Security policy

1 INTRODUCTION

1.1 JUSTIFICATION OF THE INFORMATION SECURITY POLICY

WOCU MONITORING, S.L. relies on ICT (Information and Communication Technology) systems to achieve its objectives. These systems must be managed diligently, taking appropriate measures to protect them against accidental or deliberate damage that may affect the availability, integrity, or confidentiality of the information processed or the services provided.

The objective of information security is to guarantee the quality of information and the continuous provision of services by acting preventively, monitoring daily activity, and reacting swiftly to incidents.

ICT systems must be protected against rapidly evolving threats with the potential to impact the confidentiality, integrity, availability, intended use, and value of information and services. To defend against these threats, a strategy is required that adapts to changing environmental conditions to ensure the continuous provision of services. For this reason, the National Security Framework (Royal Decree 311/2022 of January 8, hereinafter ENS), in its Article 11, establishes that “All senior bodies of Public Administrations must formally possess their security policy, which shall be approved by the head of the corresponding senior body.”

This implies that the different areas of the organization must apply the minimum security measures required by the National Security Framework, as well as continuously monitor service delivery levels, follow and analyze reported vulnerabilities, and prepare an effective response to incidents to guarantee the continuity of the services provided.

All areas must ensure that ICT security is an integral part of every stage of the system’s life cycle, from its conception to its retirement from service, including development or procurement decisions and operational activities. Security requirements and funding needs must be identified and included in planning, requests for proposals, and tender specifications for ICT projects. Departments must be prepared to prevent, detect, react to, and recover from incidents, in accordance with Article 7 of the ENS.

1.3 OBJECTIVES AND SCOPE OF THE SERVICES PROVIDED

This Security Policy applies to the various services provided in its daily activity, specifically:

• Design
• Development
• Support and maintenance

The specific scope of the ENS (National Security Framework) is as follows: Information system applied to:

“Design, development, and support and maintenance of digital infrastructure monitoring solutions in large facilities”

It assumes its commitment to information security, committing to its proper management in order to offer all its stakeholders the highest guarantees, with the following objectives:

• Guarantee the quality of information and the continuous provision of services, acting preventively, monitoring daily activity, and reacting swiftly to incidents.
• Ensure the rapid and efficient recovery of services in the face of any physical disaster or contingency that may occur and put the continuity of operations at risk.
• Prevent information security incidents to the extent that it is technically and economically viable, as well as mitigate the information security risks generated by our activities.
• Guarantee the confidentiality, integrity, availability, authenticity, and traceability of information.
• Protect information from potential threats, in a way that ensures the continuity of business lines.
• Minimize potential damages caused.
• Maximize return on investment and business opportunities.

2  REGULATORY FRAMEWORK

As a regulatory basis for the creation of this security guide, the current legislation affecting the development of activities—which explicitly implies the implementation of security measures in information systems—has been analyzed. The legal framework regarding information security is established by the following legislation:

• Royal Decree 311/2022, of May 3, which regulates the National Security Framework (ENS).
• Royal Decree 4/2010, of January 8, which regulates the National Interoperability Framework in the field of E-Government. Its purpose is to create the necessary conditions to guarantee an adequate level of technical, semantic, and organizational interoperability of the systems and applications used by Public Administrations, allowing the exercise of rights and the fulfillment of duties through electronic access to public services, while improving effectiveness and efficiency.
• Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter GDPR).
• Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights.3

3  SECURITY ORGANIZATION

As indicated in Article 12 of the ENS, security must involve all members of the organization. According to Annex II of the ENS, section 3.1, the Security Policy must identify clear roles responsible for ensuring its compliance and must be known by all members of the administrative organization. The following roles are established within the organization in relation to Information Security:

A. Information Owner

The role of the Information Owner has the following functions:

• Adopt necessary technical and organizational measures to guarantee the security of personal data processing and prevent its alteration, loss, or unauthorized processing or access, taking into account the state of technology, the nature of the stored data, and the risks to which they are exposed, whether arising from human action or the physical or natural environment.
• Hold ultimate responsibility for the use made of certain information and, therefore, for its protection.
• The Information Owner is ultimately responsible for any error or negligence leading to a confidentiality or integrity incident.
• Establish information security requirements. Within the framework of the ENS, this equates to the power to determine information security levels.
• Determine the security levels for each dimension within the framework established in Annex I of the National Security Framework (ENS).
• Although the formal approval of the levels corresponds to the Information Owner, they may request a proposal from the Security Officer and should ideally consider the opinion of the System Owner.

