Applicability: AMG Quality Services LLC, The OEMS© – Designed to Amaze, employees, contractors, authorized service providers, and applicable technology environments
Classification: Public
Review Frequency: At least annually or upon significant regulatory, contractual, technological, or security change
1. Purpose
AMG Quality Services LLC (“AMGQS”) is committed to protecting the confidentiality, integrity, and availability of information and technology assets used in providing its professional services and The OEMS© – Designed to Amaze software platform.
This policy establishes AMGQS’s cybersecurity and information-security principles and defines the controls used to protect company information, customer information, technology assets, cloud environments, applications, and supporting infrastructure from unauthorized access, misuse, alteration, disclosure, disruption, or destruction.
AMGQS maintains a risk-based cybersecurity program intended to support applicable customer, contractual, regulatory, and internationally recognized cybersecurity requirements.
2. Cybersecurity Framework
AMGQS’s cybersecurity program is designed with consideration of recognized cybersecurity standards and frameworks, including, where applicable:
Saudi National Cybersecurity Authority Essential Cybersecurity Controls (NCA ECC 2-2024);
Saudi National Cybersecurity Authority Cloud Cybersecurity Controls (NCA CCC 2-2024);
Saudi National Cybersecurity Authority Data Cybersecurity Controls (NCA DCC-1:2022);
ISO/IEC 27001:2022;
ISO/IEC 27002:2022;
NIST Cybersecurity Framework;
applicable contractual cybersecurity requirements; and
applicable United States federal and state requirements.
The applicability of individual regulatory or contractual requirements is evaluated based on the services provided, customer requirements, information classification, and technology environment.
3. Scope
This policy applies to:
AMGQS employees;
contractors and authorized consultants;
information systems operated or administered by AMGQS;
The OEMS© – Designed to Amaze platform;
company-owned or company-managed technology assets;
cloud environments and hosted applications;
company networks and endpoints;
customer information entrusted to AMGQS;
third-party services supporting AMGQS operations; and
authorized remote-access environments.
All persons granted access to AMGQS information systems are responsible for complying with applicable cybersecurity requirements.
4. Information and Personal Data Minimization
AMGQS systems are primarily designed to manage business, quality, health and safety, supplier, project, audit, operational, and technical information.
AMGQS does not intend to operate its systems as repositories of personal or sensitive personal information.
Customers and authorized users are expected to avoid entering unnecessary personal, sensitive, medical, financial, biometric, government-identification, or other personally sensitive information into AMGQS systems unless specifically authorized through an applicable agreement.
Where limited business-user identification is technically necessary for system authentication, access control, audit trails, security monitoring, electronic approvals, or system administration, AMGQS limits such information to the minimum reasonably necessary for those purposes.
Any personal information inadvertently entered into an AMGQS system should be reported to AMGQS for appropriate assessment and disposition.
Customer technical, operational, quality, supplier, project, and commercial information remains protected as confidential information regardless of whether such information constitutes personal data.
5. Cybersecurity Governance
AMGQS management maintains oversight of the cybersecurity program.
Responsibilities include:
approving cybersecurity policies and significant changes;
establishing cybersecurity responsibilities;
assessing cybersecurity risks;
providing appropriate resources;
monitoring security performance;
reviewing significant security incidents;
approving risk-treatment actions where necessary; and
reviewing the cybersecurity program periodically.
Cybersecurity responsibilities shall be assigned to personnel with appropriate authority and competence.
6. Cybersecurity Risk Management
AMGQS applies a risk-based approach to cybersecurity.
Cybersecurity risks may arise from:
software applications;
cloud infrastructure;
suppliers and technology providers;
unauthorized access;
malware and ransomware;
vulnerabilities;
software changes;
remote access;
system integrations;
cyberattacks;
service interruptions;
data loss;
configuration weaknesses;
third-party dependencies; and
emerging cybersecurity threats.
Identified risks are evaluated based on likelihood and potential impact.
Appropriate controls, mitigation actions, monitoring, acceptance, or other treatments are implemented according to the level of risk.
Cybersecurity risk assessments are reviewed periodically and following significant system, technology, supplier, or business changes.
7. Information Asset Management
AMGQS maintains appropriate identification and management of information and technology assets.
Assets may include:
applications;
databases;
cloud services;
servers;
computers;
network equipment;
software;
repositories;
communication systems;
backup environments; and
customer environments administered by AMGQS.
Assets shall have appropriate ownership and shall be protected according to their importance and information classification.
Unauthorized hardware, software, cloud services, or technology shall not be introduced into controlled AMGQS environments without appropriate authorization.
