1. Approval and Entry into Force

This Information Security Policy is effective from the date of signature and until it is replaced by a new Policy.

2. Mission of the Organization

Qualiteasy Internet Solutions, S.L. is a technology company that develops SaaS software for managing compliance systems (ISO 9001, 14001, and 45001), distributes Faronics endpoint protection solutions in Spain, and commercializes cybersecurity services integrated into its proprietary platform GuardianHubX, applying technical and organizational measures to guarantee the confidentiality, integrity, and availability of information.

These systems must be managed diligently, taking appropriate measures to protect them against accidental or deliberate damage that could affect the availability, integrity, or confidentiality of the processed information or provided services.

The goal of information security is to guarantee the quality of information and the continuous provision of services, acting preventively, monitoring daily activity, and reacting promptly to incidents.

ICT systems must be protected against rapidly evolving threats with the potential to affect the confidentiality, integrity, availability, intended use, and value of information and services. Defending against these threats requires a strategy that adapts to changing environmental conditions to ensure the continuous provision of services. This implies that departments must apply the minimum security measures required by the Spanish National Security Framework (Esquema Nacional de Seguridad - ENS), continuously monitor service delivery levels, track and analyze reported vulnerabilities, and prepare an effective response to incidents to guarantee service continuity.

Different departments must ensure that ICT security is an integral part of each stage of the system lifecycle, from conception to decommissioning, including development or acquisition decisions and operational activities. Security requirements and funding needs must be identified and included in planning, requests for proposals, and tender documents for ICT projects. Departments must be prepared to prevent, detect, respond to, and recover from incidents, in accordance with Article 8 of the ENS (Prevention, detection, response, and conservation).

3. Scope

This policy applies to all ICT systems of the entity and to all members of the organization involved in Services and Projects intended for the public sector requiring the application of the ENS, without exception.

4. Objectives

In light of the above, Management establishes the following information security objectives:

• Provide a framework to increase resilience and provide an effective response.
• Ensure quick and efficient service recovery in the event of any physical disaster or contingency that could jeopardize operational continuity.
• Prevent information security incidents as far as technically and economically feasible, as well as mitigate information security risks generated by our activities.
• Guarantee the confidentiality, integrity, availability, authenticity, and traceability of information.

5. Regulatory Framework

One of the main objectives is to comply with applicable legal requirements and any other commitments subscribed to with clients, maintaining their continuous update. The legal and regulatory framework governing our activities comprises:

• REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
• Organic Law 3/2018, of December 5, on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
• Royal Legislative Decree 1/1996, of April 12, approving the Consolidated Text of the Intellectual Property Law.
• Law 2/2019, of March 1, amending the consolidated text of the Intellectual Property Law.
• Royal Decree 311/2022, of May 3, regulating the National Security Framework (ENS).
• Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSI).
• Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations.
• Law 40/2015, of October 1, on the Legal Regime of the Public Sector.

6. Implementation and Development

To achieve these objectives, it is necessary to:

• Continuously improve our information security management system.
• Identify potential threats and the operational impact that such threats could cause if materialized.
• Preserve the interests of key stakeholders (customers, shareholders, employees, and suppliers), reputation, brand, and value-creation activities.
• Work jointly with suppliers and subcontractors to improve IT service delivery, service continuity, and information security, resulting in greater operational efficiency.
• Evaluate and guarantee the technical competence of personnel, ensuring adequate motivation for their participation in continuous process improvement through appropriate training and internal communication.
• Guarantee the proper condition of facilities and appropriate equipment matching the company’s activity and goals.
• Ensure continuous analysis of all relevant processes, establishing pertinent improvements based on obtained results and established objectives.
• Structure our management system so that it is easy to understand.

Management of our system is entrusted to the IT Systems Manager. The system will be available in our information repository, accessible according to access profiles granted under our active access management procedure.

Security documentation is organized in folders within the company file server, divided into subfolders named after standard requirement points and operational frameworks. These contain various procedures, records, and evidence, with restricted access for company personnel only.

Security documentation is structured into:

• Security Policy.
• Security Regulations: documents describing the use of equipment, services, and facilities, defining misuse, staff responsibility regarding compliance or violation, rights, duties, and disciplinary measures under current legislation.
• Specific Documents: security documentation developed according to applicable CCN-STIC guidelines.
• Security Procedures: documents detailing how to operate system elements.

This policy is complemented by all other active policies, procedures, and documents that develop our management system.

7. Security Organization

Essential responsibility lies with General Management, as it is responsible for organizing roles and responsibilities and providing adequate resources to achieve ENS objectives. Executives are also responsible for setting a good example by following established security rules.

These principles are assumed by Management, which provides necessary resources and tools for compliance, publishing them through this Integrated Management System Policy.

Defined security roles and responsibilities:

This definition of duties and responsibilities is further detailed in job profiles and system records (Register of Managers, Roles, and Responsibilities).

Conflict Resolution

Disagreements that could lead to conflicts will be addressed within the Security Committee, and Executive Management criteria will prevail in all cases.

8. Security Committee

The procedure for appointment and renewal is ratification within the Security Committee. The committee for security management and coordination is the highest decision-making body within the information security management system. The members of the Information Security Committee are:

• CHIEF INFORMATION SECURITY OFFICER
• SYSTEM MANAGER
• SERVICE MANAGER
• INFORMATION MANAGER

These members are appointed, renewed, or dismissed solely by the committee itself.

The Security Committee is an autonomous, executive body with decision-making independence that does not subordinate its activity to any other internal body.

