Our information security policy: transparency in a secure environment.

The Information Security Management System at terranets bw is based on the following principles:

1. We protect terranets bw's valuable and confidential information and that of our business partners from unauthorised access across all communication interfaces ("confidentiality").

2. We protect information from unauthorised changes ("integrity").

3. We ensure access to current and necessary information as well as to supporting procedures and systems ("availability").

4. We maintain reliable and continuous operation.

5. We comply with legal and contractual requirements, in particular with the IT Security Catalogue pursuant to Article 11 (1 a) of the Energy Industry Act (EnWG).

6. Based on annual objective programmes, we have implemented a continuous and sustainable improvement process with identification, evaluation and management of existing information security risks.

7. Within the framework of the ISMS, all company values are considered, especially in the application field "Network Services". Company values include for example business processes, information, documents and technologies or infrastructure (control systems, information and telecommunications technology, networks, etc.) as well as company locations and employees.

8. Our ISMS contributes to protecting ourselves from potential threats to our company values by using technical and organisational measures in an appropriate and economically viable way.

9. Each one of us treats the information put at our disposal with care. We report any possible threats or weak spots directly to the named places and thus contribute to continuously improving our ISMS.

All managers are directy responsible for implementing and complying with the principles of information security and the applicable documents of the ISMS manual within their organisational units.

Every employee is responsible for complying with the principles of information security. The ISMS manual along with all other complementary guidelines, procedural instructions and process descriptions are binding for employees and managers and serve to ensure that the information security requirements are continually fulfilled.

The regulations are therefore to be observed at all times. Should this not be possible in justified cases, a security incident is to be reported to the information security officer including the grounds for non-compliance in accordance with the process "Dealing with Security Incidents". This process serves to initiate the continuous improvement process.

Non-compliance with information security regulations may lead to disciplinary steps under labour law.