8. Information Classification and Handling
AMGQS applies information-handling controls appropriate to the sensitivity and business importance of information.
Information may be categorized using classifications such as:
Public
Information approved for public distribution.
Internal
Information intended primarily for AMGQS internal business use.
Confidential
Information requiring protection from unauthorized disclosure.
Customer Confidential
Customer-provided or customer-related information requiring restricted access and protection.
Information shall be accessed, transmitted, stored, shared, retained, and disposed of according to its classification and associated risk.
Customer-confidential information shall not be disclosed to unauthorized parties.
9. Identity and Access Management
Access to AMGQS information systems shall be based on legitimate business requirements.
AMGQS applies principles including:
unique user identification where appropriate;
role-based access;
least-privilege access;
need-to-know access;
multi-factor authentication where technically supported and appropriate;
controlled administrative privileges;
periodic access review;
prompt modification of access following role changes; and
removal of access when no longer required.
Privileged administrative access shall be limited to specifically authorized personnel.
Access credentials shall not be shared except through specifically approved technical mechanisms.
10. Authentication and Credential Security
AMGQS requires appropriate authentication controls to protect systems against unauthorized access.
Controls may include:
strong authentication requirements;
multi-factor authentication;
secure credential storage;
account-lockout protections;
session-management controls;
password management;
restricted administrative accounts; and
secure service-account management.
Default credentials shall be changed before systems are placed into production where applicable.
11. Acceptable Use of Technology
AMGQS information systems shall be used only for authorized business purposes.
Users shall not:
intentionally bypass cybersecurity controls;
install unauthorized software;
share credentials;
introduce malicious software;
access information without authorization;
conduct unauthorized security testing;
use systems for unlawful activities; or
expose customer or AMGQS confidential information to unauthorized parties.
Suspected misuse may result in suspension or removal of access.
12. Cloud and Hosting Security
AMGQS utilizes cloud and hosted technologies to support its services.
Cloud environments shall be selected and managed using risk-based security considerations, including:
provider security capabilities;
access controls;
authentication;
encryption;
backup;
availability;
logging;
data protection;
incident response;
supplier assurance;
contractual requirements; and
service continuity.
Cloud environments shall be configured according to secure implementation practices.
Administrative access to cloud environments shall be restricted.
AMGQS periodically reviews material cloud-service dependencies and associated cybersecurity risks.
13. Network and Communications Security
AMGQS maintains security controls designed to protect network communications and information transmission.
Controls may include:
secure network configurations;
firewalls;
secure protocols;
encrypted communications;
controlled remote access;
protected wireless connectivity;
network segmentation where appropriate;
restricted management interfaces; and
monitoring of suspicious network activity.
Obsolete or insecure communication protocols shall be restricted or disabled where reasonably practicable.
14. Endpoint and Malware Protection
Endpoints used to access AMGQS-controlled systems shall be appropriately protected.
Security measures may include:
anti-malware protection;
endpoint detection and response capabilities;
operating-system security controls;
device encryption;
automatic locking;
patch management;
controlled administrative privileges;
removable-media restrictions; and
security monitoring.
Users shall promptly report suspected malware, ransomware, unauthorized access, or other unusual device behavior.
15. Configuration and System Hardening
AMGQS systems shall be configured using secure baseline practices appropriate to their function and risk.
Security configurations may include:
removal or disabling of unnecessary services;
restriction of administrative interfaces;
secure account configuration;
firewall configuration;
secure protocols;
appropriate encryption;
security logging;
timely security updates; and
removal of unnecessary default accounts or credentials.
Security configurations shall be reviewed following significant system changes where appropriate.
16. Vulnerability and Patch Management
AMGQS maintains processes for identifying and addressing cybersecurity vulnerabilities.
Activities may include:
vulnerability scanning;
security advisories;
vendor notifications;
patch assessment;
software updates;
risk-based remediation;
configuration correction; and
verification of corrective actions.
Vulnerabilities are prioritized based on factors such as severity, exploitability, exposure, system criticality, and business impact.
Critical vulnerabilities shall receive priority attention.
17. Secure Software Development
Cybersecurity shall be considered throughout the development and maintenance of AMGQS software systems.
Secure-development practices may include:
authorization of changes;
secure coding principles;
access restrictions;
code review;
testing;
vulnerability evaluation;
controlled deployment;
separation between development and production functions where appropriate;
rollback planning; and
protection of source code and repositories.
Unauthorized production changes are prohibited.
18. Change Management
Material changes to production systems, applications, integrations, infrastructure, and security configurations shall be appropriately evaluated before implementation.
