1. Introduction & Purpose

This Mobile App Security Policy (the "Policy") establishes the standards, guidelines, and procedures for the secure development, deployment, and maintenance of all mobile applications (apps) developed, used, or managed by Nexly Corporation ("Nexly" or the "Company"). Located at 701 South Street Suite 100, Mountain Home, AR 72653, Nexly recognizes the increasing reliance on mobile applications for business operations, customer interactions, and employee productivity. This Policy is designed to:

• Protect Sensitive Data: Ensure the confidentiality, integrity, and availability of sensitive data accessed, processed, or stored by mobile applications.
• Prevent Unauthorized Access: Protect mobile applications and the data they access from unauthorized access and use.
• Minimize Security Risks: Minimize the risks associated with mobile app development, deployment, and use, including malware, data breaches, and other security threats.
• Ensure Regulatory Compliance: Comply with all applicable laws, regulations, and industry standards related to mobile app security and data privacy (e.g., GDPR, CCPA).
• Promote Secure Development Practices: Encourage secure coding practices and development methodologies.
• Establish Clear Responsibilities: Define the roles and responsibilities of all Nexly employees, contractors, and other individuals involved in mobile app development, deployment, and use.
• Provide Guidelines and Procedures: Provide clear guidelines and procedures for mobile app security.

This Policy applies to all mobile applications developed, used, or managed by Nexly, regardless of whether the applications are developed internally, by third-party vendors, or are commercially available. This includes mobile applications used by employees, customers, partners, and the public. This Policy is to be read in conjunction with other Company policies, including, but not limited to, the Information Security Policy, the Data Privacy Policy, the Acceptable Use Policy, and the Mobile Device Management (MDM) Policy (if applicable).

2. Definitions

For the purposes of this Policy, the following definitions apply:

• Mobile Application (App): A software program designed to run on mobile devices, such as smartphones and tablets. This includes native apps, web apps, and hybrid apps.
• Mobile Device: A portable computing device, such as a smartphone or tablet, used to access Company systems or data.
• Sensitive Data: Any data that requires a higher level of protection due to its sensitivity or potential impact if disclosed. This includes, but is not limited to, Personally Identifiable Information (PII), financial data, health information, and confidential business information.
• Mobile Device Management (MDM): A technology that allows IT departments to remotely manage, secure, and monitor mobile devices.
• Software Development Lifecycle (SDLC): The process of planning, creating, testing, and deploying software applications.
• Secure Coding Practices: Software development practices that aim to prevent security vulnerabilities.
• Vulnerability: A weakness in a system or application that could be exploited to compromise security.
• Penetration Testing: A simulated attack on a system or application to identify vulnerabilities.
• Mobile Application Security Testing (MAST): The process of testing mobile applications to identify security vulnerabilities.
• Two-Factor Authentication (2FA): A security process requiring users to provide two means of identification.

3. Roles & Responsibilities

Effective mobile app security requires clearly defined roles and responsibilities across the organization:

