Out Sauce Security Due Diligence Pack — For Licensees & Advice Practices

Document Purpose

This pack is prepared for licensees, dealer groups, compliance teams, and large advice practices conducting due diligence on Out Sauce as an outsourced paraplanning provider.

It has been structured to address the questions most commonly asked during vendor security assessments, drawing on standard industry frameworks (ACSC Essential Eight, APRA CPS 234, ISO 27001) and regulatory expectations established by ASIC through recent enforcement actions.

Out Sauce welcomes due diligence. We have invested in building security infrastructure that is designed to withstand scrutiny — not just pass it.

Deployment Status

Out Sauce is currently deploying its security framework through a managed services engagement with Destiny IT, commenced March 2026. Technical controls described in this document are being implemented progressively as part of this rollout. Managed devices are being provisioned to all personnel, and training programs will commence once the deployment is complete. This document reflects Out Sauce's security architecture and commitments — both established controls and those in active deployment.

How This Pack Is Structured

This pack contains Out Sauce's complete security documentation:

• This document — company overview, framework alignment, architecture summary, policy index, data handling, incident response, AI governance, contractor security, insurance, BCP, compliance evidence
• Compliance matrix — point-by-point mapping of Out Sauce controls against leading licensee cyber policy requirements
• Full policy suite — 9-document comprehensive information security policy suite
• Certificates — insurance certificates of currency, ISO 27001 certification

Contact: Out Sauce Operations — clinton@outsauce.au

1. COMPANY OVERVIEW

Why Destiny IT

Out Sauce deliberately chose a specialist IT managed services provider rather than a generalist. Destiny IT specialises in working with financial advice businesses in Australia. They understand the regulatory environment (ASIC, Privacy Act, licensee cyber policies), the data sensitivity (TFNs, health information, financial details), and the specific threat landscape facing financial services. Destiny IT is ISO 27001:2022 certified (Certificate #6686-3757-01, valid to November 2027, certified by Compass Assurance Services under JAS-ANZ accreditation), providing independent assurance of their information security management systems.

2. REGULATORY CONTEXT

Why This Matters Now

ASIC has established through enforcement actions that cybersecurity is a core compliance obligation under s912A of the Corporations Act 2001. Licensees are required to:

• Have effective risk management measures to protect client data from cyber attacks
• Ensure authorised representatives and outsourced providers meet the licensee's cybersecurity standards
• Maintain adequate cybersecurity policies, training, monitoring, and specialist expertise
• Exercise adequate supervision over outsourced service providers' cybersecurity

What this means for you: Working with an outsourced paraplanning provider that cannot demonstrate robust cybersecurity creates regulatory risk for your business and your licensee. Out Sauce's security framework is designed to significantly reduce that risk.

3. SECURITY FRAMEWORK ALIGNMENT

ACSC Essential Eight — Out Sauce Implementation

4. SECURITY ARCHITECTURE

4.1 Technical Controls

4.2 Administrative Controls

5. POLICY SUITE

Full policy documents are included in this submission pack.

6. DATA HANDLING

6.1 Data Classification

6.2 Approved Data Transfer Methods

6.3 Prohibited Practices

• No client data on personal devices, USB, removable media, or personal cloud
• No client data in personal email accounts
• No client data in unapproved AI tools
• No unencrypted transfer of sensitive information
• No duplication of sensitive data (e.g., TFNs) across multiple documents — single-source storage
• No Airdrop/Bluetooth transfer of client data

6.4 Retention & Disposal

• Client files retained 7 years per Corporations Act and licensee requirements
• All data stored in approved systems (approved financial planning software, managed cloud platform)
• Secure destruction after retention period (managed by Destiny IT)
• Contractor data return and certified destruction on termination

7. INCIDENT RESPONSE

8. AI GOVERNANCE

9. CONTRACTOR SECURITY

10. INSURANCE

11. BUSINESS CONTINUITY

12. SUBCONTRACTING & FOURTH-PARTY RISK

13. COMPLIANCE EVIDENCE

14. CYBER POLICY COMPLIANCE

Out Sauce has prepared a point-by-point compliance matrix mapping every mandatory requirement and best practice recommendation from leading licensee cyber policy standards to Out Sauce's specific controls and evidence.

Summary (83 requirements assessed):

• 83 requirements met or exceeded (100%)
• 16 requirements exceeded (Out Sauce goes beyond the minimum)
• 0 items outstanding

The full compliance matrix (OS-CCM-001) is included in this submission pack.

15. CONTACT

Out Sauce Operations Out Sauce Paraplanning (Weekes Financial Pty Ltd) clinton@outsauce.au

Prepared: June 2026 | Version 3.0 This document may be shared with licensees, compliance teams, and prospective clients for due diligence purposes.

Out Sauce — Cyber Policy Compliance Matrix

Purpose: This document maps every mandatory requirement and best practice recommendation from leading licensee cyber policy standards to Out Sauce's specific controls, policies, and evidence. It is designed so that a compliance officer can verify Out Sauce's compliance point by point.

How To Read This Matrix

Each row contains:

• Policy Requirement — the exact requirement or recommendation from the Cyber Policy
• Requirement Type — Mandatory or Recommended/Best Practice
• Out Sauce Control — what Out Sauce does to meet or exceed this requirement
• Evidence Reference — the specific Out Sauce document, system, or certificate that substantiates the control
• Status — Met, Exceeds, Partial, or N/A

1. UPDATES

2. BACKUPS

3. MULTI-FACTOR AUTHENTICATION

4. ACCESS CONTROL

5. PASSWORD CONTROLS

6. EMPLOYEE TRAINING

7. SECURITY VULNERABILITIES

8. ASSET DISPOSAL

9. PRACTICE WEBSITES

10. EMAIL AND DOMAIN SECURITY

11. CLIENT DATA — TYPES & TRANSFER

12. RETENTION OF CLIENT DATA

13. CYBER LIABILITY INSURANCE

14. IT CONSULTANT OR SPECIALIST

15. EXTERNAL OUTSOURCE PROVIDERS

Note: This section applies to Out Sauce's own outsource providers (if any), but also describes what Out Sauce's clients' licensees require of Out Sauce as an external outsource provider. Out Sauce meets all these requirements.

16. ONGOING MONITORING

17. CYBER INCIDENT RESPONSE PLAN

18. INCIDENT MANAGEMENT

Summary

83 of 83 requirements met or exceeded (100%). 16 requirements exceeded.

Out Sauce Approved AI Tools List

Purpose

This document lists all AI tools approved for use by Out Sauce personnel in the course of Out Sauce business. It is maintained by Out Sauce and may be updated from time to time.

Default position: If a tool is not on this list, it is not approved for use with any Out Sauce data.

Current Status

No AI tools are currently approved for use with Out Sauce client data. Out Sauce continues to review AI tools against security, privacy, and regulatory requirements on an ongoing basis.

All Out Sauce personnel must not use any AI tool (including but not limited to ChatGPT, Claude, Gemini, Copilot, or any other generative AI service) for any work involving Out Sauce client data until a tool is formally added to this list and notified to personnel.