Change-management controls may include:
documented change requests;
impact evaluation;
cybersecurity risk assessment;
authorization;
testing;
deployment controls;
verification; and
rollback or recovery planning.
Emergency changes shall be reviewed following implementation where normal pre-approval processes cannot reasonably be completed.
19. Cryptography and Encryption
AMGQS uses cryptographic protections where appropriate to protect sensitive information.
Measures may include encryption:
during transmission;
at rest;
within backups;
through secure web communications;
through approved authentication technologies; and
during authorized remote access.
Cryptographic technologies shall use recognized and supported standards where reasonably practicable.
Encryption keys, certificates, and secrets shall be protected against unauthorized access.
20. Logging, Monitoring, and Audit Trails
AMGQS systems may generate and maintain security and operational logs to support:
cybersecurity monitoring;
authentication records;
troubleshooting;
system integrity;
incident investigation;
administrator accountability;
audit activities; and
customer-support requirements.
Logging may include:
successful and unsuccessful authentication attempts;
administrator actions;
security events;
system changes;
application events;
network-security events; and
other activities determined to be relevant to security.
Access to logs shall be restricted to authorized personnel.
Logs shall be protected from unauthorized modification and retained according to business, contractual, security, and technical requirements.
21. Cybersecurity Incident Management
AMGQS maintains a process to identify, evaluate, respond to, recover from, and learn from cybersecurity incidents.
Cybersecurity incidents may include:
unauthorized access;
suspected compromise;
malware;
ransomware;
data loss;
unauthorized disclosure;
system manipulation;
service disruption;
credential compromise;
cyberattack;
cloud compromise; or
significant security vulnerability exploitation.
Incident-response activities may include:
detection and reporting;
initial assessment;
classification;
containment;
investigation;
eradication;
recovery;
customer communication where appropriate;
root-cause evaluation;
corrective action; and
lessons learned.
Customers shall be notified of confirmed security incidents affecting their information or services in accordance with applicable contractual requirements.
Incident information shall be maintained confidentially and shared only with authorized parties.
22. Business Continuity and Cyber Resilience
AMGQS maintains business-continuity and recovery capabilities appropriate to critical services.
Planning may address:
cybersecurity incidents;
technology outages;
cloud-service interruptions;
loss of infrastructure;
hardware failure;
software failure;
loss of connectivity;
natural disasters;
supplier failures; and
other significant disruptions.
Recovery priorities shall be determined based on business impact, customer requirements, and criticality.
Business-continuity and recovery arrangements shall be periodically evaluated.
23. Backup and Recovery
Critical information and system configurations shall be backed up according to operational and risk requirements.
Backup controls may include:
scheduled backups;
redundant storage;
access restrictions;
encryption;
backup monitoring;
retention requirements;
restoration testing; and
protection against unauthorized modification or deletion.
AMGQS periodically verifies backup and restoration capabilities appropriate to system criticality.
24. Third-Party and Supplier Cybersecurity
Third-party providers may support AMGQS technology, cloud infrastructure, hosting, communications, software, integrations, or other business services.
Cybersecurity risks associated with significant suppliers shall be evaluated based on their role and access.
Relevant third-party controls may include:
security due diligence;
contractual security requirements;
confidentiality obligations;
access restrictions;
security certifications or assurance evidence;
incident-notification obligations;
continuity requirements; and
termination or offboarding requirements.
Third-party access shall be limited to authorized business requirements.
AMGQS remains responsible for managing cybersecurity risks associated with suppliers within its reasonable operational control.
25. Remote Work and Remote Access
Remote access to AMGQS-controlled systems shall be authorized and appropriately secured.
Controls may include:
approved devices;
encrypted connections;
secure authentication;
multi-factor authentication;
restricted administrator access;
device-security controls;
session timeout;
endpoint protection; and
secure network practices.
Users shall take reasonable precautions to prevent unauthorized viewing or access to confidential information while working remotely.
26. Physical and Environmental Security
Physical access to systems and equipment supporting AMGQS operations shall be limited according to business requirements.
Security measures may include:
restricted access to equipment;
protection of computers and portable devices;
visitor controls;
secure equipment disposal;
protection from environmental threats; and
secure storage of sensitive equipment or media.
Cloud-hosted infrastructure is additionally subject to physical-security controls maintained by applicable hosting providers.
27. Cybersecurity Awareness and Competency
Persons with access to AMGQS systems shall receive cybersecurity awareness appropriate to their responsibilities.
