1. Mission and objectives of the Information Security Policy
The Information Security Policy is a broad framework, with solid foundations for carrying out work activities safely and reliably. We consider it essential to protect all the data we handle, whether belonging to our clients, employees or partners, as well as the organization's own data.
To achieve this, we strive to:
In summary, we want our systems and processes to be secure and reliable, and for everyone in the organization, from employees to external collaborators, to know how to handle information responsibly.
To achieve this mission, we have set the following goals:
Some concrete examples of our actions:
2. Scope
This Security Policy applies to all Bosonit information and the systems that support it. For these purposes, Bosonit is understood to mean:
Extending the scope of the systems provided by Bosonit to the following organizations:
All of the companies named above will be referred to collectively as "the companies."
3. Regulatory Framework
The legislation on information security that must serve as a reference is continuously updated and is reflected in the "Annex: Applicable Legislation"; it can also be reviewed on the CCN website, in the section dedicated to the National Security Framework, under regulations and the regulatory framework.
4. Security Organization
The information security of the companies will be managed by an Information Security Committee, made up of the following roles:
The Information Security Committee is the body that centralizes the management of information security within the organization.
When justified by complexity, the physical separation of its elements, or the number of users of electronically supported information or of the systems that handle it, delegated Security Committees may be created, functionally dependent on the main Information Security Committee, which will be responsible within their scope for the actions delegated to them.
The Information Owner is the person with sufficient authority to decide on the purpose, content and use of that information, and will determine, within the framework established by the National Security Framework in the area of Electronic Administration, the security requirements of the information handled. To that end:
a. They will determine the security levels of the information handled, assessing the impacts of incidents affecting information security, in accordance with the framework established by the National Security Framework.
b. Together with the Service Owner(s) and the Security Officer, they will carry out the required risk analyses and select the safeguards to be implemented.
c. They will accept the residual risks with respect to the information as calculated in the risk analysis.
d. They will monitor and control the risks, with the participation of the Security Officer.
The Service Owner(s) will be the person(s) with sufficient authority to decide on the purpose and provision of that service, and will determine, within the framework established by the National Security Framework in the area of Electronic Administration, the security requirements of the services provided. To that end:
a. Together with the Information Owner and the Security Officer, they will carry out the required risk analyses and select the safeguards to be implemented.
b. They will accept the residual risks with respect to the information as calculated in the risk analysis.
c. They will monitor and control the risks, with the participation of the Security Officer.
d. In agreement with the Information Owner and the Security Officer, they will suspend the provision of an electronic service or the handling of certain information if informed of serious security deficiencies.
The Security Officer will be the person who determines the decisions to meet the security requirements of information and services. They will have the following functions:
a. Assuming the functions included within the framework established by the National Security Framework in the area of Electronic Administration.
b. Proposing to the Service Owner the determination of security levels in each security dimension whenever requested.
c. Conducting or promoting periodic audits to verify compliance with information security obligations.
d. Monitoring and controlling the security status of information systems.
e. Proposing security standards and security procedures to the Security Committee.
f. Determining the technical security measures to be implemented within the organization.
g. Maintaining and verifying the appropriate level of security of the information handled and of the electronic services provided by the information systems.
h. Promoting training and awareness in information security matters.
i. Carrying out the risk analysis and the statement of applicability.
j. Determining the system category, in collaboration with the manager of the management system, for eventual approval by the Information Security Committee.
k. Participating in the development and implementation of security improvement plans.
l. Managing audits and certification processes.
m. Submitting the approval of changes and other system requirements to the Security Committee.
n. Overseeing compliance with the ISMS and legal frameworks (ENS/GDPR).
o. Serving as the point of contact with competent authorities (CCN-CERT, AEPD) in the event of an incident.
When justified by complexity, the physical separation of its elements, or the number of users of electronically supported information or of the systems that handle it, "delegated security officers" may be designated, functionally dependent on the main officer, who will be responsible within their scope for the actions delegated to them.
The System Manager will be appointed by the entity's management, and their position will be listed in the entity's Information Security Policy. They will have the following functions:
a. Developing, operating and maintaining the information system throughout its entire lifecycle, including its specifications, installation and verification of correct functioning.
b. Defining the topology and management of the information system, establishing the criteria for use and the services available within it.
c. Ensuring that security measures are properly integrated into the overall security framework.
d. Implementing, managing and maintaining the security measures applicable to the information system.
e. Managing, configuring and updating the hardware and software on which the information system's security mechanisms and services are based.
f. Applying the Security Operating Procedures.
g. Informing the manager of the Information Security Management System of any anomaly, compromise or vulnerability related to security.
h. Collaborating in the investigation and resolution of security incidents, from detection through resolution.
i. Verifying that the established security controls are properly observed.
j. Verifying that the approved procedures for handling the information system are applied.
k. Managing the authorizations and privileges granted to system users, including monitoring that activity carried out on the system conforms to what has been authorized.
l. Checking hardware and software installations, and their modifications and improvements, to ensure that security is not compromised and that they conform at all times to the relevant authorizations.
m. Monitoring the system's security status as provided by the security event management tools and technical audit mechanisms implemented in the system.
n. Informing the Security Officer of any anomaly, compromise or vulnerability related to security.
o. Collaborating in the investigation and resolution of security incidents, from detection through resolution.
