Information Security Policy

OBJETIVE

• To expose the Information Security Policy as the set of basic principles and lines of action to which the organisation is committed within the framework of the ISO 27001 Standard.

1. SCOPE OFE THE PROCEDURE

This Information Security Policy is applicable to all persons, systems and means that access, process, store, transmit or use the information known, managed or owned by the company for the processes described.

2. RESONSIBILITIES

The Security Officer shall review this policy annually or when significant changes make it appropriate, and resubmit it for management approval.
Reviews shall test the effectiveness of the policy, assessing the effects of technological and business changes.
Management shall be responsible for approving any necessary modifications to the text when a change occurs that affects the risk situations set out in this document.

3. DEFINITIONS

• Information System: organised set of resources so that information can be collected, stored, processed or treated, maintained, used, shared, distributed, made available, presented or transmitted.
• Risk: an estimate of the degree of exposure to a threat to one or more assets causing damage or harm to the organisation.
• Risk management: coordinated activities to direct and control an organisation with respect to risks.
• Information Security Management System (ISMS): management system that, based on the study of risks, is established to create, implement, operate, monitor, review, maintain and improve information security. The management system includes organisational structure, policies, planning activities, responsibilities, practices, procedures, processes and resources.
• Availability: It is necessary to ensure that system resources are available when needed, especially critical information.
• Integrity: System information must be available as it was stored by an authorised agent.
• Confidentiality: Information should only be available to authorised agents, especially its owner.

4. LEGAL REFERENCES

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data (GDPR).
• Organic Law 3/2018, of 5 December, on Data Protection and Guarantee of Digital Rights (LOPDGDD).
• Royal Legislative Decree 1/1996, of 12 April, Law on Intellectual Property.
• Law 34/2002 of 11 July, on information society services and electronic commerce.

5. METHODOLOGY/PROCEDURE

5. 1 INTRODUCTION

Information is a critical, essential and highly valuable asset for the development of the company's activity. This asset must be adequately protected, by means of the necessary security measures, against the threats that may affect it, regardless of the formats, supports, means of transmission, systems or persons involved in its knowledge, processing or treatment.

5. 2 PURPOSE

The purpose of this Information Security Policy is to protect the company's information assets, ensuring the availability, integrity, confidentiality, authenticity and traceability of the information and the facilities, systems and resources that process, manage, transmit and store it, always in accordance with the requirements of the business and current legislation.

5. 3 SCOPE OF THE INFORMATION SECURITY MANAGEMENT SYSTEM

The scope of the Information Security Management System encompasses the information systems that support the processes of maritime transport of passengers, vehicles, goods and the provision of the Freight Forwarding service and the Consignment service in the following work centres:

• Central office located in P.I. Añaza, Edificio Fred. Olsen, s/n. 38111-Santa Cruz de Tenerife
• Vessels
  • Benchijigua Express
  • Bencomo Express
  • Bentago Express
  • Bocayna Express
  • Benchi Express
  • Betancuria Express
  • Bajamar Express
  • Bañaderos Express
  • Buganvilla Express
  • Bentayga Cargo
  • Buganvilla
  • Bahía Cargo
  • Barlovento Express

5. 4 INFORMATION SECURITY PRINCIPLES

Information must be protected throughout its life cycle, from its creation or receipt, during its processing, communication, transport, storage, dissemination and until its eventual deletion or destruction. Therefore, the following minimum principles are established:

• Principle of confidentiality: information systems must be accessible only to those users, bodies and entities or processes expressly authorised to do so, with respect for the obligations of secrecy and professional confidentiality.
• Principle of integrity and quality: the integrity and quality of the information must be guaranteed, as well as that of the information processing processes, establishing mechanisms to ensure that the processes of creation, processing, storage and distribution of the information contribute to preserving its accuracy and correctness.
• Principle of availability and continuity: a level of availability shall be guaranteed in the information systems and the necessary plans and measures shall be put in place to ensure the continuity of services and recovery in the event of serious contingencies.
• Principle of risk management: a continuous process of risk analysis and treatment must be articulated as the basic mechanism on which information systems security management must be based.

• Principle of cost proportionality: the implementation of measures to mitigate the security risks of information systems must be based on a proportionality approach to economic and operational costs, without prejudice to ensuring that the necessary resources for the information security management system are available.
• Principle of awareness and training: Initiatives will be articulated to enable users to be aware of their duties and obligations with regard to the secure processing of information. Similarly, specific ICT security training will be promoted for all those who manage and administer information and telecommunications systems.
• Prevention principle: specific plans and lines of work will be developed to prevent fraud, non-compliance or incidents related to ICT security.

