Information Security Certificate

This is to certify that on the date 16 April 2009

Crasmanager version 5.2 (Target)

http://www.crasmanager.fi/

The Target has been assessed by information security professionals of Nixu Ltd. and verified to be secure for its intended use as a Content management system.

The Target has been approached comprehensively from the hacker perspective by using similar methods and resources that the potential attackers would likely use to attack and compromise this type of information system.

The security controls of the Target are verified to be adequate to protect information classified as confidential on the scale public/confidential/secret.

Based on the assessment, Nixu Ltd. hereby confirms that:

• Target has implemented proper security controls. No critical vulnerabilities were discovered during the assessment at the time of certification
• The system architecture of Target is designed and implemented in secure manner
• The system platforms of Target have been configured securely
• The Target production environment is maintained by using good maintenance practices to keep the system secure

Conditions of Issuing

Nixu Ltd is an independent information security expert services company, whose consultants perform over 100 security projects each year for various clients. (www.nixu.com). This certificate is not valid if Target is used for any other purpose that it was intended at the time of certification. This certificate is valid for one year from the actual audit. For each major version revision a new audit needs to be performed to uphold the certificate. This or any certificate can not and does not guarantee absolute security. Therefore Nixu Ltd. is not liable of any loss or damage in case of security breach.