Detecting Insider Threats: The Undiscussed, Under Reported OT/ICS Cybersecurity Challenge
Register Now
This Code of Ethics and Business Conduct is designed to deter wrongdoing and to promote:
This Code applies to all directors, officers and employees of the Company and its subsidiaries, who, unless otherwise specified, will be referred to jointly as employees. Agents and contractors of the Company are also expected to read, understand, and abide by this Code.
This Code should help guide your conduct during Nozomi Networks’ business activities. However, many of the principles described in this Code are general in nature, and the Code does not cover every situation that may arise. Use common sense and good judgment in applying this Code. If you have any questions about applying the Code, it is your responsibility to seek guidance.
This Code is not the exclusive source of guidance and information regarding the conduct of our business. You should consult applicable policies and procedures in specific areas as they apply. The Code is intended to supplement, not replace, the employee handbook and the other policies and procedures of the Company.
We are committed to continuously reviewing and updating our policies and procedures. The Company therefore reserves the right to amend, alter or terminate this Code at any time and for any reason, subject to applicable law.
You are expected to read and understand this Code of Business Conduct and Ethics.
You must uphold these standards in day-to-day activities and comply with all applicable policies and procedures in the Code.
Part of your job and ethical responsibility is to help enforce this Code. You should be alert to possible violations and promptly report violations or suspected violations of this Code. Please refer to “Procedural Matters—Reporting Violations” for more information.
You must cooperate with investigations into possible Code violations and be truthful and forthcoming during these investigations.
Reprisals, threats, retribution, or retaliation against any person who has in good faith reported a violation or a suspected violation of law, this Code or other company policies, or against any person who is assisting in good faith in any investigation or process with respect to such a violation, is prohibited.
In trying to determine whether any given action is appropriate, keep these steps in mind:
If you are unsure about any situation or any provision of the Code, discuss the matter with your manager or responsible employees in the Legal or Human Resources Departments.
Overview
Honest and ethical conduct is critical to our business. All employees, agents and contractors have a duty to comply with applicable law and to act in an honest and ethical manner.
Compliance With the Law
You are responsible for complying with all laws, rules, regulations, and regulatory orders applicable to the conduct of our business. If you are located or engaging in business outside of the United States, you must comply with laws, rules, regulations, and regulatory orders of the United States, including the Foreign Corrupt Practices Act and U.S. export rules and regulations, in addition to the applicable laws of other jurisdictions. If compliance with the Code should ever conflict with law, you must comply with the law.
You should undertake to acquire knowledge of the legal requirements relating to your duties sufficient to enable you to recognize potential dangers and to know when to seek advice from managers or other appropriate personnel.
Violations of laws, rules, regulations, and orders may subject you to individual criminal or civil liability, in addition to discipline by the company. Violations may also subject the company to civil or criminal liability or the loss of business.
No Discrimination or Harassment
The Company is committed to providing a work environment that is free of discrimination and harassment. The Company is an equal opportunity employer and makes employment decisions on the basis of merit and business needs. In addition, the company strictly prohibits harassment of any kind, including harassment on the basis of race, color, veteran status, religion, gender, sex, sexual orientation, age, mental or physical disability, medical condition, national origin, marital status or any other characteristics protected under federal or state law or local ordinance.
Health and Safety
You are responsible for using good judgment to help ensure a safe and healthy workplace for all employees.
Overview
Your decisions and actions in the course of your employment with the Company should be based on the best interests of the Company, and not based on personal relationships or benefits. You should seek to avoid situations where your personal activities and relationships conflict, or appear to conflict, with the interests of the Company, except under guidelines approved by the Board of Directors. This includes situations where you may have or appear to have an indirect conflict through, for example, a significant other or a relative or other persons or entities with which you have a business, social, familial, personal, or other relationship. A conflict may also arise when you take actions or have interests that make it difficult for you to perform your work for the company objectively and effectively. You must disclose to your manager any interest that you have that may, or may appear to, conflict with the interests of the company.
There are a variety of situations in which a conflict of interest may arise. While it would be impractical to attempt to list all possible situations, some common types of conflicts are discussed below.
Outside Employment and Directorships
Unless you are a non-employee director of the Company, you may not perform services as a director, employee, agent or contractor for a customer, a supplier or any other entity that has a business relationship with the Company without approval from the Company. Non-employee directors of the Company must promptly inform the company of any such service. You may not perform services as a director, employee, agent, or contractor for any competitor of the Company.
