Contact

Information Security Policy

The Information Security Policy of CASA TARRADELLAS aims to establish a series of measures to guarantee the security of the information processed within the company.

1. Objective

The information processed at CASA TARRADELLAS is an asset of great value to the organisation and, consequently, it must be duly protected. For this purpose, it is necessary to implement measures to guarantee the following aspects:

  • Availability: to ensure that users can access information when they need it.
  • Integrity: to ensure that information is complete and accurate.
  • Confidentiality: to ensure that information is accessible only to authorised users.

The implementation of information security measures also protects the following assets:

  • Business strategy: information is one of the most important assets for companies insofar as it contains confidential data of strategic value for the organisation. In this sense, information must be duly protected to guarantee business protection.
  • Compliance with regulations and contracts: ensuring information security is also essential to guarantee compliance with contractual commitments as well as with current regulations.
  • Security against threats: in an environment increasingly threatened by attacks on information systems, it is essential to implement policies that allow the control and restriction of unauthorised access.

2. Measures to be implemented

Through the Information Security Policy and the other policies derived from it, a series of measures are intended to be implemented with the objective of guaranteeing information security. These measures are based on a set of principles established in the Information Security Policy and, by way of summary, are as follows:

  • Ensure compliance of all information systems with applicable regulations, both external and internal.
  • Manage risk so that it reaches an acceptable level.
  • Carry out staff training and awareness activities.
  • Guarantee the availability, integrity and confidentiality of company information and data.
  • Establish measures that are proportional to the risks identified.
  • Make evident the responsibility of all members and collaborators of the company with regard to information security.
  • Periodically review the effectiveness of controls and thus establish a process of continuous improvement.

3. Roles and responsabilities

Information security is everyone’s responsibility and, in this sense, all those who form part of CASA TARRADELLAS are responsible for implementing the measures necessary to guarantee such security, including the following:

  • Maintain professional secrecy regarding CASA TARRADELLAS information as well as personal data to which access is granted.
  • Not disclose confidential information or personal data to third parties without the necessary authorisation.
  • Report any incident detected that affects information security.
  • Ensure that information and personal data are properly and securely stored, including information in physical format, which must be kept in locked cabinets (always seeking to limit the use of information in physical format).
  • Use corporate devices solely for professional purposes and in accordance with the access and usage instructions indicated by the company.

Without prejudice to the foregoing, CASA TARRADELLAS has defined the following roles and responsibilities entrusted with ensuring information security:

  • Security Committee: body responsible for promoting, controlling and monitoring compliance with the security measures necessary to guarantee information security. It also acts as the point of contact with the competent authorities in the event that incidents are detected.
  • Security Officer: responsible for maintaining the security of the information processed and the services provided and for promoting training and awareness in information security matters.
  • ICT Systems Manager: responsible for developing, operating and maintaining the information system and implementing the necessary security measures.
  • Asset Owner: responsible for ensuring compliance with the security measures implemented, as well as reporting detected incidents and proposing improvements.
  • Legal Services: responsible for ensuring compliance with current regulations on data protection and information security.

4. Specific Policies

Within the framework of the Information Security Policy, the following most relevant specific policies have been defined regarding specific measures that are mandatory for all users:

  • Access control: limit access to assets and information in order to prevent unauthorised access.
  • Information classification: ensure adequate protection of information according to its nature and degree of sensitivity.
  • Physical and environmental security: prevent unauthorised access as well as loss, damage, theft and compromise of the company’s physical and digital assets.
  • User-oriented measures: ensure (i) proper use of assets, (ii) a clean workstation to avoid information loss, (iii) secure exchange of information, (iv) security in the use of corporate devices, (v) control of the installation and use of appropriate software to ensure security.
  • Backups and continuity plans: ensure that the company has and securely maintains backup copies of information for use in the event of an incident.
  • Prevention and detection of viruses and other malicius softwre: ensure the installation and use of programs to protect the organisation against viruses or malicious software.
  • Management of technical vulnerabilites: adopt measures to address technical vulnerabilities in applications.
  • Cryptographic controls: use cryptographic controls to protect the confidentiality and integrity of information.
  • Communications security: protect information stored on the network.
  • Privacy and protection of personal information: ensure compliance with data protection regulations.
  • Relationship with suppliers: ensure that all these measures are also complied with by suppliers.