• 3.1. Board of Directors:
  • Oversees the Company's mobile app security program.
  • Approves the Mobile App Security Policy and reviews its effectiveness.
  • Monitors the Company's significant mobile app security risks and the effectiveness of risk mitigation activities.
• 3.2. Chief Information Officer (CIO):
  • Provides overall leadership and direction for the Company's mobile app security program.
  • Ensures that the Mobile App Security Policy is implemented and enforced.
  • Oversees the Company's mobile app security testing and vulnerability management programs.
• 3.3. Information Security Department:
  • Develops, implements, and maintains the Mobile App Security Policy.
  • Establishes and maintains the mobile app security standards and best practices.
  • Conducts mobile app security assessments and testing.
  • Manages the Company's mobile app vulnerability management program.
  • Provides training and guidance on mobile app security to developers and other relevant personnel.
  • Oversees the implementation of Mobile Device Management (MDM) solutions.
  • Investigates and responds to mobile app security incidents.
• 3.4. Head of Development / Engineering (or equivalent):
  • Oversees the development and deployment of mobile applications.
  • Ensures that all mobile applications are developed in accordance with the Mobile App Security Policy and secure coding practices.
  • Integrates security testing and vulnerability assessments into the Software Development Lifecycle (SDLC).
  • Manages the mobile app release process.
• 3.5. Developers & Development Teams:
  • Develop and maintain mobile applications in accordance with the Mobile App Security Policy, secure coding practices, and all applicable security standards.
  • Participate in mobile app security training.
  • Conduct unit testing and integration testing.
  • Remediate identified security vulnerabilities.
• 3.6. Quality Assurance (QA) Testers:
  • Perform mobile app security testing, including functional, security, and performance testing.
  • Identify and report security vulnerabilities.
• 3.7. IT Department:
  • Manages the Company's mobile devices and mobile device management (MDM) solution (if applicable).
  • Ensures that mobile devices are configured securely.
  • Provides technical support for mobile applications.
• 3.8. Data Privacy Officer (DPO) (or equivalent):
  • Ensures that mobile applications comply with all applicable data privacy laws and regulations.
  • Conducts privacy impact assessments (PIAs) for mobile applications.
  • Provides guidance on data privacy best practices for mobile app development and use.
• 3.9. All Employees:
  • Comply with the Mobile App Security Policy and all other relevant Company policies.
  • Report any suspected mobile app security vulnerabilities or incidents to the Information Security Department.
  • Follow the security guidelines and best practices provided for using mobile applications.
  • Only install and use approved mobile applications on Company-owned devices.
  • Protect access to Company data.

4. Secure Mobile App Development Standards

Nexly Corporation will implement the following secure mobile app development standards throughout the Software Development Lifecycle (SDLC):

• 4.1. Secure Coding Practices:
  • OWASP Guidelines: Follow the guidelines and best practices provided by the Open Web Application Security Project (OWASP) for mobile app security.
  • Input Validation: Validate all user inputs to prevent injection attacks and other vulnerabilities.
  • Secure Authentication and Authorization: Implement secure authentication and authorization mechanisms, including strong password policies, two-factor authentication (2FA) for sensitive applications, and role-based access control.
  • Secure Data Storage: Securely store all sensitive data on mobile devices, using encryption and other appropriate security measures.
  • Secure Data Transmission: Use secure communication channels, such as HTTPS, to transmit data between the mobile app and backend servers.
  • Session Management: Implement secure session management practices to prevent session hijacking.
  • Error Handling: Implement appropriate error handling and logging mechanisms to prevent information leakage. Do not display technical details to the user.
  • Code Reviews: Conduct code reviews to identify and address security vulnerabilities.
  • Regular Updates: Keep all software libraries and frameworks up-to-date with the latest security patches.
• 4.2. Secure Design and Architecture:
  • Security by Design: Incorporate security considerations into the design and architecture of mobile applications.
  • Least Privilege Principle: Implement the principle of least privilege, granting users only the minimum necessary access to data and resources.
  • Secure API Integration: Securely integrate mobile applications with APIs, using appropriate authentication and authorization mechanisms.
  • Secure Storage: Consider security and efficiency requirements for any data that must be stored locally on the device. Use secure data storage mechanisms provided by the OS.
  • Platform Security Features: Ensure you are using the security features of the mobile platform to protect sensitive information.
• 4.3. Secure Development Lifecycle (SDLC):
  • Security Requirements: Clearly define security requirements at the beginning of the SDLC.
  • Threat Modeling: Conduct threat modeling to identify potential security threats and vulnerabilities.
  • Secure Coding Training: Provide secure coding training to developers.
  • Code Analysis Tools: Use static and dynamic code analysis tools to identify and address security vulnerabilities.
  • Security Testing Throughout the SDLC: Integrate security testing throughout the SDLC process, including unit testing, integration testing, and penetration testing.
• 4.4. Third-Party Library and API Security:
  • Vulnerability Assessment: Evaluate all third-party libraries and APIs for known vulnerabilities.
  • Secure Usage: Follow all best practices in securing any APIs used in the applications, including key management.
  • Regular Updates: Keep third-party libraries and APIs up-to-date with the latest security patches and updates.
  • License Compliance: Verify and ensure compliance with the licenses of any third-party libraries used.

