Sharp DX Information Security Policy for Our Customers

1. introduction

1.1 Purpose

This Information Security Policy is enacted by management and documents the fundamental requirements for information security at Sharp DX (Switzerland) AG. It serves as the basis for all further instructions and activities related to information security management and demonstrates the high priority placed on the confidentiality, availability, and integrity of information in the custody of Sharp DX (Switzerland) AG.

1.2 Scope of validity

Sharp DX (Switzerland) AG recognizes that absolute security cannot be achieved in a flexibly used IT infrastructure. This policy therefore defines a target level of security, taking into account factors such as functionality, costs, efficiency, and legal requirements. In particular, Sharp DX (Switzerland) AG is committed to safeguarding its customers’ assets.

1.3. Violations

Violations are defined as actions that have actually or potentially caused, or could cause, harm. Harm is understood to include financial losses, damage to reputation, and legal violations resulting in criminal penalties. This also applies to the use of company and customer information for illegal or non-business purposes. Intentional or grossly negligent violations of this Information Security Policy and any regulations derived from it may result in disciplinary or employment-related consequences—and, in serious cases, may also result in criminal or civil liability.

1.4. Approval and Amendment

This document, the policies it contains, and any documents derived from it are binding on all internal and external employees of Sharp DX (Switzerland) AG and must be brought to their attention. The scope of this policy extends to all services, data, systems, components, and services under the responsibility of Sharp DX (Switzerland) AG. The security provisions of agreements with customers, partners, and suppliers are aligned with this Information Security Policy.

1.5. Legal, contractual, and internal requirements

Sharp DX (Switzerland) AG is committed to complying with all legal and contractual requirements.

2. security objectives

By completing the Sharp DX (Switzerland) AG Information Security Compliance Test and receiving confirmation in Sharp DX’s Learning Management System, the employee acknowledges that he or she has read and understood the Security Policy and the other requirements (see Chapter 1.5) and will comply with them accordingly.

  • Protection of assets and especially of information according to the criteria:
    • Confidentiality / Confidentiality
    • Integrity / Integrity
    • Availability / Availability
  • Sharp DX (Switzerland) AG Systems consistently adheres to its agreements with customers regarding quality and safety for all products and services it offers. The safety standards of our products and services are in line with market expectations.
  • All employees assume their own responsibility with regard to safety matters. Employees are enabled to do so through appropriate measures.
  • Contractual partners of Sharp DX (Switzerland) AG (customers, partners, service providers, external consultants, suppliers, etc.) comply with the relevant security requirements. At a minimum, a mutual non-disclosure agreement (NDA) is signed.
  • Legal regulations are complied with.

Violations are defined as actions that have caused or could cause actual or potential damage. Damage includes financial losses, damage to reputation and legal violations with penalties. This also refers to the use of company and customer information for illegal or non-official purposes.

3. implementation

Intentional or grossly negligent violations of this Information Security Policy and the regulations derived from it may result in disciplinary or employment-related consequences; in serious cases, they may also result in criminal or civil liability.

In order to achieve the objectives, the following framework conditions must be observed and ensured.

Warnings are issued by HR at the request of an Information Security Manager or a People Leader from the relevant team and are recorded in the personnel file. For disciplinary actions, the Low Performer Process may also be initiated by the People Leader or by HR.

3.1. Security Awareness

Failure to comply with contractual agreements regarding security may result in the restriction or suspension of the services provided.

3.2. Risk Management

Risk assessments are conducted periodically as part of the risk management process. The risk management system is an integral part of the information security management system and is based on the ISO 27005 standard. All relevant threats are assessed according to ISO 27005 in terms of the extent and frequency of damage. In addition, ENISA threats are periodically reviewed and reassessed.

The risk analysis serves to identify risks in detail based on compliance with the established Sharp DX (Switzerland) AG security standards, as well as any additional measures that may be taken when there is an increased need for protection. The measures defined in the Information Security Management System (ISMS) address standard threats and vulnerabilities as part of baseline security. Risk acceptance criteria are defined by senior management and reviewed annually. If risks are deemed too high, measures to mitigate them are defined.

3.3. Security Measures

Sharp DX (Switzerland) AG implements technical and organizational security measures to protect and safeguard all business-critical systems and data relevant to our business operations.

4. safety organization

4.1. Executive Management

The Executive Board of Sharp DX (Switzerland) AG bears overall responsibility for security, makes decisions in this area, and adopts the Security Policy. A management review is conducted periodically, but at least once a year. The Security Manager (CISO) and the Quality Manager (CQO) prepare a consolidated ISO 20000/27001 management report, which is signed by the Executive Board.

The report contains at least the following aspects in relation to ISO27001:

  • General condition of the safety management system
  • Audits carried out
  • Development of the security status
  • Definition and achievement of safety targets
  • Risk situation and status of special risks

4.2. CISO

The CISO is defined as a staff position for the management. He forms the interface between the Security & Compliance team and the management.

4.3. Information Security & Compliance Manager

The Security & Compliance Manager is tasked with ensuring the protection of information assets and is responsible for the implementation and coordination of security measures.

4.4. Information Owner

The information owners ensure in their area of responsibility that

  • the information and systems are classified according to business relevance
  • the safety targets are met

4.5. Information Users

Each business unit of Sharp DX (Switzerland) AG is responsible for the security of its information in terms of confidentiality, integrity, and availability, as well as for providing appropriate protection for the information in accordance with its value and the risks associated with the relevant business or technical environment. Service agreements specify the obligations of information users at the customer sites, as do contracts with external employees.

4.6. Partners, Suppliers, Visitors

If information is exchanged with a partner or supplier, a Non-Disclosure Agreement (NDA) is signed. The Sharp DX (Switzerland) AG NDA is mutually binding and applies to the collaboration defined in the NDA.

4.7. Crisis Management Team and Emergency Management

A separate process is initiated for crisis management and regularly reviewed by means of
crisis team exercises.

The crisis management team is responsible for managing business-critical incidents (such as a major incident) that escalate into crises.

Sharp DX Information Security Policy
Version: 3.0 | August 1, 2026 (Rev. Aug. 1, 2026)