ENS Security Policy

1. Approval and entry into force

This Information Security Policy is effective from the date of signature until replaced by a new Policy.

2. Mission of Asseco Spain SA

To achieve its objectives, Asseco Spain  is committed to information security and undertakes proper management of this information in order to offer all its stakeholders the highest guarantees regarding the security of the information used.

Our mission is to offer high-impact 360 technological solutions and services with a high level of customization.

These systems must be managed diligently, taking appropriate measures to protect them against accidental or deliberate damage that could affect the availability, integrity, or confidentiality of the information processed or the services provided.

The objective of information security is to ensure the quality of information and the continued provision of services by acting proactively, monitoring daily activity, and reacting promptly to incidents.

ICT systems must be protected against rapidly evolving threats that have the potential to impact the confidentiality, integrity, availability, intended use, and value of information and services. Defending against these threats requires a strategy that adapts to changing environmental conditions to ensure the continued provision of services. This means that departments must implement the minimum security measures required by the National Security Framework, as well as continuously monitor service delivery levels, track and analyze reported vulnerabilities, and prepare an effective incident response to ensure the continuity of the services provided.

The various departments must ensure that IT security is an integral part of every stage of the system’s lifecycle, from conception to decommissioning, including development or acquisition decisions and operational activities. Security requirements and funding needs must be identified for both the products they develop and their associated services, as well as for the underlying software acquired from third parties.

Departments must be prepared to prevent, detect, react to, and recover from incidents, in accordance with Article 8 of the ENS (Article 8. Prevention, detection, response, and conservation).

3. Scope

This policy applies to all the entity’s ICT systems and to all members of Asseco Spain SA, involved in Services and Projects for the public sector, which require the application of ENS, without exception. That is: THE INFORMATION SYSTEMS THAT SUPPORT THE Monitoring Service and Management and Maintenance Services for IT systems, networks, communications and security according to the Current Declaration of Applicability

4. Goals

For all the above reasons, the Management establishes the following information security objectives:

• Provide a framework for increasing resilience to respond effectively.
• Ensure the rapid and efficient recovery of services in the event of any physical disaster or contingency that could jeopardize the continuity of operations.
• Prevent information security incidents to the extent technically and economically feasible, as well as mitigate information security risks generated by our activities.
• Ensure the confidentiality, integrity, availability, authenticity and traceability of information.

5. Regulatory framework

One of our objectives must be to comply with applicable legal requirements and any other requirements we sign, in addition to our commitments to clients, as well as to continually update them. To this end, the legal and regulatory framework within which we conduct our activities is:

• REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
• Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights.
• Royal Legislative Decree 1/1996, of April 12, Intellectual Property Law.
• Law 2/2019, of March 1, amending the consolidated text of the Intellectual Property Law, approved by Royal Legislative Decree 1/1996, of April 12, and incorporating into Spanish law Directive 2014/26/EU of the European Parliament and of the Council, of February 26, 2014, and Directive (EU) 2017/1564 of the European Parliament and of the Council, of September 13, 2017.
• Royal Decree 311/2022, of May 3, regulating the National Security Scheme.
• Law 34/2002 of July 11 on Information Society Services and Electronic Commerce (LSSI).
• Law 40/2015, of October 1, on the Legal Regime of the Public Sector.
• Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations.

6. Development

In order to achieve these objectives it is necessary:

• Continuously improve our information security system.
• Identify potential threats, as well as the impact on business operations that such threats, if they materialize, could cause.
• Preserve the interests of its key stakeholders (customers, shareholders, employees, and suppliers), reputation, brand, and value-creating activities.
• Working together with our suppliers and subcontractors to improve IT service delivery, service continuity, and information security, resulting in greater efficiency in our operations.
• Evaluate and guarantee the technical competence of our staff, as well as ensure their adequate motivation to participate in the continuous improvement of our processes, providing appropriate training and internal communication to help them develop the best practices defined in the system.
• Ensure the proper condition of the facilities and appropriate equipment, so that they are in line with the company’s activity, objectives, and goals.
• Ensure ongoing analysis of all relevant processes, establishing appropriate improvements in each case based on the results obtained and the established objectives.
• Structure our management system in a way that is easy to understand. Our management system has the following structure:

Our system is managed by the Security Officer, and the system will be available in our information system in a repository, which can be accessed according to the access profiles granted in accordance with our current access management procedure.

7. Security organization

The primary responsibility lies with the General Management of Asseco Spain SA, which is responsible for organizing the functions and responsibilities and providing the appropriate resources to achieve the ENS’s objectives. Managers are also responsible for setting a good example by following established safety standards.

These principles are assumed by the Management, which provides the necessary means and provides its employees with sufficient resources for their compliance, reflecting and making them public through these Security Policies.

The defined security roles or functions are:

This definition of duties and responsibilities is completed in the job profiles and in the Personnel, Roles and Responsibilities Record system documents.

 CONFLICT RESOLUTION

Any differences of opinion that could lead to a conflict will be addressed within the Security Committee, and the opinion of the Directorate General will prevail in all cases.

8. Security Committee

The procedure for their appointment and renewal will be ratification by the security committee.

The Security Management and Coordination Committee is the body with the greatest responsibility within the information security management system, so all major security-related decisions are agreed upon by this committee.

The members of the information security committee are:

• Information Officer
• Responsible for Services
• Security Officer
• System Manager
• Company Address

These members are appointed by the committee, the only body that can appoint, renew and remove them.

The Safety Committee is an autonomous, executive body with decision-making authority and is not subordinate to any other element of our company.

Asseco Spain SA’s information security policy is developed in the complementary document to this Information Security Organization Policy.

This policy complements the rest of the policies, procedures and documents in force to develop our management system.

9. Risk Management

All systems subject to this Policy must undergo a risk analysis, assessing the threats and risks to which they are exposed. This analysis is reviewed regularly:

• at least once a year;
• when the information handled changes;
• when the services provided change;
• when a serious security incident occurs;
• when serious vulnerabilities are reported.

To harmonize risk analyses, the ICT Security Committee will establish a baseline assessment for the different types of information handled and the different services provided. The ICT Security Committee will streamline the availability of resources to address the security needs of the various systems, promoting horizontal investments.

To carry out the risk analysis, the risk analysis methodology developed in the Risk Analysis procedure will be taken into account.

10. Personnel Management

All members of Asseco Spain SA are required to understand and comply with this Information Security Policy and the Security Regulations. The ICT Security Committee is responsible for ensuring that information reaches those affected.

All Asseco Spain SA members will attend an ICT security awareness session at least once a year. An ongoing awareness program will be established for all Asseco Spain SA members, particularly new recruits.

Individuals responsible for the use, operation, or administration of ICT systems will receive training in the secure use of these systems to the extent necessary to perform their work. Training will be mandatory before assuming any responsibility, whether it is their first assignment or a change in job or responsibilities.