Information Security Policy ENS RD 311/2022

Main points of this policy

The information security policy comprises a set of guidelines that govern how NACSPORT manages and protects the information it processes and the services it provides in order to prevent, detect, react to and recover from incidents.

Prevention

The organisation will prevent information or services from being compromised by security breaches. To achieve this, there is a dedicated team whose duties include the following:

- Protect the organisation's data and systems from security threats and vulnerabilities.

- Detect and respond to security incidents in a timely and effective manner, after analysing the causes.

- Continuously improve the organisation's security.

There is also a set of additional controls identified through ongoing threat and risk assessments. These controls, and the security roles and responsibilities of all personnel, are clearly defined and documented.

To ensure compliance with the policy, NACSPORT commits to:

- Authorise the systems before they go into operation.

- Regularly assess security, including evaluations of configuration changes made routinely.

- Request periodic review by third parties in order to obtain an independent assessment.

Detection

Since services can degrade rapidly due to incidents, ranging from a simple slowdown to complete shutdown, services continuously monitor operations to detect anomalies in service levels and act accordingly as established.

Detection, analysis and reporting mechanisms are in place, which regularly reach those responsible for the systems and action is taken when there is a significant deviation from the parameters that have been pre-established as normal.

Answer

Mechanisms are in place to respond effectively to security incidents.

The point of contact for incident communications is administration@nacsport.com. The protocol for exchanging information related to the incident is established through the ISMS's Nonconformity and Incident Management process. This includes two-way communication with the Emergency Response Teams (CCCN-CERT), according to the Communications Process.

Recovery

To ensure the availability of critical services, the organisation has ICT systems continuity plans, as part of its overall business continuity plan and recovery activities; according to the Business CONTINUITY Plan.

Likewise, a set of policies are established:

- Strategic scope: Information security must have the commitment and support of all management levels so that it is coordinated and integrated with the rest of the strategic initiatives to form a coherent and effective whole; integrated with ISO standards and the National Security Scheme.

- Differentiated responsibility: Information systems differentiate the information manager, who determines the security requirements of the information processed; the service manager, who determines the security requirements of the services provided; the system manager, who is responsible for the provision of the services; and the security manager, who determines the decisions to satisfy the security requirements.

- Comprehensive Security: Security is understood as a comprehensive process comprised of all technical, human, material, and organisational elements related to the system, avoiding, except in cases of emergency or necessity, any one-off actions or situational solutions. Information security must be considered part of normal operations, being present and applied from the initial design of information systems.

- Risk Management: Risk analysis and management are essential parts of the security process. Risk management will allow for the maintenance of a controlled environment, minimising risks to acceptable levels. Reducing these levels will be achieved through the deployment of security measures, which will strike a balance between the nature of the data and its processing, the impact and probability of the risks to which it is exposed, and the effectiveness and cost of the security measures.

- Proportionality: The establishment of protection, detection and recovery measures is proportional to the potential risks and the criticality and value of the information and services affected.

- Continuous Improvement: Security measures will be reassessed and updated periodically to ensure their effectiveness in response to the constantly evolving risks and protection systems. Information security is managed, reviewed, and audited by qualified, trained, and dedicated personnel, under the leadership of Management.

- Security by default: Systems are designed and configured to ensure a sufficient level of security by default, including cloud services.

- The structure of the SGI documentation is managed and maintained by management in Qualitas CLOUD, which is accessible to management and personnel relevant to the quality system.

Specific policies and responsibilities

These policies are configured as instrumental objectives that guarantee compliance with the basic principles of the Information Security Policy in accordance with the National Security Scheme (ENS) and Royal Decree 311/2022, which regulates the ENS and inspires the actions of NACSPORT.

1. Protection of personal data: the organisation adopts the technical and organisational measures intended to guarantee the level of security required by current regulations in relation to the processing of personal data, complying with the GDPR.

2. Information asset management: The organisation's information assets are inventoried and categorised and are associated with a responsible person.

3. Security linked to people: the necessary mechanisms are in place so that any person who accesses, or may access, information assets, knows their responsibilities and thus reduces the risk derived from improper use of said assets.

4. Physical Security: Information assets are located in secure areas, protected by physical access controls appropriate to their level of criticality. The systems and information assets within these areas are sufficiently protected against physical or environmental threats.

5. Security in the management of communications and operations: the necessary procedures are in place to ensure the proper management of the security, operation, and updating of Information and Communication Technologies. Information transmitted through communication networks is adequately protected, taking into account its level of sensitivity and criticality, through mechanisms that guarantee its security.

