Objective

The information processed at CASA TARRADELLAS is an asset with great value for the organization and consequently it is necessary that it is duly protected. For these purposes, measures must be implemented to guarantee the following aspects:

Measures to be implemented

Through the Information Security Policy and the other policies that hang on it, a series of measures are intended to be implemented with the aim of guaranteeing this information security. These measures are oriented in a series of principles provided for in the Information Security Policy and which by way of summary are the following.

• Ensure compliance of all information systems with applicable regulations, both external and internal
• Manage the risk so that they reach an acceptable level
• Carry out staff training and awareness tasks
• Guarantee the availability, integrity and confidentiality of the company’s information and data
• Establish measures that are proportional to the identified risks
• Make clear the responsibility of all members and collaborators of the company with regard to information security
• Recurrently review the degree of effectiveness of the controls and thus establish a process of continuous improvement

Roles and responsibilities

Information security is everyone’s business and, in this sense, all of us who are part of CASA TARRADELLAS have the responsibility to implement the measures that are necessary to guarantee this security, among which the following are mentioned:

1. Keep professional secrecy regarding the information of CASA TARRADELLAS as well as with respect to the personal data to which you have access
2. Do not transfer confidential information or personal data to third parties without the necessary authorization
3. Report any incident detected to affect information security
4. Ensure that information and personal data are properly stored securely, including information on a physical medium which must be stored in closed cabinets (trying in any case to limit the use of information on physical media)
5. Use corporate devices only for professional purposes and following the indications of access and use indicated by the company

Without prejudice to the foregoing, CASA TARRADELLAS has defined the following roles and responsibilities responsible for ensuring information security:

1. Security Committee: body responsible for promoting, controlling, and monitoring compliance with the security measures necessary to guarantee information security. It also acts as a point of contact with the competent authorities in case incidents are detected.
2. ICT Systems Manage: develop, operate, and maintain the information system and implement the necessary security measures.
3. Owner of the Asset: ensure compliance with the security measures that are implemented as well as report incidents that are detected and propose improvements.
4. Legal Services: ensure compliance with current regulations on data protection and information security.

Specific Policies

Within the framework of the Information Security Policy, the following most relevant specific policies have been defined on specific measures that are mandatory for all users:

1. Access control: limiting access to assets and information to prevent unauthorized access.
2. Classification of information: guarantee the correct protection of information according to its nature and degree of sensitivity.
3. Physical and environmental security: guarantee unauthorized access as well as losses, damages, thefts, and compromise of the company’s physical and digital assets.
4. User-oriented measures: ensure that there is (i) adequate use of assets, (ii) a clean workplace to avoid loss of information, (iii) that information is exchanged securely, (iv) guarantee security in the use of corporate devices, (v) control the installation and use of appropriate software to guarantee their security.
5. Making copies and continuity plans: guarantee that the company owns and maintains secure backup copies of the information if it is necessary to resort to them in case of incident.
6. Prevention and detection of viruses and other malicious software: ensure the installation and use of programs to protect the organization against viruses or malicious software.
7. Management of technical vulnerabilities: adopt measures to address technical vulnerabilities in their applications.
8. Cryptographic controls: the use of cryptographic controls to protect the confidentiality and integrity of information.
9. Security in communications: protect the information stored on the network.
10. Privacy and protection of personal information: ensure compliance with data protection regulations.
11. Relationship with suppliers: guarantee that all these measures are also complied with respect to suppliers.