Financial Interests in Other Companies
You should not have a significant financial interest (an interest of 2% or less in a publicly held company is not a significant interest)—including an indirect interest through, for example, a relative or significant other—in any organization if that interest would give you or would appear to give you a conflict of interest with the Company. You should be particularly sensitive to financial interests in competitors, suppliers, customers, distributors, and strategic partners.
Transactions With the Company
If you have a significant financial interest in a transaction involving the company— including an indirect interest through, for example, a relative or significant other or a business entity—you must disclose that interest to the Company’s General Counsel and Chief Executive Officer, and that interest must be approved in writing by the company’s Chief Executive Officer. We encourage you to seek guidance if you have any questions as to whether an interest in a transaction is significant.
Corporate Opportunities
You may not directly or indirectly exploit for personal gain any opportunities that are discovered through the use of corporate property, information or position unless the opportunity is disclosed fully in writing to the Board of Directors or its designated committee and the Board of Directors or its designated committee declines to pursue the opportunity.
Loans by the Company
Loans from the Company to directors and executive officers are prohibited. Loans from the Company to other officers and employees must be approved in advance by the Board of Directors or its designed committee.
Improper Benefits
You may not receive any improper benefit as the result of your position with the Company.
Election or Appointment to Public Office
You may serve in an elected or appointed public office provided that the position does not create or appear to create a conflict of interest.
Guidance and Approvals
Evaluating whether a conflict of interest exists, or may appear to exist, requires the consideration of many factors. We encourage you to seek guidance and approval in any case where you have any questions or doubts. The company may at any time rescind prior approvals to avoid a conflict of interest, or the appearance of a conflict of interest, for any reason deemed to be in the best interest of the Company.
The company shares business-critical vulnerability reports and other documents with customers and partners for public consumption. In addition, from time to time the company makes other public communications, such as issuing press releases. Such communications can only be made by a designated individual who is part of the Company’s Public Relations Department. In no event will any other employee make or post any public statements to any person, media (print, radio, television or otherwise), media-website, blog, social media, or any other third-party medium without the express permission or written approval by the company. Any such communications will be made solely by the designated Nozomi Networks Public Relations person.
No contractors or other third parties may make any statements—public or otherwise—on the Company’s behalf.
Depending upon your position with the company, you may be called upon to provide information to help assure that the company’s public communications are complete, fair, accurate and understandable. You are expected to use all reasonable efforts to provide complete, accurate, objective, relevant, timely and understandable answers to inquiries related to the company’s public disclosures.
If you believe that any disclosure is materially misleading or if you become aware of any material information that you believe should be disclosed to the public, it is your responsibility to bring this information to the attention of the Legal Department.
Overview
All employees, agents, and contractors are responsible for the proper use of company assets. This responsibility applies to all of the company’s assets, including your time, work and work product; cash and accounts; physical assets such as inventory, equipment, vehicles, computers, systems, facilities and supplies; intellectual property, such as patents, copyrights, trademarks, inventions, software, databases, technology and trade secrets; and other proprietary or nonpublic information.
Protecting the Company’s Information
During your involvement with the company, you may come into possession of information that has not been disclosed or made available to the general public. This nonpublic information may include, among other things:
If you have any questions as to what constitutes nonpublic information, please consult the Legal Department at legal@nozominetworks.com.
All nonpublic information must only be used for Company business purposes. You have an obligation to use all reasonable efforts to safeguard the company’s nonpublic information. You may not disclose nonpublic information to anyone outside of the company, except when disclosure is required by law or when disclosure is required for business purposes and appropriate steps have been taken to prevent misuse of that information. This responsibility includes not disclosing nonpublic information in Internet discussion groups, chat rooms, bulletin boards or other electronic media. In cases where disclosing nonpublic information is required or necessary, you should coordinate with the Legal Department. The misuse of nonpublic information is contrary to company policy and may also be a violation of law.
Each employee is required to sign an At Will Employment, Confidential Information, Invention Assignment, and Arbitration Agreement or similar agreement that addresses the use and disclosure of confidential information of the company. Regardless of such agreement, you are responsible to maintain the confidentiality of the Company’s confidential or proprietary information and to use such information only for the benefit of the company.