AI tools may be used for general research, professional development, and non-client work that does not involve any Out Sauce data of any classification.

Data Classification Key

How This List Is Updated

1. Out Sauce Operations assesses the tool against security, privacy, and regulatory requirements
2. Assessment considers: where data is processed/stored, data retention, encryption, compliance with Privacy Act and licensee requirements
3. If approved, the tool is added to this list with conditions and data classification restrictions
4. All Out Sauce personnel are notified via email of the change
5. Changes take effect on the date of notification
6. Out Sauce Operations may remove any tool from this list at any time by email notification, effective immediately

Prohibited Uses (All AI Tools, Including Future Approved Tools)

Regardless of approval status, the following are always prohibited:

• Inputting Sensitive Information (TFNs, health info, financial details, account numbers) into any AI tool unless specifically approved for Sensitive data
• Using AI to make financial advice recommendations without qualified paraplanner review
• Relying on AI outputs without professional verification
• Using AI tools via personal accounts for Out Sauce work
• Disabling or circumventing any data loss prevention controls to use AI tools

Version History

This document is referenced by Out Sauce Contractors Agreement v2.0, Schedule B (Technology & AI Use Policy) and the Out Sauce Data Handling & Classification Policy (OS-DHP-001).

Out Sauce Information Security Policy

1. PURPOSE

This policy establishes Out Sauce's commitment to protecting the confidentiality, integrity, and availability of information assets — including client data, business systems, and intellectual property.

Out Sauce operates in a regulated environment where the security of client financial data is not just good practice — it is a legal obligation and a core part of the value we deliver. This policy sets the standard we hold ourselves to: not the minimum required, but the standard that positions Out Sauce as a market leader in secure paraplanning services.

2. SCOPE

This policy applies to:

• People: Out Sauce Operations, all contract paraplanners, any future employees or contractors, and approved delegates
• Systems: All Out Sauce-owned and managed devices, software, cloud services, communication platforms, and data repositories
• Data: All information created, received, stored, processed, or transmitted in the course of Out Sauce business, regardless of format
• Third parties: IT service providers (Destiny IT), software vendors, and any entity with access to Out Sauce systems or data

3. SECURITY PRINCIPLES

Out Sauce's information security framework is built on six principles:

3.1 Defence in Depth

No single control point. Multiple, overlapping layers of security — managed devices, EDR, SIEM, DLP, MFA, encryption, training, and monitoring — ensure that a failure in one layer does not compromise the whole.

3.2 Least Privilege

Every person and system gets the minimum access required to perform their function. Access is granted deliberately, reviewed regularly, and revoked promptly when no longer needed.

3.3 Security Enables Innovation

Security is not a barrier — it is the foundation that makes innovation possible. Out Sauce embraces AI, automation, and modern tools because a strong security framework allows us to do so safely. We don't restrict tools out of fear; we approve them through a governed process.

3.4 Assume Breach

We plan and design as though a breach has already occurred or is imminent. This means: monitoring, logging, rapid detection, tested response procedures, and minimising blast radius.

3.5 Human-Centred Security

The strongest security framework fails if people don't understand or follow it. Policies are written in plain language. Training is practical and relevant. Security should be the easy path, not the hard one.

3.6 Continuous Improvement

Security is not a project with a finish date. Out Sauce reviews, tests, and improves its security posture continuously — through formal annual reviews, post-incident analysis, and ongoing threat awareness.

4. GOVERNANCE

4.1 Roles and Responsibilities

4.2 Policy Review

• Annual review: Full policy suite reviewed every 12 months (anniversary of effective date)
• Triggered review: Policies reviewed out of cycle following:
  • A security incident
  • A material change in operations (e.g., new systems, significant growth)
  • A regulatory change (e.g., new ASIC guidance, Privacy Act reform, licensee policy update)
  • A change in threat landscape (e.g., new attack vector relevant to Out Sauce)
• Review record: Each review documented with date, reviewer, changes made, and next review date

4.3 Compliance and Enforcement

• All Out Sauce personnel (employees and contractors) must comply with this policy suite
• Non-compliance by contractors is addressed under the Contractors Agreement (material breach provisions)
• Non-compliance by employees is addressed through internal performance management
• Serious or repeated non-compliance may result in termination and reporting to regulators where required

5. REGULATORY FRAMEWORK

Out Sauce operates within the following regulatory framework. This policy suite is designed to meet or exceed all applicable requirements.

5.1 Primary Legislation

5.2 Regulatory Guidance

5.3 Industry Standards (Applied by Analogy)

5.4 Licensee Requirements

6. SECURITY ARCHITECTURE

Note: Out Sauce is currently deploying these controls as part of its engagement with Destiny IT managed services (commenced March 2026). Items are being implemented progressively during this rollout.

6.1 Overview

Out Sauce's security architecture is delivered through a partnership with Destiny IT, a specialist managed services provider for the Australian financial advice industry. Destiny IT is ISO 27001:2022 certified, providing independent assurance of their information security management systems. This provides enterprise-grade security at a scale appropriate for Out Sauce's operations.

6.2 Technical Controls

6.3 Administrative Controls

6.4 Physical Controls

7. RISK MANAGEMENT

7.1 Risk Appetite

Out Sauce has zero tolerance for:

• Deliberate misuse of client data
• Failure to report known security incidents
• Circumvention of security controls

Out Sauce has managed tolerance for:

• Residual risk after proportionate controls are applied
• Emerging threats that require ongoing monitoring and response
• Operational friction from security controls (mitigated through training and tool selection)

7.2 Risk Assessment

Out Sauce conducts formal risk assessments:

• Annually — comprehensive review of threat landscape, control effectiveness, and residual risk
• On change — when new systems, services, or significant operational changes are introduced
• Post-incident — following any security incident, to identify root cause and control gaps

7.3 Key Risk Areas

8. SECURITY INCIDENT MANAGEMENT

Security incidents are managed under the Cyber Incident Response Plan (OS-CIRP-001). Key commitments:

• Detection: 24/7 monitoring via Destiny IT MDR and SIEM
• Reporting: All personnel must report suspected incidents within 24 hours
• Assessment: Out Sauce assesses whether incident is an Eligible Data Breach per regulatory requirements — statutory assessment period is 30 days (Privacy Act), with licensee policies typically requiring formal assessment within 7 days
• Notification chain: Personnel → Out Sauce → Destiny IT → Affected clients → Licensee → OAIC/regulators (as required)
• Post-incident: Root cause analysis, control improvement, lessons learned

9. DATA PROTECTION

Data protection is governed by the Data Handling & Classification Policy (OS-DHP-001) and the Privacy & Data Protection Policy (OS-PDP-001). Key commitments:

• Three-tier data classification: General / Personal / Sensitive
• Handling requirements specific to each classification
• Approved transfer methods by classification
• 7-year retention (Corporations Act and licensee requirements)
• Secure destruction after retention period
• No client data on personal devices, USB, personal cloud, or unapproved systems

10. BUSINESS CONTINUITY

Business continuity is governed by the Business Continuity & Disaster Recovery Plan (OS-BCP-001). Key commitments:

• Cloud-first architecture minimises single-point-of-failure risk
• Automated backups with tested restore capability
• Documented procedures for operating during system disruption
• Communication plan for clients and contractors during extended outage

11. CONTINUOUS IMPROVEMENT

12. RELATED DOCUMENTS

APPROVAL

Out Sauce Cyber Incident Response Plan

1. PURPOSE

This plan provides step-by-step procedures for identifying, containing, investigating, and recovering from cyber security incidents. It ensures Out Sauce can respond rapidly and meet its regulatory obligations under the Privacy Act (Notifiable Data Breaches scheme), licensee cyber policy requirements, and ASIC expectations.

