Information security policy

Scope
This policy applies to all ICT systems of the entity and to all EASY TECH GLOBAL personnel and external personnel performing tasks within the company, involved in services and projects, without exception. That is to say: The information systems that support the development, maintenance, and implementation of IT services in mobile and web applications.

Mission and objectives of the organization

EASY TECH GLOBAL, in order to achieve its objectives, assumes its commitment to information security, committing to the proper management of this information, in order to offer all its stakeholders the greatest guarantees regarding the security of the information used.

These systems must be managed diligently, taking appropriate measures to protect them against accidental or deliberate damage that may affect the availability, integrity, or confidentiality of the information processed or the services provided.

EASY TECH GLOBAL‘s fundamental objective with regard to information security is to guarantee the quality of information and the continuous provision of services, acting preventively, monitoring daily activity and reacting promptly to incidents.

Therefore, the organization establishes general objectives:

• Establish and generate appropriate control measures to guarantee compliance with the requirements demanded by the National Security Scheme or legal requirements that are necessary as a result of the activity carried out, especially in relation to the protection of personal data and the provision of services through electronic or telematic means.
• Continuously improve our information security system.
• Identify potential threats, as well as the impact on business operations that such threats, should they materialize, could cause.
• Preserve the interests of its main stakeholders (customers, shareholders, employees and suppliers), reputation, brand and value creation activities.

• Working together with our suppliers and subcontractors to improve IT service delivery, service continuity, and information security, resulting in greater efficiency in our operations.
• To ensure the proper condition of the facilities and the appropriate equipment, so that they correspond to the activity, objectives and goals of the company.
• Ensure continuous analysis of all relevant processes, establishing appropriate improvements in each case, based on the results obtained and the objectives set.
• To assess and guarantee the technical competence of the staff, as well as to ensure their adequate motivation for participation in the continuous improvement of our processes, providing the appropriate training and internal communication so that they develop good practices defined in the system.
• Departments must be prepared to prevent, detect, react to and recover from incidents, in accordance with Article 8 of Royal Decree 311/2022, of May 3, which regulates the National Security Scheme (ENS) (Article 8. Prevention, detection, response and preservation).
• Continuously monitor service delivery levels, track and analyze reported vulnerabilities, and prepare an effective incident response to ensure the continuity of services provided.

Regulatory framework

The organization ( EASY TECH GLOBAL ) is responsible for complying with applicable legal requirements and any other requirements to which we subscribe, in addition to the commitments made to our clients, as well as for their continuous updating. To this end, the legal and regulatory framework within which we operate is:

• REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
• Organic Law 3/2018, of December 5, on the Protection of Personal Data and the guarantee of digital rights.
• Royal Legislative Decree 1/1996, of April 12, Intellectual Property Law.
• Law 2/2019, of March 1, which modifies the consolidated text of the Intellectual Property Law, approved by Royal Legislative Decree 1/1996, of April 12, and which incorporates into Spanish law Directive 2014/26/EU of the European Parliament and of the Council, of February 26, 2014, and Directive (EU) 2017/1564 of the European Parliament and of the Council, of September 13, 2017.
• Royal Decree 311/2022, of May 3, which regulates the National Security Scheme.
• Law 34/2002 of July 11 on Information Society Services and Electronic Commerce (LSSI).
• Law 40/2015, of October 1, on the Legal Regime of the Public Sector.
• Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations.
• ISO/IEC 27001 standard, for the effective implementation of business information security, developed in the ISO 27001 and ISO 27002 standards.

Information Security Organization

Information security is the set of preventative and reactive measures that safeguard and protect information. In other words, it encompasses all the policies and measures that affect the processing of data used within an organization. In this case, the primary responsibility lies with the organization’s senior management, as they are responsible for structuring functions and responsibilities and providing the necessary resources to ensure the safeguarding, protection, and achievement of objectives. Managers are also responsible for setting a good example by adhering to established security standards.

