A+ A+ CORPORATION PRESENTS: INFORMATION TECHNOLOGY DEPARTMENT DATA DESTRUCTION POLICY TRAINING A+

A+ Policy Scope: Computer Hardware and Peripherals Hard Drives Thumb Drives RAM Back Up Tapes Print/Copy/Scan/Facsimile Machine Physical Records A+

A+ Training Objective: Data Destruction Policy Goes Into Effect on 11/1/16 Promulgated by the Fair Credit Reporting Act All A+ Employees & 3rd Parties are Required to Comply A+

Roles & Responsibilities: VP of IT & CIO – Sponsors & Approves Director of IT Security – Maintains IT Operations – Executes Management – Ensures Compliance IT Audit – Monitors Compliance ***All Employees*** Comply With Policy Report Non-Compliance Sign Acknowledgment (part of annual security training) A+

Data Classification Applicability: Description Public Unauthorized use or disclosure of Public data or information presents negligible risk to Company and/or its customers. Confidential Unauthorized use or disclosure of Confidential data or information presents a moderate level of risk to the Company and/or its customers. Restricted Unauthorized use or disclosure of Restricted data or information presents a significant level of risk to the Company and/or its customers. A+

Policy – Data Destruction Matrix Classification/ Medium Hard Drives Removable Storage Devices RAM Back Up Tapes Printers Physical Records Public 1, 2  1 - 2 Confidential 1, 4 1 4 1, 2, 4 5 Restricted 1, 3, 6 3, 6 1, 2, 3, 6 Minimum Destruction Requirements 1 Wipe/Clean (USB) 2 Reimage/Overwrite (tape) 3 Off-site destruction 4 On-site destruction 5 On-site shredding 6 Certificate of Destruction Required A+

A+ Enforcement: Willful Policy Violations May Result in: Disciplinary Action** Legal Action Civil Action ** Up to and Including Termination A+

A+ Acknowledgment of Data Destruction Policy Training The undersigned employee/contractors/ vendors/all other affiliates hereby acknowledges and agrees that: The employee has received the training and read the Memorandum containing an overview of the Data Destruction Policy by A+ (the “Policy”). The employee understands the terms of the Policy and agrees to abide by them. Any violation of the Policy may result in disciplinary action up to and including termination of employment for cause and Legal actions. The Policy is subject to revision by A+ which may from time to time inform employees of revisions to the Policy, and it is the employee’s responsibility to ensure that they comply with the most current Policy. I will not copy or forward the Policy, in whole or in part, to any person without the consent of the A+ IT Security Director. If you have any questions regarding the Policy or any situation not specifically addressed in the Policy, please consult with your supervisor. Designation (employee/contractors/ vendors/others): ________________________ Name: _________________________________ Signature: ______________________________ Date: ___________________________________________

Questions?