Contact with Special Interest Groups

Effective: March 17, 2026 · DCF-188

1. Purpose

This policy establishes H33.ai's commitment to maintaining appropriate contact with security special interest groups, professional associations, and specialist forums in accordance with ISO 27001:2022 control A.5.6. Active participation in these communities ensures H33.ai remains informed about emerging threats, best practices, and advances in post-quantum cryptography, fully homomorphic encryption, and zero-knowledge proof systems.

2. Scope

This policy applies to all H33.ai personnel responsible for information security, cryptographic engineering, and compliance functions. It covers memberships, subscriptions, and engagement with external security organizations and special interest groups relevant to H33.ai's operations.

3. Policy Statement

H33.ai shall maintain active contact with relevant special interest groups and professional associations to:

• Receive early warning of emerging threats, vulnerabilities, and advisories relevant to post-quantum cryptography, FHE implementations, and cloud infrastructure
• Gain access to specialist security guidance and best practices
• Stay current with standards development in lattice-based cryptography, homomorphic encryption, and zero-knowledge proof systems
• Share threat intelligence with trusted peers and contribute to community defense
• Maintain awareness of regulatory developments affecting cryptographic products and services

4. Special Interest Groups Register

The following groups and forums are actively monitored and engaged by H33.ai:

NIST Post-Quantum Cryptography Project

IACR — International Association for Cryptologic Research

OWASP — Open Web Application Security Project

Cloud Security Alliance (CSA)

FIRST — Forum of Incident Response and Security Teams

US-CERT / CISA Mailing Lists

AWS Security Bulletins

Rust Security Response Working Group

HomomorphicEncryption.org Standardization Body

5. Benefits of Participation

Active engagement with these groups provides H33.ai with the following benefits:

• Early threat detection: Advance notice of vulnerabilities affecting cryptographic libraries, cloud infrastructure, and authentication systems
• Standards alignment: Direct input into the evolution of PQC and FHE standards that H33.ai implements in production
• Peer validation: Opportunities to validate H33.ai's security approaches with industry experts and academic researchers
• Regulatory awareness: Insight into upcoming compliance requirements affecting cryptographic products
• Incident support: Access to coordinated response networks in the event of industry-wide security incidents

6. Knowledge Sharing Procedures

Information obtained from special interest groups shall be managed as follows:

• Intake: The CISO reviews all incoming advisories, bulletins, and threat intelligence within 24 hours of receipt (critical items within 4 hours)
• Assessment: Each item is assessed for relevance to H33.ai's technology stack (BFV FHE, Dilithium, Kyber, STARK proofs, AWS infrastructure)
• Dissemination: Relevant findings are communicated to affected teams via internal channels with appropriate classification
• Action tracking: Items requiring action are logged in Drata as tasks with assigned owners and deadlines
• Contribution: H33.ai may share non-proprietary security findings with relevant groups, subject to CISO approval and information classification review
• Confidentiality: Information shared under TLP (Traffic Light Protocol) restrictions is handled in accordance with the designated sharing level

7. Responsibilities

8. Review Schedule

This policy and the special interest groups register shall be reviewed annually, or sooner if:

• H33.ai's technology stack changes significantly (e.g., adoption of new cryptographic primitives)
• A relevant group is dissolved or its focus changes materially
• A new special interest group emerges that is directly relevant to H33.ai's operations
• A significant security incident highlights the need for additional community engagement

The next scheduled review is March 2027.