Security policy

Approval and entry into force

This Information Security Policy is effective from the date of signature and until replaced by a new Policy.

APTENT Mission

To achieve its objectives, APTENT assumes its commitment to information security, committing to its proper management, in order to offer all its interest groups the greatest guarantees regarding the security of the information used.

These systems must be managed diligently, taking appropriate measures to protect them against accidental or deliberate damage that may affect the availability, integrity or confidentiality of the information processed or the services provided.

The objective of information security is to guarantee the quality of information and the continued provision of services, acting preventively, supervising daily activity and reacting quickly to incidents.

ICT systems must be protected against rapidly evolving threats with the potential to impact the confidentiality, integrity, availability, intended use and value of information and services. Defending against these threats requires a strategy that adapts to changes in environmental conditions to ensure continued service delivery. This implies that departments must apply the minimum security measures required by the National Security Scheme, as well as continuously monitor service delivery levels, follow and analyze reported vulnerabilities, and prepare an effective response to incidents to guarantee the continuity of the services provided.

The different departments must ensure that ICT security is an integral part of each stage of the system’s life cycle, from its conception to its decommissioning, through development or acquisition decisions and exploitation activities. Security requirements and financing needs must be identified, both for the products you develop and their associated services, as well as for the base software acquired from third parties.

Departments must be prepared to prevent, detect, react and recover from incidents, in accordance with Article 8 of the ENS (Article 8. Prevention, detection, response and conservation).

The information security policy is the set of guidelines that govern the way in which an organization manages and protects the information it processes and the services it provides. To this end, the instrument that approves said security policy must include, at a minimum, the following points:

a) The objectives or mission of the organization.

b) The regulatory framework in which the activities will be carried out.

c) The security roles or functions, defining for each one, their duties and responsibilities, as well as the procedure for their appointment and renewal.

d) The structure and composition of the committee or committees for the management and coordination of the security, detailing its scope of responsibility and the relationship with other elements of the organization.

e) The guidelines for structuring the system’s security documentation, its management and access.

f) The risks arising from the processing of personal data.

The security policy has been established in accordance with the basic principles indicated in chapter II and will be developed applying the following minimum requirements:

a) Organization and implementation of the security process.

b) Risk analysis and management.

c) Personnel management.

d) Professionalism.

e) Authorization and access control.

f) Protection of facilities.

g) Acquisition of security products and contracting of security services.

h) Least privilege.

i) Integrity and updating of the system.

j) Protection of information stored and in transit.

k) Prevention against other interconnected information systems.

l) Activity recording and detection of harmful code.

m) Security incidents.

n) Continuity of the activity.

ñ) Continuous improvement of the security process.

Scope

The information systems that support the development, implementation, consulting carried out by the accessibility department according to the current categorization.

Objectives

For all of the above, the Management establishes the following information security objectives:

• Provide a framework to increase resilience to provide an effective response.
• Ensure the rapid and efficient recovery of services, in the face of any physical disaster or contingency that may occur and put the continuity of operations at risk.
• Prevent information security incidents to the extent technically and economically viable, as well as mitigate information security risks generated by our activities.
• Guarantee the confidentiality, integrity, availability, authenticity and traceability of the information.

Regulatory framework

One of the objectives must be to comply with applicable legal requirements and any other requirements that we subscribe to in addition to the commitments acquired with clients, as well as their continuous updating. To this end, the legal and regulatory framework in which we develop our activities is:

• REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016 regarding the protection of natural persons with regard to the processing of personal data and the free circulation of these data.
• Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights.
• Royal Legislative Decree 1/1996, of April 12, Intellectual Property Law.
• Law 2/2019, of March 1, which modifies the consolidated text of the Intellectual Property Law, approved by Royal Legislative Decree 1/1996, of April 12, and by which Directive 2014/26/EU of the European Parliament and of the Council, of February 26, 2014, and the Directive (EU) are incorporated into the Spanish legal system. 2017/1564 of the European Parliament and of the Council, of September 13, 2017.
• Royal Decree 311/2022, of May 3, which regulates the National Security Scheme.
• Law 34/2002 of July 11 on Information Society Services and Electronic Commerce (LSSI).
• Law 40/2015, of October 1, on the Legal Regime of the Public Sector.
• Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations.

Development

In order to achieve these objectives it is necessary:

• Continuously improve our information security system.
• Identify potential threats, as well as the impact on business operations that these threats, if they materialize, may cause.
• Preserve the interests of its main stakeholders (customers, shareholders, employees and suppliers), reputation, brand and value creation activities.
• Work jointly with our suppliers and subcontractors in order to improve the provision of IT services, the continuity of services and the security of information, which results in greater efficiency in our activity.
• Evaluate and guarantee the technical competence of the staff, as well as ensure their adequate motivation for their participation in the continuous improvement of our processes, providing adequate training and internal communication so that they develop good practices defined in the system.
• Guarantee the correct condition of the facilities and the appropriate equipment, so that they are in accordance with the activity, objectives and goals of the company.
• Guarantee a continuous analysis of all relevant processes, establishing the relevant improvements in each case, based on the results obtained and the established objectives.
• Structure our management system so that it is easy to understand. Our management system has the following structure:

The management of our system is entrusted to the SYSTEMS MANAGER and the system will be available in our information system in a repository, which can be accessed according to the access profiles granted according to our current access management procedure.