Maintaining and Managing Records
The Company is required by local, state, federal, foreign, and other applicable laws, rules and regulations to retain certain records and to follow specific guidelines in managing its records. Records include paper documents, email, compact discs, computer hard drives, and all other recorded information, regardless of medium or characteristics. Civil and criminal penalties for failure to comply with such guidelines can be severe for employees, agents, contractors, and the company.
You should consult with the Legal Department regarding the retention of records in the case of actual or threatened litigation or government investigation. The Legal Department will notify you if a legal hold is placed on records for which you are responsible. A legal hold suspends all document destruction procedures.
Responsibilities to Our Customers, Suppliers, and Competitors
Overview
You should respect the rights of, and deal fairly with, the Company’s customers, suppliers, business partners and competitors in compliance with law. You should not take unfair advantage of anyone through deception, misrepresentation, manipulation, coercion, abuse of privileged information or any intentional unfair business practice. You are responsible for reading, understanding, and complying with the Company’s Anti-Corruption Policy.
Improper Payments
You should not authorize, offer, promise, or give, or solicit or accept, money, gifts, entertainment, privileges, gratuities, benefits, or other items of value intended to improperly influence, directly or indirectly, any business decision or that otherwise violate law or create the appearance of impropriety. You should contact the Legal Department if you have any questions as to whether a payment is proper.
Gifts and Entertainment
You may, from time to time, provide or accept business amenities to aid in building legitimate business relationships. Business amenities may include gifts, meals, services, entertainment, reimbursements, loans, favors, privileges, or other items of value.
Any business amenity should be consistent with customary business practice and should be reasonable and appropriate for the circumstance. Business amenities should not be lavish or excessive. Business amenities should not violate law or create any possible appearance of impropriety. You should avoid providing or accepting any cash payment, or other business amenity that can be construed as a bribe or payoff. All company funds expended for business amenities must be accurately recorded in the company’s books and records. We encourage you to contact the Legal Department if you have any questions as to whether a business amenity is permissible.
In some business situations outside of the United States, it is customary and lawful for business executives to present gifts to representatives of their business partners. These gifts may be of more than a nominal value, and under the circumstances, returning the gifts or paying for them may be an affront to the giver. If you find yourself in such a situation, you must report the gift to the General Counsel. In some cases, you may be required to turn the gift over to the company.
Special restrictions apply when dealing with government employees. For more information, see the next section on “Working with Governments”.
Selecting Suppliers
The company’s policy is to select suppliers based on the merits of their products, services, and business practices and to purchase supplies based on need, quality, service, price and other terms and conditions of sale. You may not establish a business relationship with any supplier if you know that its business practices violate applicable laws.
Handling the Nonpublic Information of Others
You must handle the nonpublic information of others responsibly and in accordance with our agreements with them. Nonpublic information of others includes notes, reports, conclusions, and other materials prepared by a Company employee based on the nonpublic information of others.
Once the Company has received nonpublic information, you should use all reasonable efforts to abide by the terms of any relevant nondisclosure agreement, including any obligations with respect to the return or destruction of the nonpublic information.
Improperly Obtaining or Using Assets or Information
You may not unlawfully obtain or use the materials, products, intellectual property, proprietary or nonpublic information or other assets of anyone, including suppliers, customers, business partners and competitors. You may not coerce or improperly induce past or present employees of other companies to disclose proprietary or nonpublic information of their former or other employers.
Free and Fair Competition
It is our policy to lawfully compete in the marketplace. Our commitment to fairness includes respecting the rights of our competitors to compete lawfully in the marketplace and abiding by all applicable laws in the course of competing.
Most countries have well-developed bodies of law designed to encourage and protect free and fair competition. These laws are broad and far-reaching and regulate the Company’s relationships with its distributors, resellers, suppliers and customers. Competition laws generally address the following areas: pricing practices (including predatory pricing, price fixing and price discrimination), discounting, terms of sale, credit terms, promotional allowances, secret rebates, exclusive dealerships or distributorships, product bundling, restrictions on carrying competing products, termination, and many other practices.
Competition laws also govern, usually quite strictly, relationships between the company and its competitors. Collusion among competitors is illegal, and the consequences of a violation are severe. You must not enter into an agreement or understanding, written or oral, express, or implied, with any competitor concerning prices, discounts or other terms or conditions of sale; profits or profit margins; costs; allocation of product, customers, markets or territories; limitations on production or supply; boycotts of customers or suppliers; or bids or the intent to bid, or even discuss or exchange information on these subjects.