2. SCOPE

This plan covers any actual or suspected Security Incident affecting:

• Out Sauce systems, devices, or data
• Client data handled by Out Sauce or its contractors
• Third-party systems that process Out Sauce data (e.g., approved cloud platform, financial planning software)

3. DEFINITIONS

4. INCIDENT RESPONSE TEAM

Note: This plan reflects Out Sauce's incident response framework being established as part of the Destiny IT managed services deployment (March 2026).

5. INCIDENT SEVERITY LEVELS

6. INCIDENT RESPONSE PHASES

Phase 1: DETECTION & REPORTING

How incidents are detected:

• Destiny IT monitoring (EDR, SIEM, MDR) — automated alerts
• Contractor or employee reports (within 24 hours of becoming aware)
• Client or third-party notification
• Licensee or regulator notification
• Self-identification during reviews or audits

Reporting requirements:

What to report:

• What happened (or what you suspect happened)
• When it was discovered
• What systems/data may be affected
• What actions have been taken so far
• Contact details for follow-up

Reporting channel: Phone call to Out Sauce Operations + follow-up email to clinton@outsauce.au. For CRITICAL severity, phone call is mandatory — do not rely on email alone.

Phase 2: ASSESSMENT & TRIAGE

Within the first 4 hours (CRITICAL/HIGH) or 24 hours (MEDIUM):

1. Confirm the incident — Is this a real incident, a false positive, or a near miss?
2. Classify severity — Use the severity table above
3. Identify scope — What systems, data, and people are affected?
4. Determine data type — Is client data involved? What classification (General / Personal / Sensitive)?
5. Assess NDB threshold — Could this be an Eligible Data Breach under the Privacy Act?

Decision tree:

Incident confirmed?
├── NO → Log as near miss. Review in next training cycle. STOP.
├── UNSURE → Investigate further (Destiny IT). Set 24-hour review point.
└── YES → Continue to Phase 3 (Containment)
    │
    Client data involved?
    ├── NO → Contain and resolve. Log incident. Review controls. STOP.
    └── YES → Continue NDB assessment (Phase 5)

Phase 3: CONTAINMENT

Objective: Stop the incident from getting worse. Preserve evidence.

Immediate containment actions (Destiny IT + Out Sauce Operations):

CRITICAL RULE: Do NOT attempt to investigate or remediate independently. Preserve everything and let Destiny IT handle the technical response.

Phase 4: ERADICATION & RECOVERY

Objective: Remove the threat and restore normal operations.

Phase 5: NOTIFICATION & REGULATORY OBLIGATIONS

Privacy Act — Notifiable Data Breaches (NDB) scheme:

Licensee notification:

Other notifications:

Phase 6: POST-INCIDENT REVIEW

Within 14 days of incident closure:

1. Root cause analysis — What happened and why?
2. Control effectiveness — Did existing controls work? What failed?
3. Response effectiveness — Was the response plan followed? What worked well? What needs improvement?
4. Lessons learned — What changes are needed to policies, controls, or training?
5. Action items — Specific, assigned, time-bound actions to prevent recurrence

Document: Post-incident report filed and retained for 7 years. Policy suite updated if required.

7. TESTING

This plan is tested through:

A tabletop exercise walks through a realistic scenario (e.g., "a contractor clicks a phishing link and enters their approved cloud platform credentials") and tests the team's response against this plan.

8. RECORD KEEPING

All incident records are retained for 7 years, including:

• Initial incident reports
• Investigation logs
• Communication records (notifications sent)
• Post-incident review reports
• Evidence and forensic reports (from Destiny IT)
• NDB assessment documentation
• Remediation action records

APPROVAL

Out Sauce Data Handling & Classification Policy

1. PURPOSE

This policy establishes how Out Sauce classifies, handles, stores, transfers, and retains information — particularly client data. It ensures all personnel understand their obligations and that Out Sauce meets its regulatory requirements under the Privacy Act, licensee cyber policy standards, and Corporations Act.

2. SCOPE

Applies to all information created, received, stored, processed, or transmitted by Out Sauce personnel (employees and contractors) in the course of Out Sauce business, regardless of format (digital, paper, verbal).

3. DATA CLASSIFICATION

All information handled in Out Sauce operations falls into one of three classifications:

3.1 General Information

Definition: Non-sensitive business information with no privacy implications.

Examples:

• Public business information (Out Sauce website content, marketing materials)
• General industry data, market research, public regulatory guidance
• Internal process documentation (non-confidential)
• General communication not referencing specific clients

Handling requirements:

• Standard care
• May be stored on managed device, approved cloud storage, or approved tools
• No special transfer requirements
• No restriction on approved AI tools for this classification

3.2 Personal Information

Definition: Information as defined in the Privacy Act 1988 — information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Examples:

• Client names, dates of birth, contact details (address, phone, email)
• Employment details and history
• Government identifiers (Medicare, driver's licence, passport — but NOT TFN, which is Sensitive)
• Superannuation fund names and membership numbers
• Insurance policy details (provider name, policy number)
• Basic financial information (salary, employer)

Handling requirements:

• Store only in approved systems (approved cloud platform, financial planning software managed on Out Sauce devices)
• Transfer only via approved methods (see Section 4)
• Must not be emailed without encryption unless limited to: client name, contact details, super fund name, insurance provider name, policy number
• Must not be input into AI tools unless the tool is on the Approved list AND approved for Personal Information
• Must not be stored on personal devices, USB, personal cloud, or unapproved systems
• Access limited to personnel who need it for their current engagement

3.3 Sensitive Information

Definition: A subset of personal information attracting heightened regulatory protection under the Privacy Act, licensee cyber policy standards, and applicable financial services regulation.

Examples:

• Financial details: Assets, liabilities, income, expenses, account numbers, account balances, transaction history, credit reports, credit card numbers
• Tax File Numbers (TFN) — additional protections under the Privacy Act and Tax Administration Act
• Health information: Medical conditions, insurance exclusions, health history (relevant to risk insurance)
• Insurance claims history
• Identity documents: Passport copies, driver's licence copies, birth certificates (when retained)
• Sensitive information under the Privacy Act: Racial/ethnic origin, political opinions, religious beliefs, union membership, sexual orientation, criminal record, biometric data

Handling requirements:

• Highest protection level
• Store only in approved systems with access controls (financial planning software, approved cloud platform with access restrictions)
• Transfer only via approved secure methods (see Section 4)
• Must never be emailed without encryption
• Must never be input into AI tools unless specifically approved for Sensitive Information by Out Sauce
• TFNs must be stored in one location only (approved financial planning software) — not duplicated across file notes, spreadsheets, or emails
• Access strictly limited to personnel with a current, specific need
• Printed copies must be securely destroyed after use (cross-cut shredding)

4. APPROVED TRANSFER METHODS

These methods meet or exceed leading licensee cyber policy requirements for data transfer by classification.

