Skip to content
Legal

Information Security Policy

1. Information Security Policy

Information security is a set of preventive and reactive measures whose purpose is to protect information against unauthorised access, use, disclosure, disruption or destruction.

In response to a new technological environment, in which the convergence of computing and communications is enabling a new productivity paradigm for companies, ORIZON is strongly committed to maintaining a competitive service by offering a responsible business model based on the constant pursuit of economic, social and environmental balance, in which good Information Security practices are essential to achieve the objectives of confidentiality, integrity, availability, legality and privacy of all the information it manages.

Accordingly, ORIZON sets out the following principles to be applied within the framework of the Information Security Management System (ISMS):

  • Confidentiality: The information processed by ORIZON will be known only to authorised persons, after identification, at the appropriate time and through the means provided.

  • Integrity: The information processed by ORIZON will be complete, accurate and valid, its content being that provided by the data subjects without any manipulation.

  • Availability: The information processed by ORIZON will be accessible to and usable by authorised and identified users at all times, and its persistence will be guaranteed in the event of any foreseen contingency.

  • Legality: ORIZON will ensure compliance with all legislation and contractual requirements that apply to it, and in particular with the regulations in force on the processing of personal data.

  • Privacy: ORIZON carries out processing that involves personal data subject to Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, and Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights. All of ORIZON's information systems will comply with the security required by the nature and purpose of the personal data recorded in the aforementioned Record of Processing Activities.

To perform its business functions properly, ORIZON relies on the processing of different types of data and information, supported by systems, programs, communications infrastructure, files, databases, archives, etc. These are among ORIZON's main assets, so that damage to or loss of them affects the delivery of its services and may endanger the continuity of the organisation. To prevent this, an Information Security Policy has been designed whose main aims are to:

  • Protect assets, through controls and measures, against threats that could lead to security incidents.

  • Mitigate the effects of security incidents.

  • Establish a system for classifying information and data in order to protect critical information assets.

  • Define responsibilities for information security, creating the corresponding organisational structure.

  • Draw up a set of rules, standards and procedures applicable to management bodies, employees, partners, external service providers, etc.

  • Specify the consequences of breaching the Security Policy in the workplace.

  • Assess the risks affecting assets in order to adopt the appropriate security measures and controls.

  • Verify that the security measures and controls work through internal security audits carried out by independent auditors.

  • Train users in security management and in information and communication technologies.

  • Manage internal networks: control the flow of information and data through communications infrastructure or by sending optical, magnetic, paper or other data media.

  • Observe and comply with legislation on data protection, intellectual property, employment, information society services, criminal law, etc., that affects ORIZON's assets.

  • Protect the organisation's intellectual capital so that it is not disclosed or used unlawfully.

  • Reduce the chances of unavailability through the proper use of the organisation's assets.

  • Defend assets against internal or external attacks so that they do not turn into security incidents.

  • Monitor how the security measures work by establishing the number, nature and effects of incidents.

  • Manage any security incidents that may arise and affect information security and privacy. Should one occur, the competent authorities will be notified without delay. Likewise, create and keep up to date a knowledge base to consult for future incidents.

  • Ensure business continuity by establishing backup mechanisms for both information and telecommunications.

  • Use secure development practices for applications developed in-house and verify that contracted software services meet the security requirements needed to protect ORIZON's information.

ORIZON's Management takes responsibility for supporting and promoting the organisational, technical and control measures needed to comply with this Information Security Policy, as well as for providing the resources needed to resolve, as quickly and effectively as possible, any information security non-conformities and incidents that may arise, and for putting in place the measures needed to prevent them from happening again.

This Policy will be maintained, updated and kept suited to the organisation's purposes, in line with the organisation's risk management context. To this end, it will be reviewed at planned intervals or whenever significant changes occur, to ensure that it remains suitable, adequate and effective.

Likewise, a formally defined risk assessment procedure is in place to manage the risks ORIZON faces.

In turn, all the policies and procedures included in the ISMS will be reviewed, approved and promoted by ORIZON's Management.

2. Entry into force

This Information Security Policy is effective from the day after its approval by ORIZON's Management until it is replaced by a new Policy.