Introduction

NEREALOR, hereinafter ALOR, depends on ICT systems to achieve its business objectives. These systems must be managed diligently, taking appropriate measures to protect them against accidental or deliberate damage that could affect the availability, integrity or confidentiality of the information processed or the services provided.

The objective of information security is to ensure the quality of information and the continuous provision of services by acting preventively, monitoring day-to-day activity and responding promptly to incidents.

ICT systems must be protected against rapidly evolving threats with the potential to affect the confidentiality, integrity, availability, intended use and value of information and services. Defending against these threats requires a strategy that adapts to changes in environmental conditions in order to ensure the continuous provision of services. This means that departments must apply the minimum security measures required by the National Security Framework (ENS) and the measures required to comply with ISO 27001, as well as continuously monitor service delivery levels, track and analyse reported vulnerabilities, and prepare an effective incident response to ensure the continuity of the services provided.

The various departments must ensure that ICT security is an integral part of every stage of the system life cycle, from conception to decommissioning, including development or procurement decisions and operational activities. Security requirements and funding needs must be identified and included in planning, requests for proposals and tender specifications for ICT projects.

Departments must be prepared to prevent, detect, respond to and recover from incidents, in accordance with Article 7 of the ENS.

Prevention

Departments must avoid, or at least prevent as far as possible, information or services from being adversely affected by security incidents. To this end, departments must implement the minimum security measures established by the ENS, as well as any additional controls identified through threat and risk assessment. These controls, together with the security roles and responsibilities of all personnel, must be clearly defined and documented.

To ensure compliance with the policy, departments must:

• Authorise systems before they enter into operation.

• Regularly assess security, including assessments of routine configuration changes.

Detection

Since services may degrade rapidly as a result of incidents, ranging from a simple slowdown to complete service interruption, services must continuously monitor operations in order to detect anomalies in service delivery levels and act accordingly, as established in Article 9 of the ENS.

Monitoring is particularly relevant when lines of defence are established in accordance with Article 8 of the ENS. Detection, analysis and reporting mechanisms shall be established to ensure that the responsible parties are informed regularly and whenever there is a significant deviation from the parameters previously established as normal.

Response

Departments must:

• Establish mechanisms to respond effectively to security incidents.

• Designate a point of contact for communications relating to incidents detected in other departments or other organisations.

• Establish protocols for the exchange of incident-related information. This includes two-way communications with Computer Emergency Response Teams (CERTs).

Scope

This policy applies to all ALOR ICT systems, as well as to all ALOR members, without exception.

Mission

In response to a new technological environment in which the convergence of information technology and communications is facilitating a new productivity paradigm for companies, ALOR is strongly committed to continuing to promote research, technological development and innovation projects within a quality-focused environment, where the development of good Information Security practices is essential to achieving the confidentiality, integrity, availability and legal compliance objectives applicable to all information managed. Accordingly, ALOR defines the following principles to be applied within the framework of the Information Security Management System (ISMS):

ALOR Management understands its duty to guarantee information security as an essential element for the proper delivery of ALOR services and therefore supports the following objectives and principles:

• Embed the value of Information Security throughout ALOR.

• Ensure that each and every person at ALOR contributes to protecting Information Security.

• Preserve the confidentiality, integrity, availability and resilience of information in order to ensure compliance with legal, regulatory and customer requirements relating to information security, and specifically with regard to personal data:

  • Data shall be processed lawfully, fairly and transparently in relation to the data subject (lawfulness, fairness and transparency).

  • Data shall be collected for specified, explicit and legitimate purposes and shall not be further processed in a manner incompatible with those purposes (purpose limitation).

  • Data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimisation).

  • Data shall be accurate and, where necessary, kept up to date; every reasonable step shall be taken to ensure that personal data that are inaccurate with regard to the purposes for which they are processed are erased or rectified without delay (accuracy).

  • Data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as they are processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (storage limitation).

  • Data shall be processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (integrity and confidentiality).

• Protect ALOR’s information assets against threats, whether internal or external, deliberate or accidental, in order to ensure continuity of the service provided to customers and the security of information.

• Establish an information security plan that integrates activities for the prevention and minimisation of security incident risks, based on the risk management criteria established by ALOR.

• Provide the necessary means to carry out the appropriate actions for managing identified risks.