5. DATA STORAGE

5.1 Approved Storage Locations

Out Sauce may also operate internal workflow and communication tools for task coordination and general business communications. These tools are assessed under the Out Sauce vendor management framework and are restricted to General and limited Personal information only. Client Sensitive data (Tier 3) is stored and transferred exclusively via approved financial planning software and the managed cloud platform.

5.2 Prohibited Storage

Client data (Personal or Sensitive) must never be stored on:

• Personal devices (laptops, phones, tablets not managed by Destiny IT)
• USB drives, external hard drives, or removable media
• Personal cloud storage (personal Google Drive, Dropbox, iCloud, personal OneDrive)
• Personal email accounts
• Consumer AI tools or services not on the Approved Tools list
• Paper files retained beyond immediate use (must be destroyed after use)

5.3 Data Minimisation

• Collect and retain only the client data necessary for the engagement
• Do not duplicate Sensitive Information across multiple locations (e.g., TFN in one place only)
• Working copies of client files on managed devices should be moved to approved cloud storage on completion and not retained locally longer than necessary

6. DATA RETENTION

6.1 Retention Periods

6.2 Secure Destruction

After the retention period expires:

• Digital data: Secure deletion using approved tools, or device destruction managed by Destiny IT
• Paper records: Cross-cut shredding
• Devices: Secure data erasure and certified disposal managed by Destiny IT

7. SPECIAL CATEGORIES

7.1 Tax File Numbers (TFNs)

TFNs attract additional protections under the Privacy Act and the Tax Administration Act 1953:

• Store in approved financial planning software — single-source principle (do not duplicate across multiple documents)
• Never include in email body (even encrypted email — use secure portal or system-to-system)
• Never duplicate across file notes, spreadsheets, or working documents
• Access strictly limited

7.2 Health Information

Health information (relevant to risk insurance advice) is Sensitive Information:

• Store in approved financial planning software or approved cloud platform with access controls
• Transfer via encrypted channels only
• Consider redaction after the specific advice engagement is complete (retain minimum necessary)

7.3 Identity Documents

Copies of passports, driver's licences, birth certificates (used for AML/CTF verification):

• Retain per AML/CTF Act requirements (7 years from relationship end)
• Store in approved financial planning software or approved cloud platform with access controls
• After AML/CTF verification, redact government-issued numbers where possible (per industry best practice)
• Securely destroy after retention period

8. AI & DATA

Default rule: When in doubt, do NOT input data into an AI tool. Ask Out Sauce for clarification.

9. BREACH OF THIS POLICY

Deliberate or reckless breach of this policy is treated as a serious matter:

• Contractors: Material breach under Contractors Agreement — may result in immediate termination
• Employees: Disciplinary action up to and including termination
• Regulatory consequences: Depending on the breach, Out Sauce may be required to report to the applicable licensee, OAIC, or ASIC

Inadvertent breaches (e.g., accidentally emailing the wrong file) should be reported immediately. Self-reporting is treated constructively — the goal is to contain and learn, not to punish honest mistakes.

APPROVAL

Out Sauce Acceptable Use Policy

1. PURPOSE

This policy defines acceptable use of Out Sauce technology, systems, and information assets by Out Sauce employees. Contractor technology obligations are governed by the Contractors Agreement (Schedule B — Technology & AI Use Policy), which mirrors and extends this policy.

2. SCOPE

Applies to all Out Sauce-owned or managed technology used by Out Sauce employees, including:

• Out Sauce managed devices (laptops, any future desktops or mobile devices)
• Approved cloud platform (email, collaboration tools, cloud storage)
• Financial planning software
• Any cloud services accessed through Out Sauce accounts
• Internet access through Out Sauce managed devices

3. GENERAL PRINCIPLES

• Out Sauce technology is provided for business purposes. Incidental personal use is acceptable provided it does not compromise security, consume excessive resources, or expose Out Sauce systems to risk.
• All activity on Out Sauce managed devices is subject to security monitoring by Destiny IT (for security purposes only — not productivity tracking).
• Users must not attempt to circumvent, disable, or interfere with security controls.

4. APPROVED USE

4.1 Software and Applications

• Only software approved by Out Sauce and managed by Destiny IT may be installed on managed devices
• Browser extensions must be approved — do not install extensions without checking with Destiny IT
• SaaS applications accessed via browser must be on the Approved Tools list when used with client data
• Requests for new software should be directed to Out Sauce Operations → Destiny IT for security assessment

4.2 Email and Communication

• Use Out Sauce managed email for all business communication
• Do not use personal email for any Out Sauce business
• Do not forward Out Sauce email to personal accounts
• Be cautious with email attachments and links — report suspicious emails via Destiny IT's reporting mechanism
• Do not send Sensitive Information via unencrypted email (see Data Handling Policy)

4.3 Internet Use

• Internet use on managed devices should be primarily business-related
• Incidental personal browsing is acceptable (news, weather, personal banking via secure sites)
• Do not access sites that could compromise device security (pirated software, suspicious downloads)
• Use mobile hotspot rather than public Wi-Fi; if public Wi-Fi is unavoidable, use approved VPN

4.4 Cloud Storage

• Use Out Sauce-managed approved cloud storage for document storage
• Do not sync Out Sauce data to personal cloud accounts
• Do not share Out Sauce files via personal file-sharing services

4.5 AI Tools

• Use only Approved AI Tools (see Contractors Agreement Schedule B, Approved Tools list)
• Do not input Personal or Sensitive client data into any AI tool not specifically approved for that purpose
• Disclose AI use in deliverables where AI materially contributed to content
• You remain responsible for all outputs — AI does not reduce your accountability

5. PROHIBITED USE

The following are prohibited on Out Sauce managed devices and systems:

• Installing unapproved software or browser extensions
• Attempting to gain administrative access or elevate privileges
• Disabling, modifying, or circumventing any security software or controls
• Connecting USB drives or removable media containing client data
• Transferring client data via Airdrop, Bluetooth, or other wireless file-sharing methods
• Leaving Bluetooth enabled when not actively in use
• Storing client data on personal devices, personal cloud, or personal email
• Sharing passwords or login credentials with any other person
• Saving passwords in browser autocomplete (use approved password manager only)
• Using Out Sauce systems for illegal activity
• Downloading or distributing pirated software, media, or content
• Accessing or distributing inappropriate or offensive material
• Using Out Sauce email or systems to impersonate another person
• Making public statements about security incidents without Out Sauce Operations approval

6. PASSWORDS AND AUTHENTICATION

• Use the approved enterprise password manager for all Out Sauce-related credentials
• Passwords must be minimum 16 characters
• Passwords must be unique — do not reuse across accounts
• Do not save passwords in browsers — use the password manager only
• MFA (authenticator app preferred) must be enabled on all systems accessing client data
• Report any suspected credential compromise immediately

