Cyber Security Byelaw, 2077 11. Licensee shall have provisions for User Account and in general comply with the followings: (i) All user accounts and their privileges should be subject to an approval process and should be documented. (ii) Admin privileges and any other special access privileges should be restricted to authorized individuals and documented. (iii) Admin accounts shall only be used to perform admin tasks and not for everyday access. (iv) Admin accounts shall be set to require a password change every ninety (90) days or less. (v) Every individual user shall have a unique user name and user account. (vi) Any user account with special privileges or admin rights shall be removed or periodically disabled when no longer required or if the individual changes role or leaves the organization or after a predefined length of inactivity (e.g. if the account is not used for ninety days then it is disabled). 12. Licensee shall enforce the following rules in organization for implementing password policy: (i) Password shall be at least ten (10) characters long. (ii) Password shall include combination of upper case- and lower-case alphabets, numbers and special characters. (iii) Password shall not be same as user name. (iv) Password shall not be a dictionary word. (v) Password does not contain any identical characters next to each other (vi) Same Passwords shall not be used for multiple accounts in different platforms. (vii) Passwords shall be reused within a predetermined time period. (viii) The default password on the device shall be changed from the default to an alternative strong password. (ix) Passwords shall be changed after every ninety (90) days periodically. (x) Already used passwords shall not be used while changing passwords. 13. Licensee shall act proactively as a first line of defense to protect their customers from known attacks and for this they shall (i) Recommend tools/solutions (may include Anti-virus, antispyware, anti spam, malware protection, firewall provision, advise on backup of data, identity protection etc) to protect from the possible threats via available means of communication. Page 4 of 12