• Assume responsibility for awareness and training in information security as a means of ensuring compliance with this policy.

• Extend our commitment to information security to our employees and suppliers.

• Continuously improve security by establishing and periodically monitoring information security objectives.

This Policy shall be maintained, updated and kept appropriate to ALOR’s purposes, in alignment with ALOR’s risk management context. To this end, it shall be reviewed at planned intervals or whenever significant changes occur, in order to ensure its continuing suitability, adequacy and effectiveness.

Likewise, in order to manage the risks faced by ALOR, a formally defined risk assessment procedure is established. All policies and procedures included in the ISMS shall be reviewed, approved and promoted by ALOR Management.

Regulatory framework

ALOR Management ensures that externally sourced documentation relevant to the operation of the company is known to those employees who require it and is kept up to date and available at all times.

For this purpose, the means defined in this document and the procedures that develop it shall be used.

Reference documents

• National Security Framework (ENS) [DA1]

• CCN-STIC-801 Guide [DR1]

• CCN Guides, Abstracts, CoCENS and regulations applicable to ALOR [DR2]

Security organisation

A Security Committee has been established, consisting of:

• General Management

• Security Manager

• Systems Manager

• Data Protection Officer

• Information Manager

• Service Manager

This Security Committee has the following functions and responsibilities:

• Address concerns raised by Management and Systems.

• Obtain an overview of the current state of information security.

• Promote continuous improvement of the ISMS.

• Develop the evolution strategy.

• Review the Policy, regulations and procedures at least annually.

• Approve training requirements.

• Prioritise actions.

• Promote the performance of ISMS and technical audits.

• Verify that Information Security is considered in all projects.

Roles: functions and responsibilities

Executive Management

Participates in the definition of objectives and measurements. Approves policies. Approves ISMS management reviews. Validates the conclusions of systems audits.

Executive Management establishes ALOR’s organisational chart, which contains more functions and roles than those specified here. This policy details the roles responsible for information security.

Security Manager

• Promote the security of the information handled and the electronic services provided by information systems, with the responsibility and authority to ensure that the Information Security Management System complies with the requirements of the National Security Framework.

• Supervise compliance with this Policy, its rules, derived procedures and the security configuration of systems.

• Establish adequate and effective security measures to meet the security requirements defined by the Service and Information Managers, at all times in accordance with Annex II of the ENS, and declare the applicability of those measures.

• Promote awareness and training activities in information security within their area of responsibility.

• Coordinate and monitor the implementation of ENS compliance projects, in collaboration with the Systems Manager.

• Carry out, in collaboration with the Systems Manager, the required risk analyses, select the safeguards to be implemented and review the risk management process. Likewise, together with the Systems Manager, accept the residual risks calculated in the risk analysis.

• Promote periodic audits to verify compliance with information security obligations and analyse audit reports, preparing the conclusions to be submitted to the Systems Manager so that the appropriate corrective measures can be adopted.

• Coordinate the Security Management process, in collaboration with the Systems Manager.

• Determine the system category according to the procedure described in Annex I of the ENS and the security measures to be applied in accordance with Annex II of the ENS.

• Verify that the security measures are appropriate for the protection of information and services.

Systems Manager

• Develop, operate and maintain the Information System throughout its life cycle, including its specifications, installation and verification of its correct operation.

• Ensure that specific security measures are properly integrated within the overall security framework.

• Carry out exercises and tests on operational security procedures and existing continuity plans.

• Implement the measures necessary to guarantee system security throughout its life cycle, in agreement with the Security Manager.

• Carry out, in collaboration with the Security Manager, the required risk analyses, select the safeguards to be implemented and review the risk management process. Likewise, together with the Security Manager, accept the residual risks calculated in the risk analysis.

• Prepare, in collaboration with the Security Manager, third-level security documentation (STIC Operational Procedures and STIC Technical Instructions).

• Apply operational security procedures.

• Ensure that established security controls are strictly complied with, as well as ensuring that approved procedures for handling the information system are applied.

• Supervise hardware and software installations, modifications and improvements to ensure that security is not compromised and that they remain aligned at all times with the relevant authorisations.

• Monitor the system’s security status as provided by security event management tools and technical audit mechanisms implemented in the system.

• Inform the respective responsible parties of any anomaly, compromise or vulnerability related to security.

• Collaborate in the investigation and resolution of security incidents, from detection through to resolution.