7. PHYSICAL SECURITY

• Lock managed devices when unattended (screen lock: 10-minute auto-timeout)
• Store managed devices securely when not in use (not visible in vehicles, not left in public spaces)
• Do not leave managed devices unattended in public places
• Report lost or stolen devices within 24 hours (Destiny IT can remote-lock and wipe)
• Secure printed client documents — shred when no longer needed

8. REMOTE WORKING

Out Sauce operates as a remote-first business. When working remotely:

• Use the managed device for all Out Sauce work involving client data
• Ensure your working environment is reasonably private (client data not visible on screen to unauthorised people)
• Use mobile hotspot or secure home network — avoid public Wi-Fi without VPN
• Lock device when stepping away, even briefly

9. REPORTING

Report the following to Out Sauce Operations and/or Destiny IT:

• Suspected phishing emails or social engineering attempts
• Any unusual device behaviour (slowness, unexpected pop-ups, unfamiliar software)
• Lost or stolen devices
• Any suspected security incident (see Cyber Incident Response Plan)
• Any situation where you're unsure whether an action is permitted under this policy

APPROVAL

Out Sauce Access Management Policy

1. PURPOSE

This policy governs how access to Out Sauce systems, data, and resources is granted, managed, reviewed, and revoked. It implements the principle of least privilege — every person gets only the access they need, when they need it.

2. SCOPE

Applies to all access to Out Sauce systems and data, including:

• Approved cloud platform (email, collaboration tools, cloud storage)
• Approved financial planning software
• Out Sauce managed devices
• Any cloud services or SaaS platforms used for Out Sauce business
• Physical access to Out Sauce equipment

3. PRINCIPLES

• Least privilege: Grant the minimum access needed to perform the role
• Need to know: Access to client data is limited to the specific engagements a person is working on
• Separation of duties: Where practicable, no single person has unchecked access to all systems (the Director as sole principal is an exception — mitigated by monitoring and audit trails)
• Timely revocation: Access is removed promptly when no longer needed
• Accountability: All access is attributed to a named individual — no shared accounts

4. ACCESS ROLES

4.1 Out Sauce Access Roles

4.2 Contractor Access Restrictions

Contractors receive access only to:

• The managed device assigned to them
• Approved cloud platform accounts provisioned for their work
• Approved financial planning software access limited to the specific clients they are assigned to work on
• No admin rights on any system
• No access to Out Sauce business/financial data, other contractors' work, or internal strategic documents

5. ACCESS LIFECYCLE

5.1 Onboarding — New Contractor

5.2 Onboarding — New Employee

5.3 Access Changes

When a person's role changes or they need access to additional systems:

• Request made to Out Sauce Operations
• Out Sauce Operations assesses against least privilege principle
• If approved, Destiny IT or Out Sauce Operations provisions the access
• Change logged in access register

5.4 Offboarding — Contractor Departure

5.5 Offboarding — Employee Departure

Same process as contractor, plus:

• All internal documents and access reviewed for completeness
• Handover of ongoing responsibilities documented

6. ACCESS REVIEWS

Action on review: Any unnecessary access identified is revoked within 7 days.

7. PRIVILEGED ACCESS

7.1 Admin Accounts

• Admin access to approved cloud platform and Out Sauce systems is limited to Out Sauce Operations and Destiny IT (security administration)
• Admin access must use MFA
• Admin actions are logged via SIEM
• Out Sauce Operations's admin access is mitigated by: Destiny IT's independent monitoring and audit trail

7.2 Destiny IT Access

Destiny IT has administrative access to Out Sauce systems for security management purposes. This access is governed by:

• Destiny IT's own professional indemnity and cyber insurance
• Out Sauce's Third-Party & Vendor Management Policy
• Destiny IT's contractual obligations (managed services agreement)
• SIEM logging of their administrative actions

8. AUTHENTICATION REQUIREMENTS

9. ACCESS REGISTER

Out Sauce will maintain an access register documenting:

• Who has access to what systems
• What access level (role)
• Date access was granted
• Date of last review
• Date access was revoked (where applicable)

The register will be maintained by Out Sauce Operations and reviewed quarterly.

APPROVAL

Out Sauce Business Continuity & Disaster Recovery Plan

1. PURPOSE

This plan ensures Out Sauce can maintain or rapidly restore critical business operations following a disruption — whether from a cyber incident, system failure, natural disaster, or other cause. It establishes recovery priorities, procedures, and communication protocols.

2. Out Sauce BUSINESS PROFILE

Out Sauce's cloud-first, remote model is inherently resilient. There is no single physical location whose loss would halt operations. The primary risks are: system/cloud outages, cyber incidents, and key person unavailability.

3. RECOVERY OBJECTIVES

4. CRITICAL BUSINESS FUNCTIONS

5. DISRUPTION SCENARIOS AND RESPONSES

5.1 Scenario: Single Managed Device Failure

1. Contractor reports device failure to Out Sauce and Destiny IT
2. Destiny IT diagnoses remotely — if recoverable, fix within SLA
3. If device is unrecoverable, Destiny IT manages device replacement or repair under manufacturer warranty arrangements
4. Contractor's cloud-stored work is intact (approved cloud platform backup)
5. RTO: 24-48 hours for device replacement; 0 data loss

5.2 Scenario: Cloud Platform Outage

1. Monitor cloud platform service health dashboard
2. Communicate with contractors via phone/SMS (contact list maintained offline)
3. For short outages (<4 hours): wait for restoration
4. For extended outages (>4 hours): contractors continue offline work on managed devices; Out Sauce communicates client delays via phone
5. RTO: Dependent on cloud platform provider (SLA 99.9%+ (per vendor published SLA)) — typically <4 hours for major outages

5.3 Scenario: Financial Planning Software Outage

1. Monitor vendor status page
2. Notify contractors of outage
3. Redirect contractors to work that doesn't require the platform (admin tasks, offline research)
4. Notify affected clients of potential delays
5. RTO: Dependent on vendor — typically <24 hours

5.4 Scenario: Cyber Incident (Ransomware / Data Breach)

1. Activate Cyber Incident Response Plan (OS-CIRP-001) — takes priority over BCP
2. Destiny IT leads technical response (containment, investigation)
3. Out Sauce communicates with contractors: "Stop all Out Sauce work until cleared"
4. Out Sauce communicates with affected clients per incident response plan
5. Recovery from approved cloud platform backups once Destiny IT confirms systems are clean
6. RTO: 24-72 hours depending on severity

5.5 Scenario: Key Person Unavailability

1. Short-term (<1 week): Other Out Sauce team members manage day-to-day operations. Contractors continue existing engagements autonomously. Destiny IT continues security operations independently.
2. Extended (>1 week): Out Sauce Operations contacts applicable licensees for guidance on obligations. Consider activating a nominated emergency contact (e.g., trusted industry peer or professional adviser) who can make decisions if needed.
3. All critical passwords and account access are documented in a secure location accessible to the Out Sauce Operations team.