The Company is committed to obeying both the letter and spirit of these laws, which are often referred to as antitrust, consumer protection, competition, or unfair competition laws. Although the spirit of these laws is straightforward, their application to particular situations can be quite complex. To ensure that the company complies fully with these laws, you should have a basic knowledge of them and should promptly involve our Legal Department when questionable situations arise.
Overview
Special rules govern our business and other dealings with governments. Employees, agents and contractors of the Company should use all reasonable efforts to comply with all applicable laws and regulations governing contact and dealings with governments, government employees and public officials. If you deal with governments, government employees or public officials, you should undertake to understand the special rules that apply. If you have any questions concerning government relations, you should contact the Legal Department.
Government Contracts
You should use all reasonable efforts to comply with all relevant laws and regulations that apply to government contracting. You should refer any contract with any governmental entity to the Legal Department for review and approval.
Requests by Regulatory Authorities
You must cooperate with appropriate government inquiries and investigations in accordance with law. It is important, however, to protect the legal rights of the Company with respect to its nonpublic information. All government requests for Company information, documents or investigative interviews should immediately be referred to the Legal Department. You should work with the Legal Department in responding to requests by regulatory authorities to ensure appropriate responses and to avoid inappropriate disclosure of attorney-client privileged materials, trade secret information or other nonpublic information. This policy should not be construed to prevent an employee from disclosing information to a government or law enforcement agency where the employee has reasonable cause to believe that the information discloses a violation of, or noncompliance with, a state or federal statute or regulation.
Improper Payments to Government Officials
You may not offer any payment or business amenity to a public official or a government employee if doing so could reasonably be construed as having any connection with the company’s business, maintaining current business or creating new business, even if it has a nominal value or no value at all. You should be aware that what may be permissible in dealings with commercial businesses may be deemed illegal and possibly criminal in dealings with the government. You should contact the Legal Department for guidance.
Whether you are located in the United States or abroad, you are also responsible for fully complying with the Foreign Corrupt Practices Act. The Foreign Corrupt Practices Act makes it illegal to offer, pay, promise to pay or authorize to pay any money, gift or other item of value to any foreign official, political party or candidate to assist the company or another to obtain or retain business. All managers and supervisory personnel are expected to monitor continued compliance with the Foreign Corrupt Practices Act.
Political Contributions
The company reserves the right to communicate its position on important issues to elected representatives and other government officials. It is the Company’s policy to comply fully with all local, state, federal, foreign, and other applicable laws, rules and regulations regarding political contributions. The company’s assets—including company funds, employees’ work time and company premises and equipment—must not be used for, or be contributed to, political campaigns or political activities under any circumstances without prior written approval.
Lobbying
You must obtain approval from the General Counsel for any work activity that requires lobbying communication with any member or employee of a legislative body or with any government official or employee in the formulation of legislation. Work activity covered by this policy includes meetings with legislators or members of their staffs or with senior executive branch officials on behalf of the company. Preparation, research, and other background activities that are done in support of such lobbying communication are also covered by this policy even if the communication ultimately is not made.
Trade Restrictions
A number of countries maintain controls on the destinations to which products or software may be exported. Some of the strictest export controls are maintained by the United States against countries that the U.S. government considers unfriendly or as supporting international terrorism. The U.S. regulations are complex and apply both to deemed exports from the United States and to deemed exports of products from other countries when those products contain U.S.-origin components or technology. For example, software created in the United States is subject to these regulations even if duplicated and packaged abroad. In some circumstances, an oral presentation containing technical data made to foreign nationals in the United States or access by foreign nationals to certain technology may constitute a controlled export. The Legal Department can provide you with guidance on which countries are prohibited destinations for company products or whether a proposed technical presentation or the provision of controlled technology to foreign nationals may require a U.S. government license.
Distribution
All employees will receive a copy of this Code at the time they join the Company and will receive periodic updates. Agents and contractors should also be provided with access to a copy of the Code.
Acknowledgment
All new employees must sign an acknowledgment form confirming that they have read the Code and that they understand and agree to comply with its provisions. Signed acknowledgment forms will be kept in your personnel file. Failure to read the Code or to sign an acknowledgement form does not excuse any person from the terms of the Code.
Approvals and Waivers
Except as otherwise provided in the Code, the Board of Directors or its designated committee must review and approve any matters requiring special permission under the Code for a member of the Board of Directors or an executive officer. Except as otherwise provided in the Code, the Chief Financial Officer and the General Counsel must review and approve any matters requiring special permission under the Code for any other employee, agent or contractor.
