Information Security and Quality Policy Statement

1. Management statement and commitment

The management of ARLE recognises that information security and quality are essential to the trust of our clients, suppliers, government agencies and employees, and to the reliability of our products and services.

As a specialised supplier of advanced solutions for defence, law enforcement and private security, we process, among other things:

• Operationally sensitive information
• Contractual and procurement documentation
• Technical specifications
• Export-controlled information
• Commercially confidential data
• Personal data

Management is committed to structurally protecting the confidentiality, integrity and availability of information through an Information Security Management System (ISMS) in accordance with ISO 27001. In addition, management is committed to delivering products and services that meet agreed customer requirements, applicable laws and regulations and established quality requirements, with ISO 9001 as the reference framework for quality management.

Information security and quality are integral parts of ARLE’s business operations.

2. Management systems for information security and quality

ARLE maintains an Information Security Management System (ISMS) and aims for systematic control of quality. This approach:

• Systematically identifies and assesses risks
• Implements appropriate controls
• Ensures compliance with laws and regulations
• Measures and monitors performance, customer satisfaction and process quality
• Is focused on continuous improvement

The ISMS provides the framework for information security objectives. For quality, ARLE sets measurable objectives focused on customer satisfaction, process control, conformity of products and services, and continuous improvement.

This policy applies to all employees, directors, contractors and relevant external parties.

3. Legal and regulatory compliance

ARLE is committed to complying with applicable national and international laws and regulations and with relevant contractual and customer requirements, including:

• GDPR
• Relevant Dutch and Belgian defence and export-control regulations
• Contractual security obligations towards government agencies
• Applicable ISO 27001 requirements and, for quality management, relevant ISO 9001 principles
• ABRO legislation (Dutch defence-industry security requirements)

Where contractual or legal requirements go beyond internal standards, these external obligations prevail.

4. Risk management

ARLE takes a risk-based approach to information security and quality. This means that:

• Risk assessments are carried out periodically
• Threats, vulnerabilities and impact are assessed
• Appropriate technical and organisational measures are determined
• Residual risks are explicitly accepted or mitigated

Controls are matched to the nature of the information, the quality requirements for products and services, and the defence-related context in which ARLE operates.

5. Roles and responsibilities

Management bears ultimate responsibility for information security and quality and provides appropriate resources and objectives for them.

Operational responsibility for the information security policy lies with the Data Protection Officer, in close cooperation with ICT, HR and operational processes. Management also assigns responsibilities for quality policy, quality objectives and process control to the relevant roles.

Tasks, responsibilities and authorities for information security and quality are formally documented and clearly communicated.

Every employee is responsible for information security and quality within their own sphere of influence and follows the applicable policies, work instructions and procedures.

6. Incident and complaint management

Security incidents, nonconformities in products or processes, and complaints are reported and handled according to the applicable internal procedures.

Incidents, nonconformities and complaints are:

• Registered
• Analysed
• Assessed for impact
• Followed up with corrective and preventive measures

The aim of incident, nonconformity and complaint management is recovery, preventing recurrence, and structural improvement of information security, product quality and service.

7. Awareness and training

ARLE ensures appropriate awareness and training in information security and quality.

Employees are informed, as appropriate to their role, about:

• Applicable security measures and quality requirements
• Safe handling of sensitive information and compliance with quality instructions
• Reporting procedures for incidents, nonconformities and complaints
• Relevant legal obligations

8. Continuous improvement

Through internal audits, management reviews, customer feedback and periodic assessment, ARLE monitors:

• The effectiveness of information security and quality measures
• Compliance with policy, process agreements and applicable requirements
• Achievement of information security and quality objectives

Based on these evaluations, improvement measures are determined and implemented.

Information security and quality are continuously evaluated and improved.

9. Closing statement

With this policy statement, the management of ARLE confirms its structural commitment to information security and quality: protecting information, meeting customer and legal requirements, controlling and improving processes, and delivering reliable, secure and high-quality products and services within a regulated and security-critical environment.

On behalf of management, Quality Management and the DPO.