5. Mobile App Security Testing & Deployment

Nexly Corporation will conduct thorough security testing of all mobile applications before they are deployed.

• 5.1. Security Testing:
  • Mobile Application Security Testing (MAST): Conduct MAST to identify and address security vulnerabilities. MAST will include:
    • Static Analysis: Analyzing the application's source code to identify vulnerabilities.
    • Dynamic Analysis: Testing the application while it is running to identify vulnerabilities.
    • Penetration Testing: Simulating a real-world attack to assess the application's security.
    • Vulnerability Scanning: Scanning the application for known vulnerabilities.
  • Testing Tools: Utilizing industry-standard security testing tools to identify and address vulnerabilities.
  • Test Environments: Conducting security testing in a separate, secure test environment.
  • Automated Testing: Implement automated security testing where possible.
  • Compliance Checks: Check app complies with all relevant standards.
  • Review by the Information Security Department: Any applications will be reviewed and approved by the Information Security Department before production deployment.
• 5.2. Deployment & Distribution:
  • Approved App Stores: Only deploying mobile applications through approved app stores (e.g., Apple App Store, Google Play Store) or, in the case of internal apps, through a secure and controlled internal distribution mechanism.
  • Code Signing: Using code signing to verify the authenticity and integrity of the application.
  • Secure Configuration: Configuring mobile applications securely, including disabling debugging features and implementing appropriate security settings.
  • Encryption: Using transport layer security (TLS) to encrypt all communications between the mobile app and backend services.
  • Regular Updates: Regularly updating mobile applications with the latest security patches and updates.
• 5.3. Post-Deployment Monitoring:
  • Real-time Monitoring: Monitoring the performance and security of deployed mobile applications.
  • Vulnerability Monitoring: Performing ongoing vulnerability scans for existing apps and all new apps before deployment.
  • Incident Response: Establishing procedures for responding to security incidents.
  • User Feedback: Collecting and responding to user feedback.

6. Mobile Device Security and Management

Nexly Corporation will implement mobile device security and management (MDM) measures to protect Company-owned mobile devices.

• 6.1. Mobile Device Management (MDM): Implement a Mobile Device Management (MDM) solution, where applicable, to:
  • Secure Device Configuration: Configure mobile devices securely, including enforcing strong passwords, enabling encryption, and disabling unnecessary features.
  • Remote Management: Remotely manage, secure, and monitor mobile devices.
  • Application Control: Control which applications are installed and used on mobile devices.
  • Data Loss Prevention: Implement data loss prevention (DLP) measures to prevent data leakage.
  • Remote Wipe: Remotely wipe data from lost or stolen devices.
• 6.2. Security Measures for Mobile Devices: Ensure that all mobile devices meet the following security requirements:
  • Strong Passwords/Biometrics: Require the use of strong passwords or biometric authentication to protect access to mobile devices.
  • Encryption: Enable device-level encryption to protect data stored on mobile devices.
  • Automatic Lockout: Configure devices to automatically lock after a period of inactivity.
  • Regular Updates: Keep the operating system and all applications up-to-date with the latest security patches.
  • Secure Wi-Fi: Use secure Wi-Fi networks and avoid connecting to public Wi-Fi networks.
  • Bluetooth Security: Disable Bluetooth when not in use, or use a secure Bluetooth configuration.
  • Location Services Security: Disable location services for applications that do not require them and regularly review location data and privacy settings.
• 6.3. Use of Personal Devices: If employees are permitted to use personal mobile devices to access Company data or systems (BYOD - Bring Your Own Device):
  • MDM Enrollment: Devices must be enrolled in the Company's MDM solution.
  • Compliance with Policy: Personal devices must meet the same security requirements as Company-owned devices.
  • Separate Work and Personal Data: Implement measures to segregate work data from personal data on personal devices.