These principles are adopted by Management, who provides the necessary means and equips its employees with sufficient resources for their fulfillment, and are embodied and made public through this Security Policy.

The defined security roles or functions are:

As part of the Information Security organization, the following objectives are established:

• Guarantee the confidentiality, integrity, availability, authenticity and traceability of information.
• To provide a framework to increase the capacity for resistance or resilience to give an effective response.
• To safeguard EASY TECH GLOBAL’s information assets and the technology that supports them against any threat, intentional or accidental, internal or external, in order to ensure their confidentiality, integrity and availability.
• To ensure the rapid and efficient recovery of services in the face of any physical disaster or contingency that may occur and that could jeopardize the continuity of operations.
• To prevent information security incidents to the extent that it is technically and economically feasible, as well as to mitigate information security risks generated by our activities.
  

Security Committee

The Information Security Committee is the entity that brings together the management of information security in the organization, is in charge of the management and coordination of security and is the body with the greatest responsibility within the information security management system (ISMS), so that all the most important decisions related to security are agreed by this committee.

The information security committee consists of:

• Information Officer.
• Services Officer.
• Security Officer.
• System Manager.
• Company Management.
  

These members are appointed by the committee, the only body that can appoint, renew and dismiss them.

The Information Security Committee will be responsible for implementing the necessary means and channels for the Information Security Officer (RSEG) to handle reports of system incidents and anomalies. The Committee will also be aware of, oversee the investigation of, monitor the evolution of information, and promote the resolution of information security incidents.

The security committee is an autonomous, executive body with autonomy for decision-making and does not have to subordinate its activity to any other element of our company. 

This policy is complemented by the rest of the policies, rules, procedures and instructions in force to develop our management system.

Conflict resolution

Any differences of opinion that could lead to a conflict will be addressed within the Security Committee and the opinion of the General Management will prevail in all cases. 

Information classification 

EASY TECH GLOBAL will classify and inventory information assets according to their nature. The level of protection and the measures to be applied will be based on the result of this classification.

Risk Management

All systems subject to this Policy must conduct a risk analysis, assessing the threats and risks to which they are exposed. This analysis is reviewed regularly.

• At least once a year;
• When the information handled changes;
• When the services provided change;
• When a serious security incident occurs;
• When serious vulnerabilities are reported
  

To harmonize risk analyses, the ICT Security Committee will establish a benchmark assessment for the different types of information handled and the various services provided. The ICT Security Committee will facilitate the availability of resources to address the security needs of the different systems, promoting cross-functional investments.

For the performance of the risk analysis, the risk analysis methodology developed in the Risk Analysis procedure will be taken into account.

 Personal data

All EASY TECH GLOBAL information systems will comply with the security levels required by the regulations for the nature and purpose of the personal data. The provisions of European Regulation 679/2016 on data protection and Organic Law 3/2018, of December 5, on the Protection of Personal Data and its implementing regulations will apply, without prejudice to the requirements established in the regulatory framework of the National Security Scheme in the field of Electronic Administration.

Commitments of the Security Officer:

• The security officer (RSEG) is responsible for monitoring,
  documenting, and analyzing reported security incidents, as well as communicating with the Information Security Committee and information owners.
• The Security Officer (RSEG) will participate in the preparation of the Confidentiality Agreement that will be signed by employees and third parties performing functions at EASY TECH GLOBAL, in advising on the sanctions that will be applied for non-compliance with this Policy and in the handling of information security incidents.
• Ensure that users are aware of information security threats and concerns and are trained to support the organization’s Information Security Policy in the course of their normal tasks.
• Ensuring information security when using laptops and personal computers for remote work.
• Reduce the risks of human error, implementation of irregularities, misuse of facilities and resources, and unauthorized handling of information.
• The Security Officer (RSEG), together with the information owners, as appropriate, will define physical and environmental security measures for the protection of critical assets, based on a risk analysis, and will monitor their implementation. They will also verify compliance with the physical and environmental security provisions.
• With the aim of fostering a ‘Culture of Security’, the Information Security Committee will promote a continuous awareness program to train all staff. 
• Implement these regulations and ensure compliance.
• Establish plans to ensure business continuity.
• Promote the design and implementation of DRP (Disaster recovery plan).
• Promote and collaborate with business areas for the design and implementation of business continuity plans ( BCP ).