5.6 Scenario: Internet Outage (Individual)

1. Use mobile phone hotspot as backup internet connection
2. If prolonged, work from alternative location with internet access
3. Notify Out Sauce if unable to meet engagement deadlines

5.7 Scenario: Natural Disaster (Regional)

1. Cloud-first model means geographic redundancy is built in — approved cloud platform data is replicated across provider data centres
2. Users outside the affected area continue working normally
3. Affected users resume when safe and connectivity restored
4. Client communication priorities maintained via phone

6. BACKUP AND RECOVERY

6.1 Backup Architecture

6.2 Backup Testing

• Automated restore verification: Destiny IT's backup platform performs automated restore integrity verification to confirm recoverability on an ongoing basis. Full manual restore testing is available on request as an additional service.
• Post-incident: If backups are used in incident recovery, the process is documented and reviewed

6.3 Backup Security

• Backups are encrypted and isolated from the production network (per industry best practice)
• Backup access is restricted to Destiny IT administrators
• Backup integrity is monitored by Destiny IT

7. COMMUNICATION PLAN

7.1 During Disruption

7.2 Contact List

Out Sauce maintains an offline (printed) contact list containing:

• All contractor mobile numbers and personal email addresses
• Destiny IT support phone number
• Licensee risk team contacts
• Cyber insurance claims contact
• Key client contacts

This list is kept in a secure physical location accessible to Out Sauce Operations and Out Sauce Operations, and updated quarterly.

8. TESTING

9. PLAN MAINTENANCE

• Reviewed annually or after any activation
• Updated when: new systems introduced, team size changes significantly, contact details change
• Out Sauce Operations is responsible for ensuring the plan remains current

APPROVAL

Out Sauce Privacy & Data Protection Policy

1. PURPOSE

This policy establishes how Out Sauce collects, uses, stores, discloses, and protects personal information in compliance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Notifiable Data Breaches (NDB) scheme, and evolving privacy legislation.

2. SCOPE

Applies to all personal information handled by Out Sauce in the course of business, including:

• Information about clients of financial advice firms (Out Sauce's clients' customers)
• Information about Out Sauce's own clients (the advice firms)
• Information about Out Sauce contractors and employees
• Information about prospective clients, contractors, or employees

3. AUSTRALIAN PRIVACY PRINCIPLES — Out Sauce COMPLIANCE

APP 1 — Open and Transparent Management of Personal Information

Out Sauce maintains this policy and the Data Handling & Classification Policy (OS-DHP-001) to document how personal information is managed. These policies are available to individuals on request.

APP 2 — Anonymity and Pseudonymity

Where practicable, Out Sauce allows individuals to interact anonymously (e.g., general enquiries). However, the nature of paraplanning services requires identification of clients for regulatory and professional purposes.

APP 3 — Collection of Personal Information

• Out Sauce collects personal information only where reasonably necessary for providing paraplanning services
• Collection is from the advice firm (Out Sauce's client) — Out Sauce does not typically collect information directly from end consumers
• Out Sauce collects Sensitive Information only where required for the specific advice engagement (e.g., health information for risk insurance, financial details for investment advice)
• Individuals are notified of collection through the advice firm's own privacy notices

APP 4 — Dealing with Unsolicited Information

If Out Sauce receives personal information it did not request and does not need:

• Assess whether it would have been permitted to collect it
• If not, destroy or de-identify the information as soon as practicable

APP 5 — Notification of Collection

Out Sauce relies on the advice firm (as the primary entity in the client relationship) to notify individuals about collection. Out Sauce's privacy information is available on request for inclusion in advice firm disclosures.

APP 6 — Use or Disclosure of Personal Information

Out Sauce uses personal information only for:

• The purpose for which it was collected (providing paraplanning services)
• A directly related secondary purpose the individual would reasonably expect
• Where required or authorised by law (e.g., regulatory reporting, AML/CTF obligations)

Out Sauce does not:

• Sell personal information
• Use personal information for direct marketing
• Disclose personal information to overseas recipients (unless the advice firm's client has overseas connections and disclosure is necessary for the engagement)
• Share personal information between unrelated Out Sauce clients

APP 7 — Direct Marketing

Out Sauce does not use personal information collected through paraplanning services for direct marketing.

APP 8 — Cross-Border Disclosure

Out Sauce does not routinely disclose personal information overseas. If an engagement requires it (e.g., international estate planning), Out Sauce ensures compliance with APP 8 requirements and the advice firm's instructions.

APP 9 — Government-Related Identifiers

Out Sauce does not adopt, use, or disclose government identifiers (e.g., TFN, Medicare number) as its own identifier. Government identifiers are handled per the Data Handling & Classification Policy (Sensitive Information classification).

APP 10 — Quality of Personal Information

Out Sauce takes reasonable steps to ensure personal information is accurate, up-to-date, and complete. Where Out Sauce identifies inaccuracies in client data, it notifies the advice firm.

APP 11 — Security of Personal Information

Out Sauce protects personal information through:

• The full security framework documented in the Information Security Policy (OS-ISP-001)
• Destiny IT managed services (EDR, SIEM, DLP, encryption, patching)
• Data classification and handling requirements (OS-DHP-001)
• Contractor obligations (Contractors Agreement, Schedule B)
• Training and awareness (OS-SAT-001)

When personal information is no longer needed and not subject to retention requirements, it is securely destroyed (see Data Handling & Classification Policy, Section 6).

APP 12 — Access to Personal Information

Individuals have a right to request access to personal information Out Sauce holds about them. In practice, most requests will come through the advice firm. Out Sauce will:

• Respond to access requests within 30 days
• Provide information in the format requested (where reasonable)
• Not charge for making a request (may charge reasonable costs for providing access)
• Refuse access only where permitted by law (e.g., commercially sensitive information, ongoing legal proceedings)

APP 13 — Correction of Personal Information

If Out Sauce becomes aware that personal information is inaccurate, out of date, incomplete, or misleading:

• Out Sauce takes reasonable steps to correct the information
• Notifies the advice firm of the correction
• If Out Sauce refuses a correction request, it provides written reasons and information about complaint mechanisms

4. NOTIFIABLE DATA BREACHES

4.1 When Does the NDB Scheme Apply?

A data breach is "eligible" for notification if:

1. There is unauthorised access to, disclosure of, or loss of personal information
2. A reasonable person would conclude the breach is likely to result in serious harm to any of the affected individuals
3. Out Sauce has been unable to prevent the likely risk of serious harm through remedial action

4.2 Out Sauce's NDB Process

4.3 Serious Harm Assessment Factors

When assessing whether serious harm is likely, Out Sauce considers:

• The kind of information involved (TFN, financial details, health info = higher risk)
• Whether the information is encrypted or otherwise protected
• The person(s) who obtained or could obtain the information
• Whether the breach could result in identity theft, financial loss, or reputational damage
• The nature of the harm that could result

4.4 Record Keeping

Out Sauce maintains records of:

• All data breaches (whether or not eligible for notification)
• All NDB assessments
• All notifications made
• All remedial actions taken

Records retained for 7 years.