Security Organization

The essential responsibility falls on the General Management of APTENT, since it is responsible for organizing the functions and responsibilities and for providing adequate resources to achieve the objectives of the ENS. Managers are also responsible for setting a good example by following established safety standards.

These principles are assumed by the Management, who provides the necessary means and provides its employees with sufficient resources for their compliance, expressing and making them publicly known through these Security Policies.

The defined security roles or functions are:

This definition of duties and responsibilities is completed in the job profiles and in the Registry of Managers, Roles and Responsibilities system documents.

Conflict Resolution

Differences in criteria that could lead to a conflict will be dealt with within the Security Committee and the criteria of the General Directorate will prevail in all cases.

Security Committee

The procedure for their appointment and renewal will be ratification by the security committee.

The committee for security management and coordination is the body with the greatest responsibility within the information security management system, so that all the most important decisions related to security are agreed upon by this committee.

The members of the Information Security Committee are:

• Information Manager
• Responsible for Services
• Security Manager
• System Manager
• Company Address 

These members are appointed by the committee, the only body that can appoint, renew and dismiss them. 

The safety committee is an autonomous, executive body with autonomy for decision-making and that does not have to subordinate its activity to any other element of our company. 

APTENT Information Security is developed in the complementary document to this Security Organization Policy.

This policy is complemented by the rest of the policies, procedures and documents in force to develop our management system.

Risk Management

All systems subject to this Policy must carry out a risk analysis, evaluating the threats and risks to which they are exposed. This analysis is reviewed regularly:

• at least once a year;
• when the information handled changes;
• when the services provided change;
• when a serious security incident occurs;
• when serious vulnerabilities are reported.

To harmonize risk analyses, the ICT Security Committee will establish a reference assessment for the different types of information handled and the different services provided. The ICT Security Committee will boost the availability of resources to meet the security needs of the different systems, promoting horizontal investments.

To carry out the risk analysis, the risk analysis methodology developed in the Risk Analysis procedure will be taken into account.

Personnel Management

All members of APTENT have the obligation to know and comply with this Information Security Policy and the Security Regulations, and it is the responsibility of the ICT Security Committee to provide the necessary means for the information to reach those affected.

All APTENT members will attend an ICT security awareness session at least once a year. A continuous awareness program will be established to serve all APTENT members, particularly new members.

Persons with responsibility for the use, operation or administration of ICT systems will receive training in the safe handling of the systems to the extent they need it to carry out their work. Training will be mandatory before assuming a responsibility, whether it is your first assignment or whether it is a change of job or responsibilities therein.

HR Professionalism and Safety

This Policy applies to all APTENT personnel and external personnel who perform tasks within the company.

HR will include information security functions in employee job descriptions, inform all hired personnel of their obligations regarding compliance with the Information Security Policy, manage Confidentiality Commitments with personnel, and coordinate user training regarding this Policy.

• The Security Management Manager (RGS) is responsible for monitoring, documenting and analyzing reported security incidents, as well as communicating to the Information Security Committee and information owners.
• The Information Security Committee will be responsible for implementing the necessary means and channels for the Security Management Manager (RGS) to handle incident reports and system anomalies. The Committee will also be aware of, supervise the investigation, monitor the evolution of information and promote the resolution of information security incidents.
• The Security Management Manager (RGS) will participate in the preparation of the Confidentiality Commitment to be signed by employees and third parties who perform functions at APTENT, in advising on the sanctions that will be applied for non-compliance with this Policy and in the treatment of information security incidents.
• All APTENT staff are responsible for reporting information security weaknesses and incidents that are detected in a timely manner.
•  Professionalism of human resources:
• Determine the necessary competence of personnel to carry out work that affects Information Security.
• Ensure that people are competent based on appropriate education, training or experience.
• Demonstrate through documented information that the competency of personnel in matters of Information Security is necessary.

The objectives of controlling personnel safety are:

• Reduce the risks of human error, implementation of irregularities, improper use of facilities and resources, and unauthorized handling of information.
• Explain security responsibilities at the personnel recruitment stage and include them in the agreements to be signed and verify compliance during the performance of the tasks. employee tasks.
• Ensure that users are aware of information security threats and concerns and are trained to support the APTENT Information Security Policy in the course of their normal duties.
• Establish confidentiality commitments with all staff and users outside the information processing facilities.
• Establish the necessary tools and mechanisms to promote the communication of existing security weaknesses, as well as incidents, in order to minimize their effects and prevent their recurrence.