Data Protection Officer

• Inform and advise the Information Manager and their employees of their obligations under the GDPR and other data protection provisions.

• Monitor compliance with the GDPR, other Union or Member State data protection provisions and the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and related audits.

• Provide advice, where requested, regarding the data protection impact assessment and monitor its implementation in accordance with Article 35.

• Cooperate with the supervisory authority.

• Act as the contact point for the supervisory authority on issues relating to processing, including prior consultation referred to in Article 36, and consult, where appropriate, on any other matter.

Service Manager

• Establish service security requirements, including interoperability, accessibility and availability requirements.

• Determine service security levels in coordination with the Security Manager and the Systems Manager.

• Maintain the security of the information handled and the services provided by information systems within their area of responsibility.

Information Manager

• Ensure the proper use of information and, therefore, its protection.

• Establish information security requirements.

• Determine the security levels of the information processed, assessing the consequences of a negative impact.

Users and employees

• Comply with the Information Security Policy and the supplementary rules, procedures and instructions.

• Protect and safeguard company information, preventing unauthorised or accidental disclosure, external transmission, modification, deletion or destruction, or misuse, regardless of the medium or means through which it has been accessed or obtained.

• Know and apply the Information Security Policy, the Rules for the Use of Information Systems and all other applicable policies, rules, procedures and security measures.

Appointment procedures

ALOR Management is responsible for making appointments to assign information security roles and responsibilities, as well as for establishing the committees necessary to oversee compliance with this policy. These appointments and internal structures shall be recorded in internal documents.

Information Security Policy

The Security Committee shall be responsible for the annual review of this Information Security Policy and for proposing its revision or continued maintenance. The Policy shall be approved by the Security Committee and communicated so that all affected parties are aware of it.

Risk management

All systems subject to this Policy shall undergo a risk analysis assessing the threats and risks to which they are exposed. This analysis shall be repeated:

• Regularly, at least once a year.

• When the information handled changes.

• When the services provided change.

• When a serious security incident occurs.

• When serious vulnerabilities are reported.

For the harmonisation of risk analyses, the ICT Security Committee shall establish a reference assessment for the different types of information handled and the different services provided. The ICT Security Committee shall promote the availability of resources to meet the security needs of the different systems, encouraging horizontal investments.

Development of the Information Security Policy

This Policy shall be developed through security regulations addressing specific aspects of the day-to-day operation of ALOR IT users. The security regulations shall be available to all ALOR members who need to know them, particularly those who use, operate or administer information and communications systems.

The complete Information Security Policy shall be available on SharePoint and a summary on the ALOR website (www.alor-tech.com).

Personnel obligations

All ALOR members are required to know and comply with this Information Security Policy and the Security Regulations [DR3], and it is the responsibility of the Security Committee to provide the necessary means to ensure that the information reaches all affected parties.

All ALOR members shall attend an ICT security awareness session at least once a year. An ongoing awareness programme shall be established for all ALOR members, particularly new joiners.

Persons responsible for the use, operation or administration of systems shall receive training in the secure handling of systems to the extent required to perform their duties. Training shall be mandatory before assuming a responsibility, whether it is their first assignment or a change of position or responsibilities within the same role.

Third parties

When ALOR provides services to other organisations or handles information belonging to other organisations, those organisations shall be made aware of this Information Security Policy, channels shall be established for reporting and coordination between the respective Security Committees, and action procedures shall be established for responding to security incidents.

When ALOR uses third-party services or discloses information to third parties, those third parties shall be made aware of this Security Policy and the Security Regulations applicable to those services or information. The third party shall be subject to the obligations established in those regulations and may develop its own operational procedures in order to comply with them. Specific incident reporting and resolution procedures shall be established. It shall be ensured that third-party personnel have an adequate level of security awareness, at least equivalent to that established in this Policy.

Where any aspect of the Policy cannot be fulfilled by a third party as required in the preceding paragraphs, a report shall be required from the Security Manager specifying the risks incurred and how they will be treated. Approval of this report by the managers responsible for the affected information and services shall be required before proceeding.

Approval and entry into force

The security policy defined in this document shall take effect from the time it is signed (see cover page) and published to ALOR personnel.

This Information Security Policy is effective from that date until it is replaced by a new Policy.

Date: 21 September 2026

Later versions may exist.