Awareness may include:
phishing;
credential security;
malware;
social engineering;
confidential-information handling;
incident reporting;
remote-working security;
secure software practices; and
customer-information protection.
Personnel with specialized cybersecurity responsibilities shall maintain appropriate knowledge and competence.
28. Information Retention and Secure Disposal
Information shall not be retained longer than reasonably required for:
business purposes;
customer requirements;
contractual obligations;
cybersecurity;
dispute resolution;
legal requirements; or
legitimate recordkeeping.
When information or equipment is no longer required, appropriate disposal methods shall be used.
Disposal methods may include:
secure deletion;
cryptographic erasure;
destruction of storage media;
account termination; or
other methods appropriate to information sensitivity.
29. Customer Information Protection
AMGQS recognizes customer information as a critical business asset.
Customer information shall:
be accessed only for authorized purposes;
be protected according to its sensitivity;
not be intentionally disclosed to unauthorized parties;
be transmitted using appropriate security measures;
be stored in authorized environments;
be protected from unauthorized alteration or deletion; and
be returned or disposed of in accordance with contractual requirements where applicable.
Customer ownership of customer-provided information is not transferred to AMGQS merely through use of AMGQS services.
30. Security Testing and Assurance
AMGQS may conduct security assessments appropriate to system risk.
Activities may include:
vulnerability assessments;
configuration reviews;
access reviews;
penetration testing;
security-control testing;
application testing;
backup-restoration testing;
incident-response exercises; and
supplier assessments.
Identified issues shall be documented and addressed according to their risk and severity.
Security testing shall be performed only by authorized personnel.
31. Cybersecurity Compliance and Internal Review
AMGQS periodically evaluates its cybersecurity program against applicable:
company policies;
contractual requirements;
customer requirements;
recognized cybersecurity standards;
relevant regulatory requirements; and
security best practices.
Where deficiencies are identified, appropriate corrective actions shall be established.
The cybersecurity program may be updated in response to:
cybersecurity incidents;
new threats;
vulnerabilities;
technology changes;
regulatory changes;
customer requirements;
supplier changes; or
lessons learned.
32. Noncompliance
Failure to comply with applicable cybersecurity requirements may result in:
access restriction;
suspension of system privileges;
corrective action;
contractual remedies; or
other appropriate actions.
Suspected violations should be reported to AMGQS management.
33. Cybersecurity Reporting
Suspected cybersecurity incidents, unauthorized access, security vulnerabilities, or other cybersecurity concerns affecting AMGQS systems should be reported promptly to AMGQS.
AMG Quality Services LLC
Website: www.amgqs.com
Email: sales@amgqs.com
Security-related reports will be evaluated and directed to appropriate authorized personnel.
34. Continuous Improvement
AMGQS is committed to continually improving its cybersecurity program.
Improvement activities may include:
monitoring emerging cybersecurity threats;
evaluation of new technologies;
security-control enhancements;
periodic risk assessments;
security awareness;
automation;
lessons learned from incidents;
supplier reviews;
system modernization; and
consideration of changes to applicable cybersecurity standards and customer requirements.
35. Policy Review
This policy shall be reviewed:
at least annually;
following a significant cybersecurity incident;
following major changes to AMGQS systems or services;
following significant regulatory or contractual changes; or
when cybersecurity risk materially changes.
AMGQS reserves the right to revise this policy as necessary to address evolving technology, cybersecurity threats, legal requirements, customer expectations, and recognized cybersecurity practices.
36. References
This policy has been developed with consideration of applicable and recognized cybersecurity requirements and practices, including:
Saudi National Cybersecurity Authority Essential Cybersecurity Controls (ECC 2-2024);
Saudi National Cybersecurity Authority Cloud Cybersecurity Controls (CCC 2-2024);
Saudi National Cybersecurity Authority Data Cybersecurity Controls (DCC-1:2022);
ISO/IEC 27001:2022;
ISO/IEC 27002:2022; and
NIST Cybersecurity Framework.
Reference to these frameworks does not constitute a claim of certification or regulatory applicability unless specifically stated by AMGQS.
37. Disclaimer
This public policy describes AMG Quality Services LLC’s general cybersecurity and information-security principles.
Specific controls may vary based on system architecture, customer requirements, contractual commitments, risk level, and technical feasibility.
Publication of this policy does not disclose confidential security architecture, security configurations, credentials, vulnerability information, incident-response details, or other information that could reasonably increase cybersecurity risk.
Policy No. CS-101 Rev 2.0
September 19th 2026
Where a customer contract imposes cybersecurity requirements exceeding this policy, the applicable contractual requirements shall govern to the extent agreed by AMGQS.