6. Access Control: Access to information assets by users, processes, and other information systems will be restricted through the implementation of identification, authentication, and authorisation mechanisms appropriate to the criticality of each asset. Furthermore, system usage will be logged to ensure access traceability and audit its proper use, in accordance with the organisation's activities.

7. Acquisition and maintenance of information systems: information security aspects are considered in all phases of the information systems life cycle, guaranteeing their security by default.

8. Security incident management: appropriate mechanisms are in place for the correct identification, recording and resolution of security incidents.

9. Continuity Management: Appropriate mechanisms are in place to ensure the availability of information systems and maintain the continuity of business processes, according to the service level needs of its users.

10. Compliance: the necessary technical, organisational and procedural measures are adopted to comply with current legal regulations on information security.

Ensuring compliance with minimum requirements:

a) Organisation and implementation of the security process.

b) Risk analysis and management.

c) Personnel management.

d) Professionalism.

e) Authorisation and control of access.

f) Protection of the facilities.

g) Acquisition of security products and contracting of security services.

h) Minimum privilege.

i) System integrity and updating.

j) Protection of information stored and in transit.

k) Prevention against other interconnected information systems.

l) Activity logging and malicious code detection.

m) Security incidents.

n) Continuity of activity.

o) Continuous improvement of the security process.

Security organisation

NACSPORT establishes a set of roles and functions for information security management, which is set out in its Job Descriptions and Organisational Chart, consisting of:

- The Management and Information Security Committee, which performs the functions of:

a) Approve the proposals for modification and permanent updating made on the information security processes.

b) Cooperate in defining processes, IT and security regulations for approval by Management.

c) To ensure and promote compliance with the PSI and its regulatory development.

d) Promote continuous improvement in information security management.

e) Resolve any conflicts that may arise from the establishment of the aforementioned organisational structure.

The CDSI will meet on an ordinary basis at least semi-annually and on an extraordinary basis when decided by the Management.

The CDSI may obtain from technical personnel, its own or external, the relevant information for making its decisions.

The main security roles and functions are established in the Information Security Committee, composed of:

- Security Officer.

- Responsible for the systems.

- Responsible for services.

- Responsible for the information.

The Information Security Committee has the support of the DPO and the team of technical managers from the various areas.

The Management of these responsibilities of NACSPORT are designated in the Job Descriptions and Organisational Chart, and the main roles accept said appointment and their responsibilities in writing.

Security documentation structure

The regulatory framework for information security is mandatory and will be developed in levels, according to the scope of application and the level of technical detail. These levels of development are as follows:

- Information security policies, consisting of this document and the Information Security Management Manual and the Information Security Management Process.

- Operational processes and technical instructions that explicitly describe the object, the process of activities for the security of information and assets; the ISMS management tools on which they are based, indicators and control systems.

- As well as mandatory policies and regulations, associated with the various areas of activity, including the treatment associated with types of incidents.

Personal data

NACSPORT, processes personal data. And it establishes, in the information documents for employees and subcontractors, which it signs, the processing of the information to which they will have authorised access, and it lists the affected files and the corresponding responsible parties. All information systems of the organisation will comply with the security levels required by the regulations for the nature and purpose of the personal data collected in the aforementioned Security Document.

Risk management

NACSPORT, has a process with risk categorisation criteria, its corresponding risk treatment plan and the ISMS risk matrix; that integrates the results of the risk assessment and the status of the risk treatment plan for Management Review; formulates the ISMS risk treatment plan; the approval and acceptance of the ISMS residual risk treatment plan and the acceptance by the risk owners; and implementation of the risk treatment plan.

Staff obligations

Within the information security policies and processes, the organisation establishes for all members of the organisation the obligation to know and comply with this Information Security Policy and the Security Regulations, and it is the responsibility of the Security Committee to provide the necessary means for the information to reach those affected.

All members of the organisation will attend safety awareness sessions and measures at least once a year. A continuing awareness program will be established to serve all members, and particularly new members.

Individuals responsible for the use, operation, or administration of systems receive training in the secure handling of systems to the extent necessary to perform their work. This training is mandatory before assuming any responsibility, whether it is their first assignment or a change in job position or responsibilities within the same role. They are also trained and informed on incident reporting and management, as well as the principle of least privilege for access. Furthermore, they are informed of the set of regulations and criteria regarding confidentiality and the proper use of the assets to which they have access.

Third parties

When the organisation provides services to other bodies or handles information from other bodies, they will be made aware of this Information Security Policy, channels will be established for reporting and coordination of the respective Security Committees, and procedures will be established for responding to security incidents.

