1. Information Security Everyday Best Practices Lock your workstation when you walk away – Hit Ctrl + Alt + Delete Store your passwords securely and don’t share them with anyone – Use a password protected Excel file or lock them away in a cabinet Be careful what you write – Write every email as if it may become public Be suspicious of emails with attachments and links – Even if that email appears to come from within CBS or from a well known organization (airline, bank, etc) Report quickly – If something seems odd with your computer or you accidentally click on a suspicious link, call the CBS Service Desk or email security.incidents@cbs.comsecurity.incidents@cbs.com Transfer files securely – If you have to email an attachment that has sensitive information – password protect that attachment and send the password through another channel (phone, text, IM) Use only approved services for CBS information – Use only CBS email for CBS business and only approved file sharing services Practice “need to know” – Only share sensitive or highly confidential information with those that require it for conducting their job duties Keep an eye on your mobile devices at all times – Portable devices are very easy to steal or lose, make sure you’re being careful If you have further information security questions contact the CBS Information Security Group at infosec.questions@cbs.cominfosec.questions@cbs.com

2. The Information Security Group Information Security Policies and Standards can be found on Stagehand – https://stagehand.cbs.com https://stagehand.cbs.com Information Security questions: – Infosec.questions@cbs.comInfosec.questions@cbs.com Report anything suspicious to ISG – Security.incidents@cbs.com Security.incidents@cbs.com – CBSSpamAdmin@cbs.com CBSSpamAdmin@cbs.com

3. Information Security Best Practices Your Role in Incident Response What is an Information Security Incident? Use of CBS information systems contrary to CBS policy Unauthorized access to CBS computer systems or CBS information Suspicious activity on CBS computer systems or CBS employee owned personal computer or mobile devices that contain CBS information Loss or theft of CBS owned or personal computer systems, mobile devices or other devices that contain CBS data It’s an incident… What should I DO? Call the CBS Service Desk (800) 507-8382 or email them at helpdesk@cbs.com helpdesk@cbs.com Email the Information Security Group at security.incidents@cbs.com security.incidents@cbs.com It’s an incident… What should I NOT DO? Don’t take any direct action unless instructed to do so by the CBS Service Desk or other IT support (such as unplugging wires, disconnecting from the network, shutting down your computer) Don’t contact Law Enforcement (Corporate Security will do that when necessary) Don’t post anything about the incident on social media sites Provide as much information as possible! Pornography Don’t contact any media organizations

4. try a phrase instead of a word like: “@ CBS1 you know 7hat our people R the best!” Go Long 1-9, @, &, *, !, $, % Use numbers and special characters If you have to write down passwords, do so in a password protected or encrypted excel spreadsheet Don’t use “password” in the file name Store it securely Keep your CBS and personal passwords diverse and separate Don’t reuse passwords Information Security Best Practices Foundation of a Secure Password If you have further information security questions contact the CBS Information Security Group at infosec.questions@cbs.cominfosec.questions@cbs.com

5. Keep an eye on your items at all times or store them securely Use a screen filter to avoid others “shoulder surfing” Use approved CBS technology (VPN) when using wifi Use a secure, password protected non-public wifi Discuss sensitive CBS information in public Let anyone else use your CBS provided device or account Use public computers or kiosks to access CBS systems or information (i.e. webmail) Information Security Best Practices Working Remotely If you have further information security questions contact the CBS Information Security Group at infosec.questions@cbs.cominfosec.questions@cbs.com

6. Keep the software up to date If you lose it or it’s stolen, report it immediately Use a secure PIN (not 1111 or your birthday) Don’t connect to public wifi networks Backup your device Encrypt your device Information Security Best Practices Securing Your Mobile Device If you have further information security questions contact the CBS Information Security Group at infosec.questions@cbs.cominfosec.questions@cbs.com