Data Protection

Information security policies

– set of rules for information security, approved by the company’s management, published and communicated to employees and relevant external parties.

Review of information security rules

– To ensure effectiveness and continued appropriateness, we review our information security rules at planned intervals or when significant changes occur.

Information security roles and responsibilities

– establish and assign specific information security responsibilities to all employees and external collaborators.

Segregation of duties

– we separate areas of responsibility to reduce the chances of unauthorised or unintended disclosure, modification or use of organisational assets.

Information security in project management

– We address information security in project management, regardless of the type of project.

Mobile device rules

– we use rules and security measures to deal with the risks of using mobile devices. We use security rules and measures to protect information accessed, processed or stored on mobile devices.

Managing security during employment

– We conduct checks on all applicants for available jobs in accordance with relevant laws, regulations and ethics and proportionate to business requirements, classification of information to be accessed and perceived risks. The contractual agreement between us and our employees specifies responsibilities of both parties regarding information security. Information security, responsibilities and duties that remain valid after termination of employment or change of employment within the organisation are defined, communicated to the employee or external contractor and enforceable.

Management responsibilities

– Company management requires all employees and contractors to comply with information security in accordance with the rules and procedures established by the organisation.

Information security awareness, education and training

– all employees of the organisation are continuously made aware of organisational rules and procedures relevant to their function.

Managing and removing removable media

– we use procedures that implement the management of removable media devices. When no longer needed, removable media devices are destroyed, ensuring that data can no longer be read.

Transfer of physical materials

– materials containing information are protected against unauthorised access, improper or unauthorised use and corruption during transport.

Access control and management

– We use an access control policy, which is reviewed based on business and information security requirements. Users are only given access to the networks/network services they have been authorised to use.

Managing and using user login passwords

– we use a process to control the allocation of authentication information. Users follow best practices in the use of secret authentication information. We use our password management system to ensure quality passwords.

Restricting access to information

– access to application information and functions is restricted in accordance with access control rules.

Secure login

– Access to systems and applications is controlled through a secure authentication process.

Physical location and protection of equipment

– IT&C equipment is located and protected to reduce risks from environmental threats and hazards and the possibility of unauthorised access.

Utilities and cable security

– equipment is protected from power failures and other interruptions caused by utility support failures. Power and telecommunications cables carrying data are protected from interception, interference or damage.

Equipment maintenance

– equipment is continuously and properly maintained to ensure its availability and integrity.

Checking and safe re-use of equipment

– multiple overwriting of data and low level formatting of storage media is provided to ensure that sensitive information and licensed software is securely removed or overwritten prior to disposal or reuse of equipment.

Clear desk / clear screen

– we have adopted clear rules for documents and removable storage media and a clear screen rule for information processing facilities.

Procedures for working with documents

– we have defined operating procedures and made them available to all users who need them.

Separation of development, testing and operational environments

– We use separate environments for development, testing and operation to reduce the risk of unauthorised access or changes to the operational environment.

Controls against malware

– We implement detection, prevention and recovery controls to ensure protection against malware and combine these controls with appropriate user awareness.

Safety children

– we regularly back up information and systems. The number of backups is correlated to the potential risks of the information and systems supported.

Event logging and log file protection

– we produce, maintain and regularly review event logs that record user activities, exceptions, defects and information security events. Log files are protected.

Installing software on operating systems

– we have established rules governing the installation of software on operating systems, especially user installation.

Managing vulnerabilities

– Technical vulnerabilities are managed by mitigating them in a timely manner, assessing the organisation’s exposure and taking appropriate measures that address the associated risk.

Restrictions on changes to software packages

– we use software modification rules, limiting this action to necessary changes.

Addressing security in supplier agreements

– We review, document and agree with our suppliers information security requirements to reduce the risks associated with supplier access to the organisation’s assets.

Reporting information security events and incidents

– when information security events are observed, they are reported through the appropriate management channels in a timely manner. Employees and contractors note and report any observed or suspected weaknesses in systems or services. We assess and classify the information security events we face accordingly. We respond in a timely manner and in accordance with our internal procedures to information security incidents. We use the knowledge we gain when analysing and resolving information security incidents to reduce the likelihood or impact of future incidents. We have a process for identifying, collecting, acquiring and retaining information that can be used as evidence.

Intellectual property rights

– implement appropriate procedures to ensure compliance with legislative, regulatory and contractual requirements related to intellectual property rights and the use of proprietary software products.

Review of technical compliance

– IT systems are regularly reviewed to comply with the organisation’s security rules and standards.