top of page

CYBERSECURITY POLICY

1. POLICY STATEMENT

Gamezon Space Corporation (“Gamezon”, “Company”, or “Corporation”) recognizes cybersecurity as a critical operational, financial, technological, and governance priority essential to protecting its global digital infrastructure, shareholder systems, investor platforms, e-commerce operations, fintech services, intellectual property, and confidential information assets.

​

This Cybersecurity Policy establishes the Company’s framework for securing systems, networks, applications, databases, cloud environments, and digital operations against cyber threats, unauthorized access, disruption, fraud, misuse, and malicious attacks.

The Company is committed to maintaining a proactive cybersecurity posture through risk management, monitoring, prevention, incident response, and continuous security improvement.

​

2. PURPOSE OF THE POLICY

This Policy aims to:

  • Protect digital infrastructure and systems;

  • Prevent unauthorized access and cyberattacks;

  • Secure investor and shareholder information;

  • Establish operational cybersecurity standards;

  • Ensure business continuity;

  • Reduce operational and financial cyber risks;

  • Maintain regulatory and compliance obligations.

​

3. SCOPE OF APPLICATION

This Policy applies to:

  • Employees

  • Directors

  • Investors

  • Shareholders

  • Contractors

  • Vendors

  • Third-party providers

  • Consultants

  • Platform users with authorized access

This Policy covers all:

  • Networks

  • Servers

  • Applications

  • Databases

  • Websites

  • APIs

  • Cloud systems

  • Devices

  • Internal communication systems

  • Financial platforms

used or managed by the Company.

​

4. CYBERSECURITY GOVERNANCE

The Company shall establish cybersecurity governance procedures including:

  • Executive oversight;

  • Security risk management;

  • Compliance monitoring;

  • Incident management;

  • Internal security reviews;

  • Security policy enforcement.

​

5. ACCESS MANAGEMENT

The Company shall implement strict access management controls.

​

5.1 Access Authorization

Access to systems shall be granted only to authorized individuals based on:

  • Job responsibilities;

  • Operational necessity;

  • Security approval levels.

5.2 Least Privilege Principle

Users shall receive the minimum access necessary to perform authorized functions.

5.3 Account Management

The Company may implement:

  • User account approvals;

  • Access reviews;

  • Account deactivation procedures;

  • Privileged access controls.

​

6. AUTHENTICATION SYSTEMS

The Company shall use secure authentication mechanisms including:

  • Multi-factor authentication (MFA);

  • Password security requirements;

  • Biometric verification;

  • Secure session controls;

  • Device authentication procedures.

6.1 Password Standards

Passwords shall:

  • Meet minimum complexity requirements;

  • Be regularly updated;

  • Remain confidential;

  • Never be shared.

​

7. SECURITY MONITORING

The Company shall maintain continuous monitoring of systems and infrastructure to detect security threats and suspicious activity.

Monitoring tools may include:

  • Intrusion detection systems (IDS);

  • Intrusion prevention systems (IPS);

  • Security information and event management (SIEM);

  • Endpoint detection and response (EDR);

  • Network traffic monitoring;

  • Log management systems.

​

8. INFRASTRUCTURE PROTECTION

The Company shall protect critical infrastructure through:

  • Firewalls;

  • Network segmentation;

  • Secure cloud architecture;

  • Endpoint security;

  • Vulnerability management;

  • Security patching;

  • Backup systems;

  • Redundancy controls.

​

9. DATA SECURITY

Sensitive information shall be protected through:

  • Encryption;

  • Access controls;

  • Secure storage;

  • Data classification;

  • Backup and recovery systems;

  • Secure transmission protocols.

​

10. INCIDENT RESPONSE PROCEDURES

The Company shall maintain cybersecurity incident response procedures for detecting, managing, investigating, and recovering from cyber incidents.

​

10.1 Reportable Incidents

Examples include:

  • Unauthorized access;

  • Malware attacks;

  • Data breaches;

  • Ransomware incidents;

  • Phishing attacks;

  • Distributed denial-of-service (DDoS) attacks;

  • Insider threats.

​

10.2 Incident Response Process

The Company may:

  1. Detect and identify incidents;

  2. Contain affected systems;

  3. Investigate root causes;

  4. Mitigate risks;

  5. Restore operations;

  6. Notify stakeholders where required;

  7. Implement corrective actions.

​

11. SECURITY TESTING & VULNERABILITY MANAGEMENT

The Company may conduct:

  • Penetration testing;

  • Vulnerability assessments;

  • Security audits;

  • Infrastructure scans;

  • Application security reviews.

Identified vulnerabilities shall be remediated promptly.

​

12. EMPLOYEE SECURITY RESPONSIBILITIES

Employees must:

  • Follow cybersecurity procedures;

  • Protect login credentials;

  • Avoid unauthorized software installations;

  • Report suspicious activities;

  • Complete security awareness training.

​

13. THIRD-PARTY SECURITY REQUIREMENTS

Third-party vendors and service providers must:

  • Maintain adequate cybersecurity standards;

  • Protect Company data;

  • Comply with security obligations;

  • Report cybersecurity incidents promptly.

The Company reserves audit rights over third-party security controls.

​

14. BUSINESS CONTINUITY & DISASTER RECOVERY

The Company shall maintain:

  • Backup systems;

  • Disaster recovery plans;

  • Incident recovery procedures;

  • Operational continuity frameworks.

Critical systems shall be recoverable within defined recovery objectives.

​

15. CYBERSECURITY TRAINING & AWARENESS

The Company shall conduct periodic training covering:

  • Phishing prevention;

  • Password security;

  • Social engineering risks;

  • Secure system usage;

  • Incident reporting procedures.

​

16. POLICY VIOLATIONS

Violations of this Policy may result in:

  • Suspension of system access;

  • Disciplinary action;

  • Termination of employment or contracts;

  • Regulatory reporting;

  • Legal action.

​

17. AUDITS & POLICY REVIEW

The Company shall periodically review and update cybersecurity controls and policies to address evolving threats and operational requirements.

​

18. GOVERNING LAW

This Policy shall be governed by the laws of:

the Repulic of Kenya and applicable international cybersecurity and data protection regulations.

 

19. POLICY APPROVAL

Approved by:

Gamezon Space Corporation

Authorized By: Wycliffe Wejuli
Title: The Company President
Date: 1st May, 2026

Signature: _________________________________________

​

OPTIONAL ADVANCED CYBERSECURITY CONTROLS

The Company may additionally implement:

  • Zero-trust architecture

  • AI-powered threat intelligence

  • Blockchain security verification

  • SOC (Security Operations Center)

  • Real-time attack monitoring

  • Threat hunting systems

  • Cloud-native security controls

  • Secure DevSecOps pipelines

  • Identity & access governance

  • Endpoint isolation technologies

  • Dark web threat monitoring

  • Automated incident response systems

bottom of page