The System Manager may propose the suspension of the processing of certain information or the provision of a given service if they detect serious security deficiencies that could affect compliance with the established requirements. The final decision, to be made by the entity's management, must be agreed upon with the owners of the affected information and services and the Security Officer.
In certain information systems that, due to their complexity, distribution, physical separation of their elements or number of users, require additional personnel to carry out the functions of System Manager, each organization may designate as many Delegated System Managers as it deems necessary. The designation is made by the System Manager, who delegates functions, not responsibility.
Delegated System Managers will handle, within their area of competence, all actions delegated by the System Manager related to the operation, maintenance, installation and verification of the correct functioning of the information system. It is common for these roles to be responsible for information subsystems of a certain size, or for information systems that provide horizontal services.
Each Delegated System Manager will maintain a direct functional dependency on the System Manager, to whom they will report.
a. Implementing security in the system and overseeing its daily operation, always with the option of delegating to administrators or operators under their responsibility.
b. Drafting the Information Security Policy for approval by Management.
c. Formally approving the ISMS's policies, standards, procedures and standards.
d. Carrying out the risk analysis and assessment process on the assets.
e. Monitoring the main residual risks assumed by the Organization and recommending possible actions regarding them.
f. Defining and updating the policies, standards, procedures and standards defined in the ISMS and promoting their use.
g. Advising on the application of the methodology for maintaining contingency and business continuity plans.
h. Promoting continuous improvement of the information security management system.
i. Coordinating the efforts of the different areas regarding information security, to ensure that efforts are consistent, aligned with the approved risk management strategy, and to avoid duplication.
j. Monitoring the performance of security incident management processes and recommending possible actions regarding them. In particular, ensuring coordination among the different security areas in the management of information security incidents.
k. Ensuring compliance with applicable legal, regulatory and sector-specific regulations.
l. Coordinating the continuity plans of the different areas to ensure seamless action in the event they must be activated.
m. Opening, documenting and studying nonconformities, corrective actions and preventive actions.
n. Tracking indicators.
o. Stopping or suspending services or access to information upon learning that they present serious security deficiencies that could be exploited by third parties to carry out attacks.
p. Providing the Security Officer and/or the Security Committee with advice for determining the System Category.
q. Managing everything related to the authorizations granted to system users and their privileges.
r. Ensuring that established security controls are met.
s. Overseeing hardware and software installations, and their modifications and improvements, to ensure that security is not compromised and that they conform at all times to the relevant authorizations.
t. Monitoring the system's security status and regularly reviewing security events that occur.
Holds ultimate responsibility for the security of the companies, encompassing, among other aspects, information security, ensuring the entity's commitment to security and its proper implementation, management and maintenance.
All of these roles will be designated in the constitutive documents of the Information Security Committee.
5. Awareness and Training
In the companies' effort to ensure the correct implementation of a Security Management System, they are committed to maintaining the level of awareness and training of both their internal employees and their external collaborators regarding information security, thereby avoiding the security risks inherent in a lack of knowledge in this area.
6. Risk Management Methodology
All systems subject to this Policy must undergo a risk analysis and management process, assessing the assets, threats and vulnerabilities to which they are exposed and proposing appropriate countermeasures to mitigate the risks. Although continuous monitoring of changes made to the systems is required, this analysis will be repeated:
For the harmonization of risk analyses, a baseline assessment will be established for the different types of information handled and the different services provided.
7. Information Classification
The companies will classify and inventory information assets according to their nature. The level of protection and the measures to be applied will be based on the result of this classification.
8. Personal Data
When a system subject to the National Security Framework handles personal data, the provisions of European Regulation 679/2016 on data protection and Organic Law 3/2018, of December 5, on the Protection of Personal Data, and its implementing regulations, shall apply, without prejudice to the requirements established in the regulatory framework of the National Security Framework in the area of Electronic Administration.
All information systems will conform to the security levels required by personal data protection regulations.
9. Conflict Resolution
In the event of a conflict between the different parties responsible within the organizational structure of the Information Security Policy, it will be resolved by Bosonit's Management, and the stricter requirements arising from personal data protection will prevail.
10. Relationships with Third Parties
When Bosonit provides services to or shares information with third parties, they will be made aware of this Information Security Policy and its derived rules and instructions.