When the organisation uses third-party services or transfers information to third parties, they will be informed of this Security Policy and the applicable Security Regulations for those services or information. The third party will be subject to the obligations established in those regulations and may develop its own operating procedures to comply with them. Specific incident reporting and resolution procedures will be established. It will be ensured that third-party personnel are adequately trained in security matters, at least to the same level as established in this Policy. When any aspect of the Policy cannot be met by a third party as required in the preceding paragraphs, a report from the Security Officer will be required, specifying the risks involved and how they will be addressed. Approval of this report by those responsible for the affected information and services will be required before proceeding.

Continuous improvement

One of the fundamental principles of the organisation is to continuously improve the effectiveness of the integrated management system according to the standards: ISO 27001 and ENS, taking measures for the continuous improvement of security measures, facilitating participation in decisions that affect them, as well as the right to be consulted, the continuous improvement of measures to guarantee the security of information based on the ISMS and the ENS.

This includes, among other things:

- Analyse and maximise customer and user satisfaction with our solutions and services.

- Our ongoing pursuit of excellence is based on the early identification and eradication of the sources of errors. Prevention and anticipation take priority over correction.

- To achieve the motivation of our human resources, their training, qualification and experience, through appropriate selection, training and development activities.

- To establish and maintain channels of communication and permanent information with our clients, employees, suppliers and society in general.

Information Security Management System Policy (ISMS) ISO 27001

This policy is defined and reviewed periodically by NACSPORT Management

The general objective is to implement a set of actions aimed at minimising cyber risks, both in the software and applications we develop, and in our activities, and to reduce the risk of attack. Management is committed to providing services that consistently meet the needs and expectations of our users and clients.

All personnel are involved in complying with this Policy. Information Security Management (ISMS) is an integral and fundamental part of our organisation's management.

To achieve the objectives, the systems are diligently managed, taking appropriate measures to protect them against accidental or deliberate damage that may affect the availability, authenticity, integrity, confidentiality or traceability of the information processed, or the services provided.

The goal of information security is to guarantee the quality of information and the continuous provision of services, acting preventively, monitoring daily activity and reacting effectively to incidents.

To achieve the highest level of quality and safety in our processes and services, we ensure that they are carried out effectively through our procedures, which describe our processes.

Information security policy

The adoption of the Information Security Management System (ISMS) aims to achieve compliance with the following commitments:

- Comply with the requirements set out in ISO 27001 standards (Information Security Management System).

- Comply with legal, regulatory, statutory, customer and other applicable requirements, ensuring information security effectively.

- Continuously improve the effectiveness of the integrated management system according to ISO 27001 standards.

- Continuous improvement of measures to ensure information security based on the ISMS.

- Analyse and maximise user satisfaction with our solutions and services.

- Our continuous pursuit of excellence is based on the early identification and eradication of the sources of errors. Prevention is always prioritised over correction.

- To achieve the motivation of our human resources, their training, qualification and experience, through appropriate selection, training and development activities.

- To establish and maintain channels of communication and permanent information with our clients, staff, suppliers and society in general.

- The Information Security Policy (ISMS) is made available to the public and interested parties for their information and knowledge.

- The purpose of this Information Security Policy is to protect the information assets of the organisation and our clients and to operate in a secure and controlled environment. This fundamental objective serves as the framework for all the activities and services we provide. Likewise, the organisation diligently manages its IT (Information Technology) systems, taking appropriate measures to protect them against accidental or deliberate damage that could affect the availability, authenticity, integrity, confidentiality, or traceability of the information processed, or the services provided, and reporting and addressing security incidents appropriately.

- Senior management is committed to complying with applicable information security requirements and providing the necessary resources for such compliance.

In addition:

- The information is protected against loss and its corresponding: Availability, Confidentiality, Authenticity, Integrity and Traceability.

- The information is protected against unauthorised access.

- The business requirements regarding information security and information systems are met.

- Security incidents are reported and handled appropriately.

To fulfill these commitments, Management provides the Management System with all the necessary tools, both documented and computer-based, to ensure that the Information Security Policy (ISMS) is understood, developed, applied and remains in force at all levels of the organisation.

Furthermore, the company establishes annually (taking advantage of the Management Review and Analysis of the Management System, as well as the Risk/Opportunity analysis with stakeholders and processes) a series of Information Security (ISMS) objectives and targets, as well as our management objectives related to the development, evolution, and consolidation of the business and information security. These objectives may be qualitative or quantitative, but in any case, they must be verifiable in terms of compliance and effectiveness. Progress in achieving these objectives is evaluated by Management and by the Integrated Management System Manager during the periodic review of the Integrated Management System.

Within the Information Security Policies, NACSPORT is prepared to prevent, detect, react to and recover from incidents.