The Board of Directors has approved and continuously reviews the IT Policy and Business Continuity Plan of the Company. The management has arranged offsite data storage facilities. All the key records are being maintained at different locations. Employees are aware of the steps required to be taken in case of any emergency.

BUSINESS CONTINUITY AND DISASTER RECOVERY PLAN
The concept of Business Continuity Planning has become a major business management requirement over the past few years.

Business Continuity Plan
Business Continuity Planning is a process used to develop a practical plan for how a business can recover or partially restore critical business activities within a predetermined timeframe after a crisis or disaster. The resulting plan is called a Business Continuity Plan.

Manufacturing Facilities
Manufacturing facility of the Company is in Sub Posed Office Sugar Mills Jamrao, Umerkot Mirpurkhas, Sindh Province of Pakistan. The building is fire resilient and fully equipped with modern firefighting equipment. It also meets HSE requirements at all levels. Despite all these arrangements, insurance coverage is made at the maximum level. Therefore, in case of any natural disaster, the Company would be able to recover its financial loss through insurance coverage. Hence, partial loss would not affect the Company’s operations. Moreover, other locations of the Ghulam Faruque Group are available as alternate locations therefore; interruptions, if any, can be managed.

Identification of Potential Issues and The Plan Update
Potential issues are identified and updated from time to time to have an up to the mark solution for the anticipated problems. For the purposes of such identification, independent studies are conducted and drills are carried out. Based on the results obtained from these studies and drills, plans are updated.

Disaster Recovery Plan and IT Infrastructure
The Company’s production server facility is at PTCL Karachi with backup server facility at Lahore. In case of any disaster, the Company would be able to continue its operations smoothly. Availability of servers at such distant locations enables the Company to perform its IT functions without glitches in the event of an infrastructural damage at any particular location. Moreover, the Company is situated at various locations across Pakistan and operations may be carried out through all such locations. Also, at the time of imposition of lockdowns by the government due to COVID-19 pandemic, the employees of the Company were able to work from home smoothly via VPN clients.

Cyber Insurance
Cybersecurity insurance, is a contract that an entity can purchase to help reduce the financial risks associated with doing business online. In exchange for a monthly or quarterly fee, the insurance policy transfers some of the risk to the insurer.

Cybersecurity insurance is a new and emerging industry. Companies that purchase cybersecurity insurance today are considered early adopters. Cybersecurity policies can change from one month to the next, given the dynamic and fluctuating nature of the associated cyber-risks. Unlike well-established insurance plans, underwriters of cybersecurity insurance policies have limited data to formulate risk models to determine insurance policy coverages, rates and premiums insurer.

Currently we have no specific Cyber insurance. But we have kept the option of DR as contingency in any case of theft, disaster and cyberattack to restore the data and hardware. Resources are available to make data and hardware to restore at any level with all harmony of DR & BC.

Currently we have no specific Cyber insurance. Although, we have implemented relevant prevention about the cyber security. As result, the theft, disaster and cyberattack to restore the data and hardware as per our DR policy.

ADVANCEMENT IN DIGITAL TRANSFORMATION
In the past few decades, a fourth industrial revolution has emerged, known as Industry 4.0. Industry 4.0 takes the emphasis on digital technology from recent decades to a whole new level with the help of interconnectivity through the Internet of Things (loT), access to real-time data, and the introduction of cyber physical systems. Industry 4.0 offers a more comprehensive, interlinked, and holistic approach to manufacturing. It connects physical with digital, and allows for better collaboration and access across departments, partners, vendors, product, and people. Industry 4.0 empowers business owners to better control and understands every aspect of their operation, and allows them to leverage instant data to boost productivity, improve processes, and drive growth.

There are hundreds of concepts and terms (ERR, loT, RPA, Block chain, Al, Big data, Cloud Computing etc) that relate to Industry 4.0, but we have to decide in which domain we want to invest in Industry 4.0 solutions as per our business requirement.

In our case, board of directors in IT steering committee decided to invest in ERP and Cloud computing to improve business process management tools and reporting that can be used to manage information across an organization

Marketing and Other Staff
The Company’s senior management, as a part of Ghulam Faruque Group, is present across Pakistan and not restricted to one location. In case of an mishap, operations can be taken over and continued from any other location.

Cloud Computing
Cloud computing is the delivery of computing services including servers, storage, databases, networking, software, analytics, and intelligence over the Internet (“the cloud”) to offer faster innovation, flexible resources, and economies of scale. You typically pay only for cloud services you use, helping you lower your operating costs, run your infrastructure more efficiently, and The Board of Directors has decided to migrate company’s on premises SAP ERP solution to S4/HANA on cloud in IT steering committee. Company is now moving towards S4/HANA and Success Factors on cloud. Multiple cloud service provider solutions have been reviewed and evaluated in IT steering committee and finalized one cloud service provider. S4/HANA and Success factor on cloud is on execution phase and expected to be live by the end of year 2023.

STAFF TRAINING TO AVOID CYBERSECURITY THREAT AND RISKS
IT steering committee advised IT team to regularly informed and organized training for the company’s end users to follow best standard practices to avoid any cybersecurity threats & risks.

IT team regularly conduct information security awareness session. The purpose of security awareness is to focus attention on security, creating sensitivity to the threats and vulnerabilities of computer systems and recognition of the need to protect data, information and systems. Security awareness training helps to minimize risk thus preventing the loss of Pll, IP, and money or brand reputation. An effective awareness training program addresses the cybersecurity mistakes that employees may make when using email, the web and in the physical world such as tailgating or improper document disposal.