Likewise, when Bosonit uses third-party services or shares information with third parties, they will also be made aware of this Information Security Policy and the security regulations and instructions applicable to such services or information. Third parties will be subject to the obligations and security measures established in such regulations and instructions, and may develop their own operating procedures to satisfy them. Specific procedures for detecting and resolving incidents will be established. It will be ensured that third-party personnel are adequately aware of information security, at least to the same level established in this Information Security Policy.
Specifically, third parties must guarantee compliance with the information security policy based on auditable standards that allow verification of compliance with these policies. Likewise, it will be ensured, through audit or a certificate of destruction/deletion, that the third party cancels and deletes data belonging to Bosonit upon completion of the contract.
When some aspect of the Information Security Policy cannot be met by a third party, a report from the Information Security Officer will be required specifying the risks incurred and how they will be addressed. Approval of this report by the Information Owner and the Owners of the affected Services will be required before proceeding.
11. Staff Obligations
All personnel with responsibility for the use, operation or administration of information and communications technology systems are obliged to know and comply with this Information Security Policy and its derived security regulations, regardless of the type of legal relationship linking them to the companies.
All personnel will receive training in the secure handling of systems to the extent needed to perform their work.
The Security Policy will be accessible to all personnel providing services within the bodies and entities referred to in the "Scope" section.
With the aim of fostering a "security culture," the Information Security Committee will promote an ongoing awareness program to train all personnel.
Failure to comply with the Security Policy and its implementing regulations will result in the establishment of preventive and corrective measures aimed at safeguarding and protecting networks and information systems, without prejudice to the corresponding disciplinary liability.
12. Policy Review
With regard to the reviews that may be carried out on the wording of the text constituting the information security policy, two types of activities will be distinguished:
Periodic reviews will be carried out at least annually.
13. Instruments for Developing the Security Policy
A regulatory framework for information security is established, structured into different levels, so that the objectives set out in this document are given specific development.
The security policy will structure its regulatory framework at the following levels:
Their approval will depend on their scope of application, which may be a specific area or a particular information system.
In addition, guides with recommendations and best practices may be established.
To the extent possible, all this documentation will be managed in accordance with the companies' current Document and Records Control procedure, the objective of which is to establish the criteria for controlling the security documentation and records used in the Information Security Management System, and which extends to all documentation supporting compliance with the National Security Framework.
14. Information Security Management
14.1 Objectives and Measurement
The general objectives for the information security management system are as follows: to create a better market image and reduce the damage caused by potential incidents; the goals are aligned with the organization's business objectives, strategy and business plans. The head of the information security technical office is responsible for reviewing these general ISMS objectives and establishing new ones.
Objectives for individual security controls or groups of controls are proposed by the head of the information security technical office and approved by the security committee in the Statement of Applicability.
All objectives must be reviewed at least once a year.
BOSONIT will measure compliance with all objectives. The head of the information security technical office is responsible for defining the method for measuring compliance with the objectives; measurement will be carried out at least once a year, and the head of the information security technical office will analyze and evaluate the results and report them to the security committee as input for Management review.
14.2 Information Security Requirements
This Policy, and the ISMS as a whole, must comply with the legal and regulatory requirements relevant to the organization in the area of information security, as well as with contractual obligations.
The List of Legal, Regulatory and Contractual Obligations details a list of contractual and legal requirements.
14.3 Information Security Controls
The process for selecting controls (protections) is defined in the risk assessment and treatment methodology.
The selected controls and their implementation status are detailed in the Statement of Applicability.
14.4 Responsibilities
Responsibilities for the ISMS are as follows:
14.5 Communication of the Policy
The Human Resources department must ensure that all BOSONIT employees, as well as relevant external participants, are familiar with this Policy.
15. Configuration and Log Management
15.1 Review of Equipment Configuration
A review of equipment configuration will be carried out annually, following hardening guides. The guides followed will be of recognized standing, giving priority to CIS guides and guides published by the CCN.
15.2 Log Management
All critical security events will be audited, with a retention period of 3 months. If needed as evidence of an attack, logs will be retained for as long as the Information Security Officer deems necessary. If personal data is affected, the DPO may also request that logs be retained for a longer period.
15.3 Review of Specific Access
Permissions will be modified in cases of project or role changes. Every six months, managers will be provided with a list of shared, non-personal resources along with the users who have access to them, in order to verify that permission inheritance is correct. If a manager detects users with unauthorized access, they will send an email to the Systems department to correct the error as soon as possible.
15.4 Support for ISMS Implementation
Through this document, the security committee declares that the implementation and continuous improvement of the ISMS will be supported by the appropriate resources needed to achieve all the objectives established in this Policy, as well as to meet all identified requirements.
15.5 Document Management
The owner of this document is the head of the information security technical office, who must review it, and update it if necessary, at least once a year.
When assessing the effectiveness and adequacy of this document, the following criteria must be taken into account:
LGAI Technological Center S.A.(Applus+) certifica que el sistema de Gestión de Seguridad de la información de la organización DocExploit.