Authorization and Access Control to Information Systems

Controlling access to information systems aims to:

• Prevent unauthorized access to information systems, databases and information services.
• Implement security in user access through authentication and authorization techniques.
• Control the security of the connection between the APTENT network and other public or private networks.
• Review critical events and activities carried out by users on the systems.
• Raise awareness about your responsibility for the use of passwords and equipment.
• Ensure information security when using laptops and personal computers for remote work.

Protection of Facilities

The objectives of this policy regarding the protection of facilities are:

Prevent unauthorized access, damage and interference to APTENT headquarters, facilities and information

• Protect APTENT critical information processing equipment by placing it in protected areas and protected by a defined security perimeter, with appropriate security measures and access controls. Likewise, consider its protection during its transfer and remain outside the protected areas, for maintenance or other reasons.
• Control environmental factors that could harm the proper functioning of the computer equipment that houses the APTENT information.
• Implement measures to protect the information handled by staff in the offices, within the normal framework of their usual tasks.
• Provide protection proportional to the identified risks.

This Policy applies to all physical resources related to APTENT information systems, facilities, equipment, wiring, files, storage media, etc.

It should be noted that in the case of APTENT, all development, quality, etc. environments are located externally in secure hosting, so only the laptops and peripherals must be protected locally.

The Head of Security Management (RGS), together with the Information Holders, as appropriate, will define the physical and environmental security measures for the protection of critical assets, based on a risk analysis, and will supervise their application. It will also verify compliance with physical and environmental security provisions.

Those responsible for the different departments will define the levels of physical access of APTENT staff to the restricted areas under their responsibility. Information Owners will formally authorize off-site work with information about their business to APTENT employees when they deem it appropriate.

All APTENT staff are responsible for compliance with the clean screen and desktop policy, for the protection of information related to daily work in the offices.

Product acquisition

The different departments must ensure that ICT security is an integral part of each stage of the system’s life cycle, from its conception to its decommissioning, through development or acquisition decisions and exploitation activities. Security requirements and financing needs must be identified and included in planning, requests for offers, and bidding documents for ICT projects.

On the other hand, information security will be taken into account in the acquisition and maintenance of information systems, limiting and managing change.

Default security

APTENT considers it strategic for the entity that the processes integrate information security as part of their life cycle. Information systems and services must include security by default from their creation to their withdrawal, including security in development and/or acquisition decisions and in all activities in operation, establishing security as an integral and transversal process.

System integrity and updating

APTENT is committed to guaranteeing the integrity of the system through a change management process that allows control of the update of physical or logical elements through authorization prior to their installation in the system. Said evaluation will be carried out mainly by the technical management who will evaluate the impact on the security of the system before making the changes and will control in a documented manner those changes that are evaluated as important or with implications on the security of the systems.

Through periodic security reviews, the security status of the systems will be evaluated in relation to the manufacturers’ specifications, vulnerabilities and updates that affect them, reacting diligently to manage the risk in view of their security status.

Protection of information stored and in transit

APTENT establishes protection measures for the Security of Information stored or in transit through insecure environments. Laptops, peripheral devices, information carriers and communications over open networks or with weak encryption will be considered insecure environments.

Prevention of interconnected information systems

APTENT, establishes protection measures for Information Security especially to protect the perimeter, in particular, if connected to public networks, especially if they are used in whole or mainly, for the provision of electronic communications services available to the public.

In any case, the risks derived from the interconnection of the system, through networks, with other systems will be analyzed, and their connection point will be controlled. Electronic connections available to the public.

Activity logs

APTENT will record user activities, retaining the necessary information to monitor, analyze, investigate and document improper or unauthorized activities, allowing the person acting to be identified at all times.

The main objectives of Incident Management are to:

• Establish a detection and reaction system against harmful code.
• Have procedures for managing security incidents and weaknesses detected in the elements of the information system.
• These procedures will cover detection mechanisms, classification criteria, analysis and resolution procedures, as well as communication channels to interested parties and the record of actions.
• This log is used for continuous improvement of system security.
• Ensure that IT services return to optimal performance.
• Reduce the possible risks and impacts that the incident may cause.
•  Ensure the integrity of the systems in the event of a security incident.
• Communicate the impact of an incident as soon as it is detected to activate the alarm; and implement an appropriate business communication plan.
• Promote business efficiency.

Continuity of activity

APTENT, with the aim of guaranteeing the continuity of activities, establishes measures so that the systems have backup copies and establishes necessary mechanisms to guarantee the continuity of operations, in the event of loss of the usual means of work.

Continuous improvement of the security process

APTENT establishes a process of continuous improvement of information security by applying the criteria and methodology established in the National Security Scheme.

In Leganés, on January 17, 2025