Supplier Registration

COMPANY PROFILE

Business Address *

City *

Region / State *

Postal / Zip Code *

Country *

Please provide the primary contact details for your company, including the name, email address, and telephone number. *

How long has your company been in business? *

What is the legal organisation of your company? Proprietorship Partnership Publically held company with shares listed on a stock market Trust Individual Other

Is your company OEM Authorized Distributor Trader Other

What is your primary scope of products and/services?

Company Website *

FINANCIAL & LEGAL

Have you sent us your banking details with your official company letterhead? * Yes No

Payment Terms * Select one... NET 30 NET 45 NET 60 NET 90 NET 20 with discount ADVANCE/UPFRONT DUE ON RECEIPT 50% @PLACEMENT - 50% NET 30 OTHER

If you select 'OTHER' on the previous question, please describe your payment terms

Currency *

Email address for remittance advices *

OWNERSHIP STRUCTURE

Does your company Qualify as diverse owned? NO YES - Minority-owned (MBEs) / African American YES - Minority-owned (MBEs) / Asian American YES - Minority-owned (MBEs) / Hispanic American YES - Minority-owned (MBEs) / Native American YES - Minority-owned (MBEs) / Canadian Aboriginal / Visible minorities YES - Minority-owned (MBEs) / Canadian visible minorities YES - Minority-owned (MBEs) / unknown YES - Woman-owned (WBEs) YES - Veteran-owned (VET) YES - SDVET (Service - Disable Veteran Owned) YES - LGBT (LBGT-Owned) YES - Disable (Disable-Owned) YES - SC-SDB (Self Certified SDB) YES - Hubzone (Hubzone) YES - Small business (SBEs) YES - HCBU YES - Abilityone (Abilityone Program) YES - ANC (Alaskan Native Corp or Tribally Owned) YES - DBE (Disadvantage Business) YES - WOSB (Women - Owned Small business) YES - EDWOSB (Economically Disadvantage WOSB) YES - 8A (8 (A) Program) YES - ACDBE (Airport Concessionaire DBE)

If you selected "YES" for any of the previous questions, have you already sent your diverse-owned certificate to Craig International via email? Yes No

QUALITY, HEALTH, SAFETY AND ENVIRONMENT

Are your QHSE management system certified by an accredited certifying body? NO YES - Certified Quality Management System YES - Certified Occupational Health & Safety Management System YES - Certified Environmental Management System

LABOUR RIGHTS, HUMAN TRAFFICKING AND MODERN SLAVERY ASSESSMENT

Does your company have a policy, procedure or process for selection and follow up of suppliers on the basis of human rights? * Yes No

Is there perceived to be a risk of slavery or human-trafficking taking place in your business or supply chain? * Yes No

In which countries are the operations of your business? *

Are employees all on a written contract of employment? Yes No

Do you have anyone under the age of 16 years old working for you as an employee, agency worker or contractor? * Yes No

TRADE COMPLIANCE

Is your company subject to economic sanctions or trade restrictions imposed by the U.S. or U.K. government or any other applicable jurisdiction? * Yes No

Are any individuals/members of your company listed on any U.S. or U.K. restricted parties list, such as the U.S. Treasury Department List of Specially Designated Nationals and Blocked Persons or similar lists under Applicable Law? * Yes No

Please confirm that products your company supplies are not sourced from Restricted Parties or originate from any sanctioned country* CONFIRMED

CRAIG CONTACT

Could you kindly select the name of the buyer who sent you the link to the supplier questionnaire? Ashley Chapa Natalie Boe Jase Skarbovig Andrea Alicea Allison Lochbaum Camille Buenaluz Rameez Subair Andres Rodriguez Silvia Garza Armani Aziz Jesse Roberts Harry Cosme Grant Williams Juan Bagi Enma Cruz Joann Dang Jacob Dzik Jonathan Thomas

SUPPLIER SECURITY ASSESSMENT

Security Frameworks and Compliance - Please indicate your organization compliance status with the following frameworks: NIST Cybersecurity Framework (CSF) NIST 800-53 Security Controls CIS Controls (Critical Security Controls) ISO 27001 Information Security Management ISO 27002 Security Controls PCI DSS (Payment Card Industry Data Security Standard) GDPR (General Data Protection Regulation) SOC 2 Type 1 / SOC 2 Type 2 IASME Cyber Assurance Level 1 / IASME Cyber Assurance Level 2 Essential 8 (Australian Cyber Security Centre) Cyber Essentials / Cyber Essentials Plus (UK) COBIT CSA STAR Level 1 / CSA STAR Level 2

Additional Information (if applicable):

Technical Security Controls - Please indicate whether your organization has implemented the following essential security controls: Multi-Factor Authentication (MFA) organization-wide Endpoint protection (antivirus/anti-malware) on all devices Regular security patch management and updates End-of-Life (EOL) Software Management Network firewall protection Data encryption for sensitive information Access controls and user permission management Security incident response procedures Employee cybersecurity awareness training Regular security monitoring and logging Access controls and user permission management Business continuity and disaster recovery planning

Additional Information (if applicable):

IT Policies and Documentation - Please indicate whether your organization has the following policies documented and implemented, and whether they are reviewed annually: IT Security Policy Network Security Policy Password Security Policy Access Control Policy Data Protection and Privacy Policy Asset Management Policy Acceptable Use Policy Endpoint Security Policy Vulnerability Management Policy Mobile Device Management Policy Security Incident Response Policy Employee Training and Cyber Awareness Policy

Are your IT policies reviewed and updated annually? Yes No

Does your organization perform Security Assessments, Penetration Testing, or Vulnerability Assessments on a periodic basis? Yes No

In the last 12 months, has your organization experienced a minor data breach or major cybersecurity incident? Yes No

Additional Information (if applicable):

By submitting this questionnaire, the Supplier acknowledges and agrees that Craig International Ltd. may audit its security practices in the event of a serious cybersecurity incident or suspected non-compliance (with reasonable notice unless urgent); all Company information must be kept strictly confidential and not disclosed without prior written consent; applicable data protection laws (including GDPR) will be complied with, and appropriate measures implemented to protect personal and sensitive data; any security incident affecting Craig International Ltd.s data will be reported in writing within 48 hours; and the information provided herein is accurate and complete to the best of the Suppliers knowledge, submitted by an authorized representative.* I acknowledge and agree to these terms on behalf of my organization.