Security organization is further detailed in the complementary document Security Organization Policy. This policy is complemented by other active policies and procedures.

9. Risk Management

All systems subject to this Policy must undergo risk analysis, evaluating exposed threats and risks. This analysis is reviewed regularly:

• At least once a year.
• Whenever handled information changes.
• Whenever provided services change.
• When a major security incident occurs.
• When critical vulnerabilities are reported.

To harmonize risk analyses, the ICT Security Committee will establish baseline ratings for handled information types and provided services. The Committee will drive resource availability to address system security needs, promoting horizontal investments.

Risk analysis will follow the methodology defined in the Risk Analysis procedure.

10. Personnel Management

All members of QUALITEASY INTERNET SOLUTIONS SL are obligated to know and comply with this Information Security Policy and Security Regulations. The ICT Security Committee is responsible for ensuring information reaches affected personnel.

All members of QUALITEASY INTERNET SOLUTIONS SL must attend an ICT security awareness session at least once a year. A continuous awareness program will be established, particularly for new hires.

Personnel responsible for operating or administering ICT systems will receive specific training for safe system handling prior to assuming responsibilities, whether for new assignments or role changes.

11. Human Resources Professionalism and Security

This Policy applies to all QUALITEASY INTERNET SOLUTIONS SL personnel and external staff performing tasks within the company.

HR will include information security functions in job descriptions, inform new hires of their compliance obligations, manage Confidentiality Agreements, and coordinate user training.

• The Chief Information Security Officer (CISO) is responsible for monitoring, documenting, and analyzing reported security incidents, communicating them to the Security Committee and information owners.
• The Security Committee is responsible for implementing channels for incident reporting, supervising investigations, tracking information evolution, and promoting resolution.
• The CISO will participate in drafting Confidentiality Agreements signed by employees and third parties, advising on sanctions for policy breaches, and handling security incidents.
• All personnel are responsible for promptly reporting detected security weaknesses and incidents.

Human Resources Professionalism:

• Determine necessary staff competence affecting Information Security.
• Ensure personnel are competent based on appropriate education, training, or experience.
• Retain documented evidence proving staff competence in Information Security.

Personal Security Control Objectives:

• Reduce risks of human error, irregularities, misuse of facilities/resources, and unauthorized information handling.
• Clarify security responsibilities during recruitment, including them in signed agreements.
• Ensure users are aware of security threats and trained to support the Information Security Policy.
• Establish confidentiality commitments with all staff and external users.
• Implement tools and mechanisms to communicate security weaknesses and incidents to minimize impact and prevent recurrence.

12. Authorization and Access Control to Information Systems

Control of access to information systems aims to:

• Prevent unauthorized access to information systems, databases, and information services.
• Implement access security through authentication and authorization techniques.
• Control connection security between QUALITEASY INTERNET SOLUTIONS SL network and public or private networks.
• Review critical events and user activities on systems.
• Raise awareness regarding password and equipment responsibility.
• Guarantee information security when using laptops and personal computers for remote work.

13. Facility Protection

Objectives regarding facility protection:

• Prevent unauthorized access, damage, or interference to headquarters, facilities, and information.
• Protect critical processing equipment in protected areas with defined perimeters, access controls, and environmental safeguards, including protection during transfer outside protected areas.
• Control environmental factors that could harm computing equipment.
• Implement measures to protect information handled by office personnel during routine work.
• Provide protection proportional to identified risks.

This Policy applies to all physical resources: facilities, equipment, cabling, files, storage media, etc.

The CISO and Information Owners define physical and environmental security measures based on risk analysis and supervise compliance.

Department managers define physical access levels to restricted areas. Information Owners formally authorize off-site work involving business information.

All personnel must comply with the clear screen and clear desk policy for daily office work protection.

14. Product Acquisition

Departments must ensure ICT security is an integral part of every system lifecycle stage (conception, development/acquisition, operation, and decommissioning). Security requirements and funding must be included in planning and tender specifications.

Information security must be considered during system acquisition and maintenance, limiting and managing changes.

Development and acquisition policy is detailed in the document: System Acquisition, Development, and Maintenance Policy.

15. Security by Default

QUALITEASY INTERNET SOLUTIONS SL considers it strategic for processes to integrate security by default throughout their lifecycle, from creation to decommissioning, establishing security as a comprehensive, transversal process.

16. System Integrity and Updates

QUALITEASY INTERNET SOLUTIONS SL commits to ensuring system integrity through a change management process controlling physical or logical updates via prior authorization. Systems management evaluates security impacts before implementing changes and documents major modifications.

Periodic security reviews evaluate system status against manufacturer specifications, vulnerabilities, and patches, acting promptly to manage risks.

17. Protection of Stored and In-Transit Information

QUALITEASY INTERNET SOLUTIONS SL establishes measures to protect stored or in-transit information across insecure environments (laptops, mobile devices, peripheral equipment, open networks, or weak encryption).

18. Prevention of Interconnected Information Systems

QUALITEASY INTERNET SOLUTIONS SL establishes protection measures for the perimeter, particularly when connecting to public networks or electronic communication services available to the public.

Risks arising from system interconnection via networks will be analyzed, and connection points controlled.

19. Business Continuity

QUALITEASY INTERNET SOLUTIONS SL establishes measures ensuring system backups and operational continuity mechanisms in the event of losing standard working tools.

20. Continuous Improvement of the Security Process

QUALITEASY INTERNET SOLUTIONS SL establishes a continuous improvement process for information security applying international standards such as ISO 27001.

Signed: Executive Management