• Principle of detection and response: services must continuously monitor the operation to detect anomalies in the levels of service provision and act accordingly by responding effectively, through the mechanisms established for this purpose, to security incidents.
• Principle of continuous improvement: the degree of compliance with the security improvement objectives planned annually and the degree of effectiveness of the ICT security controls implemented shall be reviewed in order to adapt them to the constant evolution of the risks and technological environment of the Public Administration.
• ICT security principle in the lifecycle of information systems: security specifications shall be included in all phases of the lifecycle of services and systems, accompanied by the corresponding control procedures.
• Differentiated role principle: responsibility for the security of information systems shall be differentiated from responsibility for the provision of services.

5. 5 COMPLIANCE

The Information Security Policy is approved by the company's Management and its content and that of the rules and procedures that develop it is mandatory.

Users who fail to comply with the Information Security Policy or the complementary rules and procedures may be sanctioned in accordance with the provisions of the contracts covering their relationship with the company and with the current and applicable legislation.

5. 6 CLASSIFICATION OF INFORMATION

The information shall be classified according to the sensitivity required for its processing and the levels of security and protection required.

5. 7 ROLES, RESPONSIBILITIES AND DUTIES

Users
Any person or system accessing information processed, managed or owned by the company is considered a user. Users are responsible for their conduct when accessing information or using the company's computer systems. Users are responsible for all actions performed using their personal identifiers or credentials.

• Comply with the Information Security Policy and complementary rules, procedures and instructions.
• Protect and safeguard the company's information, preventing its disclosure, external release, modification, accidental or unauthorised deletion or destruction, or misuse, regardless of the medium or means by which it was accessed or known.
• Know and apply the Information Security Policy, the Rules for the Use of Information Systems and all other applicable policies, rules, procedures and security measures.
   

• Demonstrate leadership and commitment to the information security management system.
• Ensure that the information security policy and objectives are established and are consistent with the strategic direction of the organisation.
• Approve and communicate the Information Security Policy, the Information Systems Usage Rules and the importance of compliance to all users, internal and external, customers and suppliers.
• Meet at least once a year, and whenever any extraordinary event or request demands it, with the Security and Systems Managers, to be informed about the ISMS and to update the Information Security strategy. 
• Foster a corporate information security culture.
• Support the continuous improvement of information security processes.
• Ensure that the necessary resources are available for compliance with the information security policy, the rules for use of the systems and for the operation of the information security management system.

• Define the approach to the analysis and management of information security risks and the criteria for taking risks and ensure that risks are assessed at least annually.
• Ensure that internal information security audits are conducted and their results reviewed to identify opportunities for improvement.
• Define and control the information security budget.
• Approve training plans and Information Security related improvements and projects.
• Approve documentation up to the second level of standards and procedures.
• Determine the measures, disciplinary or otherwise, that may be applied to those responsible for security breaches.

• Promote the security of the information handled and the electronic services provided by the information systems, with the responsibility and authority to ensure that the Information Security Management System complies with the requirements of the UNE-ISO/IEC 27001 Standard.
• Supervise compliance with this Policy, its rules, derived procedures and the security configuration of the systems.
• Promote security awareness and training activities in the area of responsibility.
• Coordinate and monitor the implementation of projects to adapt to the ISO 27001 standard, in collaboration with the Head of Systems.
• Carry out, in collaboration with the System Manager, the mandatory risk analyses, select the safeguards to be implemented and review the risk management process. Likewise, together with the System Manager, accept the residual risks calculated in the risk analysis.
• Promote periodic audits to verify compliance with information security obligations and analyse the audit reports, drawing up the conclusions to be presented to the System Manager so that he/she can adopt the appropriate corrective measures.
• Sign the Statement of Applicability, which comprises the list of security measures selected for a system.
• Verify that the security measures are adequate for the protection of information and services.
• Responsible for the direct or delegated execution of management decisions, meet with management and the System Manager at least annually to ensure strategy.
• Report Serious Incidents as appropriate, together with Management and the System Manager.
   

With regard to documentation, and with the support of the System Manager, the functions of the Security Officer are, with the exceptions set out in the documents themselves:

• Propose second-level security documentation (ICT Security Standards (ICT Security Standards - ICTS) and General Procedures of the Information Security Management System (ISMS)) to the Management and the System Manager for approval, and sign said documentation.
• Approve the third level security documentation (STIC Operating Procedures and STIC Technical Instructions).
• Maintain the documentation organised and updated, managing the mechanisms for accessing it.

In order to carry out any of its functions, the Security Manager may request the collaboration of the System Manager.
 

• Inform and advise the data controller and its employees of their obligations in relation to the LOPDGDD and other data protection provisions.
• Monitoring compliance with the provisions of this Regulation, other Union or Member State data protection provisions and the controller's or processor's policies on the protection of personal data, including the allocation of responsibilities, awareness-raising and training of staff involved in processing operations, and related audits;
• Provide advice on request on the data protection impact assessment and monitor its implementation in accordance with Article 35;
• Cooperate with the supervisory authority (Spanish Data Protection Agency);
• Act as a contact point for the supervisory authority on issues relating to processing, including prior consultation as referred to in Article 36, and consult, as appropriate, on any other matter.

