Information Security Management System Statement

Our Commitment

At Advice Lab, we are committed to protecting the confidentiality, integrity, and availability of information entrusted to us by our clients, partners, and staff. Information security is not just a technical obligation — it is a core part of how we deliver trusted advice and maintain the confidence of everyone we work with.

Scope

Our ISMS applies to all information assets, systems, people, and processes involved in the delivery of Advice Lab's advisory services, including client data, internal systems, third-party relationships, and remote working environments.

What We Do

We have established, implemented, and maintain an Information Security Management System aligned with the requirements of ISO/IEC 27001:2022. This system is reviewed regularly to ensure it remains appropriate to the nature and scale of our business.

Our ISMS is designed to:

• Identify and manage information security risks in a structured and consistent way
• Protect client and business information from unauthorized access, disclosure, alteration, or loss
• Meet our legal, regulatory, and contractual obligations, including applicable Australian privacy legislation
• Build and maintain trust with our clients and stakeholders
• Continuously improve our security posture based on lessons learned and evolving threats

Leadership and Accountability

Senior leadership at Advice Lab is fully committed to this ISMS. Security responsibilities are clearly assigned, and all staff are expected to understand and uphold their role in protecting information assets.

Continuous Improvement

We treat information security as an ongoing discipline. We regularly assess risks, test our controls, review incidents, and update our practices to reflect changes in our business environment and the threat landscape.

This statement is reviewed annually and approved by Advice Lab's senior leadership.