Basic Policy

Since its establishment on December 25, 2001, NIA Engineering Co., Ltd. (hereinafter referred to as “the Company”) has been engaged in a variety of business fields, including construction, the environment, and technology. Through the provision of professional engineering services that contribute to the development of society, we strive to remain a company that is trusted by our clients and stakeholders.

To translate this philosophy into concrete action, we have established our “Corporate Creed” as the foundation for our daily conduct. Furthermore, to address the critical challenge of protecting information assets in modern society, we have formulated our “Information Security Basic Policy” and “Personal Information Protection Policy .” All officers and employees are required to adhere to these policies.

Corporate Creed

●Customer Relations

1. Be a small, brilliantly shining professional group filled with dreams and romance.
2. Earn the trust and confidence of customers through sincerity and dedication.

●Internal Relations

1. Devote ourselves to positive and productive teamwork.
2. Never shy away from hard work.
3. Thoroughly practice “Ho-Ren-So” method (reporting, contacting, and consulting).
4. Eliminate the “3M” (“Muda, Mura, Muri”) of waste, inconsistency, and overburden (such as long phone calls or unnecessary copying).

●Human Relations

1. Work with compassion.
2. Value harmony and cooperation.
3. Always practice courteous greetings.

Information Security Basic Policy

1. Responsibility of Management
Management shall take the lead in promoting the continuous improvement and advancement of information security on an organizational basis.
2. Establishment of Internal Framework
The Company shall establish an internal framework aimed at maintaining and improving information security. This framework will define security measures as formal internal rules.
3. Employee Initiatives
Employees shall acquire the knowledge and skills necessary for information security to ensure the reliability of our security initiatives.
4. Compliance with Laws and Contractual Requirements
The Company shall comply with all applicable domestic and international laws, regulations, standards, and contractual requirements with clients and partners. With respect to projects related to U.S. military facilities in particular, we shall meet customer requirements and international standards to ensure reliable compliance.
5. Conformance to CMMC
The Company shall strictly implement fundamental cyber hygiene measures in compliance with the 15 requirements of CMMC (Cybersecurity Maturity Model Certification) Level 1, as defined by the U.S. Department of Defense. In doing so, we will ensure that all of our business activities, including those related to U.S. military facilities, are managed reliably and securely.
6. Incident Response and Handling of Violations/Accidents
In the event of an information security-related incident, violation of law or contract, or accident, the Company shall respond promptly and appropriately. We will minimize the impact of any security breaches, investigate their causes, and prevent their recurrence. We will also continuously strengthen our security posture.
7. Continuous Improvement

The Company shall periodically review this Information Security Basic Policy and related rules and management systems, to continuously improve information security.

[Supplement] About CMMC Level 1
CMMC (Cybersecurity Maturity Model Certification) is a cybersecurity certification framework established by the U.S. Department of Defense (DoD).
Its purpose is to protect Controlled Unclassified Information (CUI) held or handled by the Defense Industrial Base (DIB) from cyberattacks.
Among its levels, Level 1 is positioned as Foundational Cyber Hygiene and consists of 15 fundamental security requirements specified in FAR clause 52.204-21. These requirements are organized into six Control Families, as outlined below.

Control Family	Examples of Implementation
Access Control	Centralized management of IT assets and access rights Prohibition of unauthorized cloud services
Identification & Authentication	Clear definition and management of user accounts Maintenance of IT asset inventories
Media Protection	Shredding of paper media; secure deletion and disposal
Physical Protection	Physical access restrictions to facilities/equipment Management of access logs
System & Communications Protection	Prohibition of unauthorized VPNs or remote access services Protection of communications
System & Information Integrity	Deployment of security software; monitoring through security tools

These requirements represent the minimum baseline of cybersecurity measures that all companies, regardless of size, must implement to establish trust in defense-related operations. Based on this concept, the Company has developed a security framework in conformance with CMMC Level 1, ensuring an information management system that provides safety and assurance to our clients and society.

Privacy Policy

The Company recognizes the protection of personal information as an important social responsibility and complies with the Act on the Protection of Personal Information and other relevant laws and regulations. Personal information obtained by the Company will be acquired and used appropriately within the scope necessary for the execution of business operations, and will not be used beyond the intended purpose.

To prevent the leakage, loss, or damage of personal information, the Company will implement appropriate security control measures and will continuously provide education and awareness programs to all officers and employees.
Except as required by law, the Company will not share personal information with third party without the consent of the individual involved. The Company will regularly review its system for handling personal information to ensure continuous improvement.

For inquiries or requests regarding personal information, such as disclosure, correction, suspension of use, or similar matters, please contact us.

NIA Engineering Co., Ltd.

---

SECURITY ACTION Declaration

We, NIA Engineering Co., Ltd., as a company contributing to the development of society through our businesses in the fields of construction, environment, and technology, support the purpose of the “SECURITY ACTION” initiative promoted by the Information-technology Promotion Agency (IPA), Japan, and have made a declaration under the program.
Based on this declaration, we prioritize the maintenance and enhancement of information security. Through company-wide initiatives, we strive to become a safer and more trusted enterprise.

For details on “SECURITY ACTION” , please refer to the official website.　

---