• To develop, operate and maintain the information system throughout its life cycle, its specifications, installation and verification of its correct functioning.
• Defining the topology and management system of the Information System, establishing the criteria for its use and the services available in it.
• Ensure that specific security measures are properly integrated into the overall security framework.
• Conduct exercises and tests on existing security operating procedures and continuity plans.
• Monitoring the systems lifecycle: specification, architecture, development, operation, changes.
• Implementing the necessary measures to guarantee the security of the system throughout its life cycle, in agreement with the Security Manager.
• Approve any substantial modification to the configuration of any element of the system.

The System Security Administrator.
The functions to be performed are the following:

• The implementation, management, and maintenance of the security measures applicable to the information system.
• The management, configuration, and updating, where appropriate, of the hardware and software on which the security mechanisms and services of the information systems are based.
• The management of the authorizations granted to system users in particular, the privileges granted, including monitoring that the activity carried out in the system conforms to what is authorized.
• The application of security operating procedures.
• Apply configuration changes to the information system.
• Ensure that the established security controls are strictly complied with, as well as ensure that the approved procedures for managing the information system are applied.
• Supervise the installation of hardware and software, their modifications and improvements to ensure that security is not compromised and that at all times they comply with the relevant authorizations.
• Monitor the security status of the system provided by the security event management tools and technical audit mechanisms implemented in the system.
• Inform the respective responsible parties of any anomalies, compromises or vulnerabilities related to security.
• Collaborate in the investigation and resolution of security incidents, from their detection to their resolution.

5. 8 SECURITY RISK ASSESSMENT

Knowing the risks and developing a strategy to manage them adequately is essential for the company, since only by knowing the security status can the appropriate decisions be made to mitigate the risks faced.

For this purpose, a detailed analysis of the risks affecting the assets included in an asset inventory will be carried out, which will be documented in a Risk Analysis document. The entity must determine the risk levels from which it will take treatment actions on them. A Risk is considered acceptable when implementing more security controls is estimated to consume more resources than the possible associated impact.

Once the risk assessment process has been carried out, the company's management will be responsible for approving the residual risks and the risk treatment plans.

5. 9 PROJECTS

All projects related to or affecting information systems must include, in their analysis process, an evaluation of security requirements and define a security model agreed upon with the information security officer. In the design, development, installation, and management of information systems and in projects, security concepts will be considered and applied from the design, secure coding, and security controls and measures that are appropriate according to the approved applicability document.

5. 10 PROCUREMENT AND ACQUISITIONS

All procurements and acquisitions that involve or require access to or processing of information classified as non-public must be covered by a contract that includes clauses designed to guarantee the safeguarding of the confidentiality, integrity, and availability of information.

In those cases where the contracted services involve access or processing by the supplier of personal data, the contract must include the clauses required to comply with the new General Data Protection Regulation (GDPR) and its developments.

Companies and individuals who, by reason of service contracts or acquisitions of any kind, access confidential or internal information, must be aware of the Information Security Policy and the complementary rules and procedures that apply to the purpose of the contract.

External companies and individuals who access the company's information must consider such information, by default, as confidential. The only information that they may consider as non-confidential is that which has been obtained through public media.

5. 11 AWARENESS AND TRAINING

This Information Security Policy must be known to all internal and external users and to companies that access, manage, or process the company's data. The set of Policies, standards, and procedures complementary to this Information Security Policy must also be adequately communicated and made known to the persons, companies, and institutions affected or involved in each case. Communication, awareness, and training programs will be defined periodically, and a copy of the corresponding (Policy of Use of Assets) regulations will be provided to users.

5. 12 SECURITY INCIDENTS AND RESPONSE

Any compromise of the confidentiality, integrity, or availability of the company's information is considered a security incident. This includes, but is not limited to, unauthorized access, deletion, destruction, modification, or interruption of availability. Mere attempts to compromise the aforementioned conditions, to avoid, alter, or modify security measures, or violations or non-compliance with the Information Security Policy or complementary rules and procedures are also considered security incidents.

Users are responsible for immediately reporting any security incident through the channels and procedures defined in the organization for incident communication.

5. 13 REVIEW AND AUDITS

The security officer will review this policy annually or when significant changes warrant it, and will resubmit it for approval by management.

Reviews will verify the effectiveness of the policy, assessing the effects of technological and business changes.

Management will be responsible for approving the necessary modifications to the text when a change occurs that affects the risk situations established in this document.

The security management system will be audited annually, according to an audit plan developed by the security officer.

Review date: December 20, 2024