Information Security Policy

COM3 will protect information at every stage of its lifecycle —creation/receipt, use and processing, communication and transport, storage and authorised dissemination, and erasure or destruction— ensuring its confidentiality, integrity, availability, authenticity and traceability. This protection will apply to physical and logical media, both owned and third-party (including cloud), through organisational, technical and physical controls proportionate to its classification (e.g. access control, encryption, logging and monitoring, and certified destruction where applicable).

The following minimum principles are therefore established:

Security is conceived as a comprehensive and continuous process encompassing the human, material, technical, legal and organisational elements of the information system. All information processing will be governed by this principle, avoiding isolated or ad hoc actions.

Management and the responsible officers (RSI, RS, RI, RSE) will ensure effective coordination, the definition of responsibilities and the provision of necessary resources. Awareness and training will be promoted among everyone involved, so that a lack of knowledge, organisation, coordination or instructions does not become a source of risk.

Security will be implemented using a continuous improvement approach (PDCA), with documented and measurable preventive, detective and corrective controls.

Risk analysis and management is an essential, continuous and up-to-date process that underpins security. Its purpose is to maintain a controlled environment, reducing risks to acceptable levels defined by Management (risk appetite).

Risk reduction will be achieved through the proportionate and balanced application of security measures (organisational, operational and technical) appropriate to the classification of information, the services provided and exposure to threats.

Identified risks will be recorded and addressed in accordance with a risk analysis methodology, applying mitigation, transfer, avoidance or acceptance treatments, with defined responsible persons, deadlines and evidence.

System security will be implemented as a continuous cycle of prevention, detection and response, in order to minimise vulnerabilities, deter threats and reduce the exposure surface, and ensure that threats do not materialise or, if they do, limit their impact on information and services.

Preventive measures will eliminate or reduce the likelihood of threats materialising (hardening, patches, access control, segmentation, encryption, least privilege and Zero Trust principles).

Detection measures will enable cyber incidents to be discovered and assessed in a timely manner (event logging and correlation, defined alerts and thresholds).

Response measures will restore affected information and services in accordance with the maximum time allowed to restore the service and the maximum age of data whose loss is acceptable, including containment, eradication, recovery and lessons learned.

Without undermining the principles of the ENS, the system will ensure the preservation and authenticity of electronic data and the availability of services throughout the information lifecycle.

The system will have a multi-layer protection strategy. If one layer is compromised, the remaining layers will enable an appropriate response and containment of the incident, reducing the likelihood of total compromise and minimising the impact on information and services.

These lines of defence will include coordinated organisational, physical and logical/technological measures.

Continuous system monitoring will enable anomalous activities or behaviour to be detected and responded to in time to contain them.

Ongoing assessment of asset security will measure its evolution, identifying vulnerabilities and configuration deviations.

Security measures will be reviewed and updated periodically, adjusting their effectiveness to changes in risks, threats and protection technologies, and reconsidering the security approach when necessary.

A clear segregation of responsibilities will be maintained within the information system:

Information Owner (RI): Defines the classification and security requirements of the information processed.

Service Owner (RSE): Establishes the security requirements of the service and ensures that they are met during operation.

System Owner (RS): Is responsible for the implementation and technical operation supporting the services (infrastructure, applications, networks).

Information Security Officer (RSI): Provides guidance and makes security decisions to meet the defined requirements, and coordinates risk management and incident response.

Where personal data are processed, the roles of Data Controller and, where applicable, Data Processor will also be identified, in accordance with RGPD/LOPDGDD, ensuring consistency between these functions and the responsibilities above.

COM3 is subject to the following regulations in the provision of services to its customers:

Royal Decree 311/2022 of 3 May, regulating the National Security Framework.

Resolution of 7 October 2016 of the State Secretariat for Public Administrations, approving the Technical Security Instruction on the Security Status Report.

Resolution of 13 October 2016 of the State Secretariat for Public Administrations, approving the Technical Security Instruction on compliance with the National Security Framework.

Resolution of 27 March 2018 of the State Secretariat for Public Service, approving the Technical Security Instruction on Auditing the Security of Information Systems.

Resolution of 13 April 2018 of the State Secretariat for Public Service, approving the Technical Security Instruction on Security Incident Notification.

Organic Law 3/2018 of 5 December on Personal Data Protection and the guarantee of digital rights.

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

CCN-STIC Security Guides.

Occupational Risk Prevention Law 31/1995 of 8 November and Royal Decree 39/1997.

Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).

Royal Decree-Law 13/2012 of 30 March, the cookie law.

Royal Legislative Decree 1/1996 of 12 April, approving the consolidated text of the Intellectual Property Law.

The various designated roles, together with their respective functions and responsibilities, are:

Design, implement and maintain the SGSI in accordance with the ENS.

Maintain risk analysis and treatment, and the training/awareness plan.

Establish rules/procedures (access, changes, incidents, backups, logs, continuity).

Coordinate security incidents.

Measure and report indicators.

Act as the functional owner of the service.

Define, incorporate and maintain security requirements in contracts with suppliers.

Align operations with business needs and with the ENS.

Act as the technical owner of the platform/system: architecture, hardening, patches, backups, logs.

Manage configuration and inventory, vulnerabilities, monitoring and capacity.

Carry out day-to-day operations.

Establish access criteria and authorise access to their data.

Define information retention and destruction.

Participate in impact assessments and incident management.

All COM3 employees are required to know and comply with this Information Security Policy. Everyone will attend an ICT security awareness session at least once a year.

COM3 has a document management system through which documents are drafted, reviewed and approved.

All systems subject to this Policy will be included in a risk analysis assessing threats, vulnerabilities and impacts. This analysis will be repeated:

Periodically, at least annually.

When the information processed changes.

When the services provided or their criticality change.

Following a serious security incident.

In the event of serious vulnerabilities or significant new threats.

Principles and requirements aligned with the ENS are established and apply to all services, assets and people involved, including: organisation, risk analysis, personnel management, access control, facility protection, system integrity and updating, information protection, activity logging, incident management, business continuity and continuous improvement.

COM3 processes personal data and will ensure their protection in accordance with RGPD/LOPDGDD and the ENS.

When services are provided to or information is processed for other organisations, those parties will be familiar with and accept this Security Policy and the applicable associated regulations.

COM3 will be prepared to prevent, detect, respond to and recover from security incidents, with defined responsibilities and coordination by the Security Committee.

The Information Security Committee will draw up the Information Security Policy (PSI) in accordance with art. 12 of the ENS and control ORG.1 of Annex II. It will review it at least annually.

The PSI will be approved by Management (the CEO of COM3) and communicated to all affected parties.