives immediate containment.
• Verify remediation through rescan, testing, or equivalent evidence before closure.
• Time-limited exceptions require rationale, accountable ownership, compensating controls, approval, and expiry.

Incident Response

• Report suspected compromise, data loss, unauthorized access, misuse, or material disruption immediately.
• Triage, contain, preserve evidence, investigate, eradicate, recover, and validate monitoring.
• Assess affected data, systems, individuals, partners, jurisdictions, duration, and likely impact.
• Coordinate required TikTok Shop, seller, customer, individual, or regulatory notifications through authorized owners.
• Record timeline, decisions, evidence, communications, corrective actions, and closure approval.

Continuity and Recovery Lifecycle

Prepare: Identify critical services, dependencies, owners, recovery priorities, protected backups, and alternate procedures.

Respond: Protect people and data, stabilize service, communicate status, and activate approved continuity actions.

Restore: Recover from trusted configurations or backups, test function and security, and monitor for recurrence.

Review: Document impact, decisions, recovery evidence, gaps, owners, and corrective actions.

Exercise Evidence: The program requires periodic review and exercise planning. This policy does not represent that a completed independent exercise or penetration-test report is included.

SECTION 6 | ASSURANCE

Publication, Review, and Control Register

Policy Owner Attestation

IT and Operations confirms that this document establishes the current information security framework and daily operations baseline:

• The policy is effective, mandatory, published internally, and available to relevant personnel for operational use.
• Security ownership, risk treatment, asset accountability, data handling, access, infrastructure, endpoints, development, operations, providers, response, and resilience are governed.
• Supporting standards and controlled evidence define detailed requirements without exposing sensitive configurations publicly.
• Personnel must report suspected security events and may not bypass mandatory controls without an approved exception.
• Material risks, exceptions, findings, incidents, and corrective actions are assigned and tracked under accountable ownership.
• The policy is reviewed at least annually and upon material legal, contractual, product, technology, vendor, threat, incident, or data-flow change.

Controlled Disclosure: Detailed inventories, credentials, network topology, raw findings, incidents, access records, recovery materials, and exception files remain access restricted.

Supporting Policy Register

IAM-01: Access and least privilege - Effective

ENC-01: Classification and encryption - Effective

EPP-01: Endpoint protection baseline - Effective

NET-01: Network security controls - Effective

VTM-01: Vulnerability management - Effective

IRBC-01: Incident and continuity - Effective

Document Control

Document ID: NI-SEC-ISP-001

Version: 1.0

Effective: 23 July 2026

Review cycle: At least annually

Next review: By 23 July 2027

PUBLICATION AND CHANGE CONTROL

The owner records approval, publication, review, material changes, and the next review date. Updates are required when the risk environment or applicable obligations materially change. Superseded versions are archived under restricted access, and relevant personnel are informed of material control changes.