Management Procedures Vulnerability Risk AssessmentIncident Adversary CountermeasurePolicies Intrusion Detection Information Countermeasures Program CORPORATE SECURITY PLAN April, 2016 24 Hour Emergency Number 1-866-267-5298 CORPORATE SECURITY PLAN PREPARED BY: APRIL, 2016 Ikkuma Resources Corp. Corporate Security Plan Manual Receipt Form Upon receipt of this Ikkuma Resources Corp. Corporate Security Plan, this Receipt Form must be completed and returned to the Senior VP Engineering in the Corporate Office. The Manual holder is responsible for ensuring that the Manual is kept current by inserting the latest revisions as they are issued. Name (please print): Position: Date: Signed: Return signed copy to: Ikkuma Resources Corp. 2700, 605 - 5th Ave SW Calgary, AB T2P 3HS Phone: 403-261-5900 Fax: 403-261-5902 Email: [email protected] Attention: Yvonne McLeod Senior VP Engineering Ikkuma Corporate Security Plan Administration PROGRAM ADMINISTRATION RESPONSIBILITY The responsibility for maintaining this Corporate Security Plan (“The Plan”) is three fold: 1. All manual recipients are responsible for ensuring that their assigned manuals are current. 2. Information in this plan will be verified and updated annually. The Senior VP Engineering is responsible for ensuring the Plan is reviewed by all personnel annually and immediately after any changes have been made to the manual. 3. The Senior VP Engineering is responsible for updating the manual. Any requests for revisions to the Plan should be forwarded to the Senior VP Engineering or approval and implementation. April, 2016 Page 1 of 4 Ikkuma Corporate Security Plan Administration REVISION MATRIX Site Specific Area: Matrix Administrator: Plan Revision Annually Update Company Personnel Contact List Document and Map Updates’ Confirm Response Agencies and Government Support Update Distribution List Conduct Response Training Note: Updates to the manual will be issued to all manual holders annually. April, 2016 Page 2 of 4 Ikkuma Corporate Security Plan Administration REVISION REQUEST FORM Recommended By: (Signature) (Name and title) Date: Approved By: (Signature) (Name and title) Date: Copies of revised pages attached: Yes No Section(s) and pages(s) amended or replaced: Section Page(s) Section Page(s) Purpose / Comments: April, 2016 Page 3 of 4 Ikkuma Corporate Security Plan Administration Revision Log Revision # Date Description Create a Corporate Security Plan to satisfy National Energy Board requirements (OPR 99, PRC 2010-01 Pipeline 1 April 2016 Security Management Programs) and in accordance with CAN-CSA Z246.1-13. 2 August 2017 Revision only to Corporate Emergency Response Team 3 March 2018 Revision only to Corporate Emergency Response Team Revision to Corporate Emergency Response Team, Field 4 February 2019 Personnel and Other Consultant Revised Title on 4.3 Revision to Telephone Directory Revision to Emergency Contact Information Revision to Emergency Contact Information - Ojay NEB Regulated Pipeline Revision to Specific Roles & Duties - Ojay NEB Regulated Pipeline April, 2016 Page 4 of 4 Ikkuma Corporate Security Plan Table of Contents SECURITY MANAGEMENT PLAN DISTRIBUTION LIST ...................................................................................................... 1 INTRODUCTION ............................................................................................................. 1 2.1 Introduction .................................................................................................................. 1 2.2 Purpose ....................................................................................................................... 2 2.3 Scope .......................................................................................................................... 3 2.4 Security Policy ............................................................................................................. 3 2.5 Document Maintenance and Distribution Process ........................................................ 3 2.6 Training and Testing the Security Management Plan ................................................... 4 2.7 Security Vulnerability Assessment ............................................................................... 4 2.8 Audits and Security Plan Review ................................................................................. 4 2.9 Change Management, Evaluation and Improvement Process ...................................... 4 2.10 References .................................................................................................................. 4 GLOSSARY .................................................................................................................... 1 SECURITY MANAGEMENT PROGRAM (SMP) ............................................................. 1 4.1 General ........................................................................................................................ 1 4.2 Management Commitment ........................................................................................... 1 4.3 President and CEO ...................................................................................................... 1 (Company Security Officer) ................................................................................... 1 District / Area / Production Foreman and Superintendents .................................... 2 CEOC Liaison Officer ............................................................................................ 2 Ikkuma Corporate EOC ......................................................................................... 2 Security Incident Investigation Team ..................................................................... 2 Initial Media Statement .......................................................................................... 2 4.4 Indicators ..................................................................................................................... 3 Global, Regional and Local Indicators ................................................................... 4 SECURITY RISK MANAGEMENT PROCESS ................................................................ 1 5.1 Asset Characterization ................................................................................................. 2 Process ................................................................................................................. 2 5.2 Threat Assessment ...................................................................................................... 2 General ................................................................................................................. 2 Process ................................................................................................................. 2 5.3 Vulnerability Assessment ............................................................................................. 3 5.4 Risk Assessment ......................................................................................................... 3 5.5 Security Risk Assessment ............................................................................................ 3 5.6 Risk Matrix ................................................................................................................... 4 5.7 Risk Matrix ................................................................................................................... 5 5.8 Risk Mitigation ............................................................................................................. 5 5.9 Communication and Recommendations ....................................................................... 5 5.10 Threat Response (Graduated Threat Mitigation) Matrix ............................................... 6 INFORMATION SECURITY MANAGEMENT.................................................................. 1 INFORMATION TECHNOLOGY / CONTROL SYSTEMS SECURITY ............................ 1 7.1 Information Technology ............................................................................................... 1 7.2 Control System Security............................................................................................... 1 PERSONNEL SECURITY ............................................................................................... 1 April, 2016 Page 1 of 3 Ikkuma Corporate Security Plan Table of Contents 8.1 Security Awareness Training ....................................................................................... 1 PHYSICAL SECURITY MEASURES .............................................................................. 1 9.1 Threats to personnel, assets AND environment .......................................................... 1 9.2 Minimum Operational Security Standards (MOSS) ...................................................... 1 Physical Security ................................................................................................... 2 Access Control Procedures ................................................................................... 3 Contingency Plans ................................................................................................ 3 Communications ................................................................................................... 3 Security Training and Awareness .......................................................................... 4 Guards and Patrol Force ......................................................................................