HR Responsibilities

• HR will include information security functions in employee job descriptions, inform all new hires of their obligations regarding compliance with the Information Security Policy, manage Confidentiality Agreements with staff, and coordinate user training tasks regarding this Policy.
• All EASY TECH GLOBAL staff are responsible for promptly reporting any information security weaknesses and incidents that are detected.
• Determine the necessary competence of the staff to carry out the work that affects Information Security.
• It is necessary to ensure that people are competent based on appropriate education, training, or experience.
• Demonstrate, through documented information, the competence of the staff in matters of Information Security.
• Explain the security responsibilities during the staff recruitment stage and include them in the agreements to be signed, and verify compliance during the employee’s performance of their duties.

Staff obligations

• Acceptance of confidentiality agreements with all staff and users outside of information processing facilities.
• Establish the necessary tools and mechanisms to promote communication of existing security weaknesses, as well as incidents, in order to minimize their effects and prevent their recurrence.
• All members of EASY TECH GLOBAL are obligated to know and comply with this Information Security Policy and other information security regulations. It is the responsibility of the ICT Security Committee to provide the necessary means for the information to reach those affected.
• All EASY TECH GLOBAL members will attend an ICT security awareness session at least once a year. An ongoing awareness program will be established to serve all EASY TECH GLOBAL members, particularly new members.
• Individuals responsible for the use, operation, or administration of ICT systems will receive training in the secure handling of these systems to the extent necessary to perform their work. This training will be mandatory before assuming any responsibility, whether it is their first assignment or a change in job position or responsibilities within the same position.
• All personnel with responsibility for the use, operation, or administration of information and communications technology systems have the obligation to know and comply with this Information Security Policy and the derived security regulations, regardless of the type of legal relationship that links them to the organization.
• Failure to comply with the Security Policy and its implementing regulations will result in the establishment of preventive and corrective measures aimed at safeguarding and protecting information networks and systems, without prejudice to the corresponding requirement of disciplinary responsibility.
• Users are responsible for their credentials and for not disclosing or sharing them.
• All users have the obligation and responsibility to notify the Security Officer if they suspect or are victims of an information security incident.

Implementation framework

An information security regulatory framework has been established, the structure of which is segregated into different levels so that the objectives set out in this document have a specific development:

The rules are proposed by the security officer and approved by the Information Security Committee, while the approval of procedures and instructions will depend on their scope of application, which may be in a specific area or in a specific information system.

Relationships with third parties 

EASY TECH GLOBAL, as a service provider or when it transfers information to third parties, will make them aware of this Information Security Policy and the rules, procedures and instructions derived from it. 

Similarly, when EASY TECH GLOBAL uses third-party services or transfers information to third parties, they will also be informed of this Information Security Policy and the regulations, procedures, and security instructions pertaining to those services or information. Third parties will be subject to the security obligations and measures established in said regulations and instructions, and may develop their own operating procedures to comply with them. Specific procedures for detecting and resolving incidents will be established. It will be ensured that third-party personnel are adequately trained in information security matters, at least to the same level as that established in this Information Security Policy. 

Specifically, third parties must guarantee compliance with the information security policy based on auditable standards that allow verification of compliance with these policies.

When any aspect of the Information Security Policy cannot be met by a third party, a report from the Information Security Officer will be required, detailing the risks involved and how they will be addressed. This report will require approval from the Information Officer and the heads of the affected Services.