5. PRIVACY RISK MANAGEMENT

Out Sauce recognises that privacy obligations continue to evolve, with increasing expectations around proportionality, data minimisation, and informed consent for monitoring. Out Sauce proactively manages these risks through:

• Contractor monitoring: Out Sauce ensures monitoring on managed devices is proportionate, informed consent is obtained, and monitoring is limited to security purposes. The Contractors Agreement (Schedule A, Clause 5) addresses this.
• Data minimisation: Out Sauce does not collect or retain more personal information than necessary.
• Proportionality: Security measures are proportionate to the risk.

Out Sauce mitigates privacy risk through:

• Explicit, informed consent for monitoring (Schedule A)
• Clear limitation of monitoring to security purposes (not productivity tracking)
• Data minimisation principles (Data Handling Policy)
• Regular review of monitoring scope and proportionality

6. CONTRACTOR AND EMPLOYEE PRIVACY

6.1 Information Out Sauce Holds About Contractors

• Business entity details, ABN, contact information
• Bank details for payment
• Insurance certificates of currency
• Training completion records
• Security incident reports (if any)
• Device assignment and access records

This information is collected with consent (via the Contractors Agreement) and used only for managing the contractor relationship.

6.2 Monitoring and Privacy

• Out Sauce does NOT monitor contractor productivity, hours, or work methods
• Security monitoring on managed devices is limited to threat detection and data protection
• Monitoring data is accessible only to Destiny IT (for security) and Out Sauce (for incident response)
• Contractors are fully informed of monitoring scope before consenting

6.3 Employee Privacy

• Out Sauce holds standard employment records for Out Sauce Operations and Out Sauce Operations (exempt from APPs under the employee records exemption)
• Despite the exemption, Out Sauce applies the same standards as for contractor information

7. COMPLAINTS

If any individual believes Out Sauce has breached their privacy:

1. Contact Out Sauce Operations — clinton@outsauce.au
2. Out Sauce will investigate within 30 days and respond in writing
3. If not resolved to the individual's satisfaction, they may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au

APPROVAL

Out Sauce Third-Party & Vendor Management Policy

1. PURPOSE

This policy governs how Out Sauce assesses, engages, monitors, and manages third-party vendors and service providers that have access to Out Sauce systems, data, or operations. It ensures that Out Sauce's security and privacy standards are maintained across the supply chain.

2. SCOPE

Applies to all third-party relationships where the third party:

• Accesses, processes, or stores Out Sauce or client data
• Provides IT or technology services to Out Sauce
• Has connectivity to Out Sauce systems or infrastructure
• Provides professional services involving confidential business information

3. THIRD-PARTY RISK TIERS

4. ASSESSMENT CRITERIA

4.1 Pre-Engagement Assessment

Before engaging a Tier 1 or Tier 2 vendor, Out Sauce assesses:

4.2 Licensee Requirements for External Outsource Providers

Per leading licensee cyber policy standards, external outsource providers must:

• Hold their own Professional Indemnity Insurance
• Hold their own Cyber Insurance Policy
• Provide Certificates of Currency to Out Sauce (maintained on file, available to licensees on request)
• Transfer client data only via approved methods (approved financial planning software, approved cloud storage, encrypted email)
• Hold their own software licensing

5. CURRENT VENDOR REGISTER

6. ONGOING MONITORING

6.1 Annual Review

All Tier 1 and Tier 2 vendors are reviewed annually:

• Confirm insurance remains current (request updated COCs)
• Review any security incidents reported by the vendor
• Assess any changes to the vendor's services, data handling, or terms
• Review vendor's security certifications and compliance status

6.2 Continuous Monitoring

For Tier 1 vendors:

• Subscribe to vendor security bulletins and incident notifications
• Monitor vendor uptime and service quality against SLA
• Review any changes to vendor's privacy policy or terms of service

6.3 Incident Response

If a vendor experiences a security incident that may affect Out Sauce data:

• Activate Cyber Incident Response Plan (OS-CIRP-001)
• Demand information from the vendor about scope, impact, and remediation
• Assess whether Out Sauce's own NDB obligations are triggered
• Notify applicable licensee if required

7. CONTRACT REQUIREMENTS

Out Sauce's agreements with Tier 1 and Tier 2 vendors should include (where Out Sauce has negotiating power):

Practical note: Out Sauce may not have negotiating power over terms with large vendors (cloud platform providers, financial planning software vendors). In those cases, Out Sauce relies on the vendor's published security certifications, terms, and SLAs.

8. OFFBOARDING VENDORS

When a vendor relationship ends:

1. Revoke vendor's access to Out Sauce systems (within 24 hours)
2. Request return or certified destruction of Out Sauce data
3. Rotate any credentials the vendor had access to
4. Update vendor register
5. Retain records of the vendor relationship for 7 years

APPROVAL

Out Sauce Security Awareness & Training Framework

1. PURPOSE

This framework establishes Out Sauce's security awareness and training program. Its goal is to ensure every person handling Out Sauce data understands the risks, knows the rules, and can recognise and respond to threats.

2. SCOPE

Applies to:

• Out Sauce employees (Out Sauce Operations and Out Sauce Operations)
• All contract paraplanners
• Any future employees, contractors, or approved delegates

3. TRAINING REQUIREMENTS

4. TRAINING PROGRAM

4.1 Security Awareness Training

Security awareness training and phishing simulations will be provided through Out Sauce's managed IT services agreement with Destiny IT. This is an included service covering all managed users.

Training is delivered via a video platform through Destiny IT's security provider, with content delivered on a monthly or bi-monthly basis. Training covers security awareness relevant to Out Sauce's operating environment, including recognition and response to cyber threats.

4.2 Out Sauce-Delivered Training

Out Sauce delivers the following directly:

• Onboarding orientation — Out Sauce security framework, key policies, data handling rules, managed device overview
• Policy updates — notification and summary when policies are updated
• Incident debriefs — lessons learned following any security incident
• AI and data handling — Out Sauce's data classification and approved handling methods

4.3 Phishing Simulations

Simulated phishing exercises are included in Out Sauce's managed services agreement with Destiny IT, delivered monthly or bi-monthly depending on requirements. Phishing resistance testing is integrated with the security awareness training platform. Results are used for training purposes — not performance management.

5. TRACKING AND EVIDENCE

5.1 Training Register

Out Sauce maintains a training register documenting:

• Who completed what training
• When it was completed
• Completion evidence
• Phishing simulation results

The register is maintained by Out Sauce Operations and available for licensee audit on request.

5.2 Licensee Reporting

• Training completion records are maintained by Out Sauce and available to licensees on request
• Training register submitted to applicable licensee upon request

APPROVAL

Policy Review Register

1. Purpose

This register provides a centralised record of all Out Sauce policy and procedure documents, their review status, and review history. It ensures that the Out Sauce security and operational document suite remains current, accurate, and aligned with regulatory requirements, threat landscape changes, and business operations.

All Out Sauce documents must be reviewed at least annually or when triggered by specific events outlined in this register.