7. Incident Response and Remediation

Nexly Corporation will have established procedures for responding to mobile app security incidents.

• 7.1. Incident Reporting: All suspected or confirmed mobile app security incidents must be reported immediately to the Information Security Department.
  • Incident Report: Provide detailed information regarding the incident.
• 7.2. Incident Investigation: The Information Security Department will investigate all reported incidents to determine the cause, scope, and impact.
• 7.3. Containment, Eradication and Recovery:
  • Containment: Take steps to contain the incident, such as disabling the affected application or revoking access to Company systems.
  • Eradication: Identify and eliminate the root cause of the incident.
  • Recovery: Restore affected systems and data from backups, and/or take necessary actions.
• 7.4. Remediation and Mitigation:
  • Corrective Actions: Implement corrective actions to prevent future incidents, which may include patching vulnerabilities, strengthening security controls, and updating security policies.
  • Communications: Notify any affected users or stakeholders, as required.
  • Documentation: Document the incident, investigation, and corrective actions.
  • Post-Incident Review: Conduct a post-incident review to identify lessons learned.

8. Policy Compliance and Enforcement

Compliance with this Mobile App Security Policy is mandatory for all Covered Parties.

• 8.1. Employee Responsibility: All employees, contractors, and vendors are responsible for:
  • Adhering to the requirements of this Policy.
  • Complying with all applicable security standards and best practices.
  • Reporting any suspected security vulnerabilities or incidents to the Information Security Department.
• 8.2. Enforcement: Failure to comply with this Policy may result in:
  • Disciplinary action, up to and including termination of employment or contract.
  • Legal action.
• 8.3. Vendor Compliance: All third-party vendors must comply with the relevant portions of this Policy. Contracts with vendors will include provisions for ensuring compliance and consequences for non-compliance.

9. Training and Awareness

Nexly Corporation is committed to providing employees with training and awareness programs to ensure they understand their responsibilities under this Mobile App Security Policy.

• 9.1. Mandatory Training: All employees will be required to complete training on the Mobile App Security Policy and related security topics.
  • Training Frequency: Training will be provided [Specify Frequency, e.g., annually] or more frequently as needed.
  • Content: Training will cover the key principles of this Policy.
• 9.2. Role-Based Training: Employees with specific responsibilities related to mobile app security (e.g., developers, QA testers, IT staff) will receive specialized training.
• 9.3. Ongoing Awareness: The Information Security Department will conduct ongoing awareness campaigns to reinforce the importance of mobile app security.

10. Policy Review & Amendments

This Mobile App Security Policy will be reviewed and updated regularly to ensure its continued effectiveness and compliance with all applicable laws, regulations, and industry best practices.

• Review Frequency: This Policy will be reviewed at least [Specify Frequency, e.g., annually] or more frequently as needed, such as in response to changes in the mobile app landscape, the Company's business operations, or the regulatory environment.
• Review Process: The review process will involve:
  • Input from Stakeholders: Seeking input from relevant stakeholders, including the Information Security Department, Legal Counsel, the Head of Development, and other key personnel.
  • Reviewing Benchmarks: Looking at industry best practices and the policies of similar companies.
  • Legal and Regulatory Review: Ensuring that the Policy complies with all applicable laws, regulations, and industry standards.
  • Vulnerability Assessments: Analyze any security breaches to determine if the policy needs to be updated.
• Policy Amendments and Communication: Any amendments to this Policy will be approved by [Specify Approving Authority, e.g., the Board of Directors or the Executive Leadership Team] and communicated to all Covered Parties through [Specify Communication Channels, e.g., company-wide email, intranet posting, training sessions]. All employees are responsible for being aware of and adhering to any changes.
• Policy Ownership: The Information Security Department, with support from Legal Counsel, is responsible for maintaining and updating this Policy.

**Acknowledgement:** By using mobile applications and Company resources, all employees, contractors, and vendors are deemed to acknowledge that they have read, understood, and agree to abide by the terms and conditions outlined in this Mobile App Security Policy.