Any waiver of any provision of this Code for a member of the Board of Directors or an executive officer must be approved in writing by the Board of Directors or its designated committee and promptly disclosed, along with the reasons for the waiver, to the extent required by law or regulation. Any waiver of any provision of this Code with respect to any other employee, agent or contractor must be approved in writing by the Chief Financial Officer and the General Counsel.
Copies of approvals and waivers will be retained by the company.
Reporting Violations
You should promptly report violations or suspected violations of this Code to the Nozomi Networks Legal Department at: 1-800-314-6114 ext.120, 575 Market Street, Unit 3650, San Francisco, CA 94105 U.S.A. If you wish to remain anonymous, send an anonymous letter addressed to the above address or you may report pursuant to the company’s whistleblower email address: legal@nozominetworks.com.
If you make an anonymous report, please provide as much detail as possible, including copies of any documents or material that you believe may be relevant to the issue.
When reports are not made anonymously, reasonable efforts will be made to keep your identity confidential. In certain circumstances, however, your identity may become apparent during an investigation or may need to be disclosed (e.g., in regulatory proceedings). Accordingly, it is not possible for the Company to give a blanket guarantee of confidentiality.
Reprisals, threats, retribution or retaliation against any person who has in good faith reported a violation or a suspected violation of law, this Code or other Company policies, or against any person who is assisting in any investigation or process with respect to such a violation, is prohibited.
Investigations
The Board of Directors or its designated committee will be responsible for investigating violations and determining appropriate disciplinary action for matters involving members of the Board of Directors or executive officers. The Board of Directors or its designated committee may designate others to conduct or manage investigations on its behalf and recommend disciplinary action.
Subject to the general authority of the Board of Directors to administer this Code, Head of HR, along with Head of Legal will be jointly responsible for investigating violations and determining appropriate disciplinary action for other employees, agents and contractors. Head of HR, along with Head of Legal may designate others to conduct or manage investigations on their behalf and recommend disciplinary action. Code violations and the corrective actions taken will be reported to the Board of Directors or its designated committee by either the CEO or another designated Executive. The Board of Directors reserves the right to investigate violations and determine appropriate disciplinary action on its own and to designate others to do so in place of, or in addition to, Head of HR and Head of Legal.
The company will promptly investigate any suspected violations. If it is determined that evidence of a violation exists, the individual subject to investigation will be notified. The subject of an investigation will have an opportunity to respond to any allegations made against that person. A person suspected of violating the Code may be suspended with or without pay while an investigation is conducted. The company will follow local grievance procedures in jurisdictions where such procedures apply.
Disciplinary Action
The company will take appropriate action against any employee, agent or contractor whose actions are found to violate the Code. Disciplinary actions may include, at the Company’s sole discretion, oral or written reprimand, suspension or immediate termination of employment or business relationship, or any other disciplinary action or combination of disciplinary actions as deemed appropriate to the circumstances. A record of the disciplinary action will be retained in the employee’s personnel file.
In determining what disciplinary action is appropriate in a particular case, the company will take into account all relevant information, including the nature and severity of the violation, any history of warnings and violations, whether the violation appears to have been intentional or inadvertent and whether the violator reported his or her own misconduct. The Company will strive to enforce the Code in a consistent manner while accounting for all relevant information. An alleged violator may make a written request for reconsideration within 14 days of notification of the final disciplinary decision.
Where the Company has suffered a loss, it may pursue its remedies against the individuals or entities responsible. Certain violations of this Code may also be subject to civil or criminal prosecution by governmental authorities and others. Where laws have been violated, the Company will report violators to the appropriate authorities.
Information
Nothing in this Code of Ethics and Business Conduct creates or implies an employment contract or term of employment. Employment may be terminated with or without cause and with or without notice at any time by the employee or the Company in accordance with applicable local customs, laws, and regulations. Nothing in this Code shall limit the right to terminate employment in accordance with applicable custom, laws, and regulations. Unless otherwise agreed to in writing by the Chief Executive Officer and in accordance with local custom, laws, or regulations, no employee of the Company has any authority to enter into any agreement for employment for a specified period of time, or to make any agreement or representation contrary to the company’s policy.
The policies in this Code do not constitute a complete list of company policies or a complete list of the types of conduct that can result in discipline, up to and including discharge.