2. Review Schedule

3. Triggered Review Criteria

In addition to the scheduled annual review, any Out Sauce document must be reviewed immediately when any of the following triggers occur:

3.1 Security Incident

• A cyber security incident has occurred that exposed a gap or weakness in existing policy
• A near-miss event that revealed inadequate controls or procedures
• A phishing simulation result indicating systemic training or policy failures

3.2 Regulatory Change

• New or amended ASIC regulatory guidance affecting financial services security obligations
• Changes to the Privacy Act, Australian Privacy Principles, or notifiable data breach scheme
• New or updated licensee security requirements or due diligence expectations
• Changes to industry standards referenced in Out Sauce policies (e.g., Essential Eight, ISO 27001)

3.3 Operational Change

• Onboarding of a new licensee or significant change to licensee arrangements
• Addition or removal of a third-party vendor or IT service provider
• Material change to Out Sauce business operations, staffing model, or service delivery
• Introduction of new technology, tools, or platforms into the Out Sauce environment
• Changes to the Destiny IT managed service scope or configuration

3.4 Threat Landscape Change

• Emergence of a new threat category relevant to Out Sauce operations (e.g., novel AI-based attack vectors)
• Industry-wide security advisory or alert affecting financial services practices
• Notification from Destiny IT or other security partners of elevated threat conditions

4. Review Procedure

4.1 Initiation

• Scheduled reviews: Out Sauce Operations initiates the review process no later than 30 days before the documented Next Review Date
• Triggered reviews: The person identifying the trigger notifies Out Sauce Operations, who initiates the review within 5 business days

4.2 Review Steps

1. Out Sauce Operations retrieves the current version of the document from the document repository
2. The document is assessed against:
   • Current regulatory requirements and licensee obligations
   • Current operational practices and technology environment
   • Any incidents, near-misses, or audit findings since last review
   • Feedback from personnel, licensees, or Destiny IT
3. Required changes are drafted and documented
4. If changes affect other documents in the suite, those documents are flagged for concurrent review

4.3 Approval

• All policy changes must be approved by Out Sauce Operations before publication
• Material changes (new sections, removed controls, changed classification levels) require documented approval rationale
• Minor changes (formatting, typographical corrections, reference updates) may be approved by Out Sauce Operations

4.4 Distribution

• Updated documents are published to the Out Sauce document repository
• All affected personnel are notified of changes and required to acknowledge updated policies
• Licensees are notified where changes affect due diligence pack content or compliance matrix entries
• The Review Schedule table in this register is updated with the new version, effective date, and next review date

5. Review History Log

6. Document Control

This document is classified as Internal and is maintained by Out Sauce Operations. It is available to licensees upon request as part of the Out Sauce due diligence pack.

Risk Assessment Register

1. Purpose

This register documents the Out Sauce information security risk assessment methodology, maintains a current record of identified risks, and tracks risk treatment over time. It supports Out Sauce obligations under licensee due diligence requirements and demonstrates a structured, ongoing approach to identifying, assessing, and managing information security risks across the business.

This register is maintained by Out Sauce Operations and reviewed at least annually, or following any significant incident, operational change, or regulatory development.

2. Risk Rating Methodology

2.1 Likelihood Scale

2.2 Impact Scale

2.3 Risk Rating Matrix

2.4 Risk Rating Thresholds

2.5 Risk Appetite Statement

Out Sauce maintains zero tolerance for:

• Deliberate misuse of client data by any personnel
• Use of unapproved tools or platforms for processing client information
• Circumvention of security controls or policies

Out Sauce maintains managed tolerance for:

• Residual risks that remain after all reasonable and proportionate controls have been applied
• Risks rated Low or Medium after treatment, where the cost of further mitigation is disproportionate to the risk reduction achieved
• Operational risks inherent in the delivery of financial planning services (e.g., reliance on third-party platforms)

3. Risk Register

4. Assessment Schedule

4.1 Annual Comprehensive Assessment

• A full risk assessment is conducted annually, aligned with the policy review cycle
• All existing risks are reassessed for changes in likelihood, impact, or control effectiveness
• New risks are identified through environmental scanning, incident review, and stakeholder consultation
• Results are documented in the Assessment History Log below

4.2 On-Change Assessment

• A targeted risk assessment is conducted when any of the following occur:
  • New technology, platform, or tool introduced into the Out Sauce environment
  • New licensee onboarded or significant change to licensee arrangements
  • New vendor engaged or existing vendor scope materially changed
  • Significant change to Out Sauce staffing model or operational processes
  • Regulatory change affecting Out Sauce security obligations

4.3 Post-Incident Assessment

• Following any security incident (actual or near-miss), the relevant risk(s) are reassessed
• Control effectiveness is evaluated in light of the incident
• New risks identified during incident investigation are added to the register
• Assessment is completed within 10 business days of incident closure

5. Assessment History Log

6. Document Control

This document is classified as Internal and is maintained by Out Sauce Operations. It is available to licensees upon request as part of the Out Sauce due diligence pack.

Security Awareness Training Program

1. Purpose

This document defines the Out Sauce security awareness training program, including the annual training schedule, module descriptions, onboarding requirements, and effectiveness measurement criteria. It ensures all Out Sauce personnel — including all operations staff, and contract paraplanners — receive consistent, relevant, and timely security training aligned with Out Sauce policy obligations and licensee expectations.

This program is maintained by Out Sauce Operations and delivered in partnership with Destiny IT.

2. Training Requirements Summary

3. Annual Training Schedule

4. Training Modules

5. New Contractor Onboarding Checklist

All new contractors must complete the following steps within their first 5 business days. Access to client data and financial planning software is not granted until all mandatory items are completed.

Sign-off:

6. Completion Requirements

6.1 Passing Criteria

• MOD-001 (Security Awareness Fundamentals): Must achieve minimum 80% score on assessment
• MOD-002 to MOD-005: Must complete all content and provide written acknowledgment
• MOD-006 (Phishing Simulations): No pass/fail — results tracked for trend analysis and targeted remediation

6.2 Timeframes

• Annual training (MOD-001 to MOD-004): Must be completed within Q1 each year
• Policy acknowledgment: Within 10 business days of notification
• New contractor onboarding: Within 5 business days of engagement commencement

6.3 Non-Compliance Consequences

• Personnel who fail to complete mandatory training within the required timeframe will have their access to Out Sauce systems restricted until training is completed
• Personnel who fail a phishing simulation will receive targeted refresher training within 5 business days
• Personnel who fail two consecutive phishing simulations will complete the full MOD-001 module again
• Repeated non-compliance will be escalated to Out Sauce Operations for review and may result in termination of contractor engagement

7. Effectiveness Measurement

Out Sauce Operations tracks the following metrics to assess training program effectiveness:

Annual Effectiveness Review

At the end of each training year (Q4), Out Sauce Operations conducts an effectiveness review that considers:

• Year-on-year trends in all metrics above
• Correlation between training and actual incident rates
• Feedback from personnel on training content and delivery
• Changes in threat landscape requiring curriculum updates
• Recommendations for the following year's training program

Results are documented in the Training Register annual summary (OS-TR-001) and reported to Out Sauce Operations.

8. Document Control

This document is classified as Internal and is maintained by Out Sauce Operations. It is available to licensees upon request as part of the Out Sauce due diligence pack.