B.  Service Owner

The heads of the functional units have been designated as Service Owners, and they are responsible for the following functions:

• Regarding the GDPR, by delegation of the Data Controller, the Service Owner is entrusted with the development of tasks related to the management of personal data processing carried out specifically within their area.
• Establish service security requirements. Within the framework of the ENS, this equates to the power to determine information security levels.
• Hold ultimate responsibility for the use made of specific services and, therefore, for their protection.
• The Service Owner is ultimately responsible for any error or negligence leading to a service availability incident.
• Determine the security levels for each dimension of the service within the framework established in Annex I of the National Security Framework (ENS).
• Although the formal approval of the levels corresponds to the Service Owner, they may request a proposal from the Security Officer and should ideally consider the opinion of the System Owner.
• Service delivery must always meet the security requirements of the information it handles, meaning information security requirements can be inherited, while adding requirements for availability, accessibility, interoperability, etc.

C.  Information Security Officer

Aquí tienes la traducción al inglés de las funciones del Responsable de Seguridad de la Información:

The main functions entrusted to the Information Security Officer are:

• Coordinate and control the measures defined in the Record of Processing Activities and, in general, ensure compliance with the security measures detailed in the Data Protection Impact Assessment (DPIA).
• Report directly to the Information Security Committee.
• Act as Secretary of the Information Security Committee.
• Convene the Information Security Committee, gathering all relevant information.
• Maintain the security of the information handled and the services provided by the information systems within their scope of responsibility, in accordance with the Organization’s Security Policy.
• Promote training and awareness regarding information security within their scope of responsibility.
• Collect the security requirements from the Information and Service Owners and determine the System category.
• Conduct the Risk Analysis.
• Prepare a Statement of Applicability based on the required security measures according to Annex II of the ENS and the results of the Risk Analysis.
• Provide the Information and Service Owners with information regarding the expected residual risk level after implementing the treatment options selected in the risk analysis and the security measures required by the ENS.
• Coordinate the preparation of the System Security Documentation.
• Participate in the preparation of the Information Security Policy within the framework of the Information Security Committee for approval by Management.
• Participate in the preparation and approval of Information Security regulations within the framework of the Information Security Committee.
• Prepare and approve Information Security Operating Procedures.
• Periodically provide the Security Committee with a summary of security actions, information security incidents, and the status of system security (specifically the level of residual risk to which the system is exposed).
• Prepare Security Improvement Plans alongside the System Owners for approval by the Information Security Committee.
• Prepare Training and Awareness Plans for personnel regarding Information Security, which must be approved by the Information Security Committee.
• Validate the System Continuity Plans prepared by the System Owner, which must be approved by the Information Security Committee and periodically tested by the System Owner.
• Approve the guidelines proposed by System Owners to consider Information Security throughout the entire life cycle of assets and processes: specification, architecture, development, operation, and changes.
• Convene the meetings of the Information Security Committee.
• Prepare the topics to be addressed in Committee meetings, providing timely information for decision-making.
• Draft the minutes of the meetings.
• Be responsible for the direct or delegated execution of the Committee’s decisions.

D.  System Owner

The main functions entrusted to the System Owner are:

• Develop, operate, and maintain the Information System throughout its entire life cycle, including its specifications, installation, and verification of its correct operation.
• Define the topology and management system of the Information System, establishing the criteria for use and the services available within it.
• Ensure that specific security measures are properly integrated within the general security framework.
• The System Owner may agree to suspend the handling of certain information or the provision of a certain service if informed of serious security deficiencies that could affect the fulfillment of established requirements. This decision must be agreed upon with the affected Information Owners, the affected Service Owners, and the Security Officer before being executed.
• Apply the security operating procedures developed and approved by the Security Officer.
• Monitor the security status of the Information System and report it periodically—or in the event of relevant security incidents—to the Information Security Officer.
• Develop System Continuity Plans to be validated by the Information Security Officer and coordinated and approved by the Information Security Committee.
• Conduct periodic exercises and tests of the System Continuity Plans to keep them updated and verify their effectiveness.
• Develop guidelines for considering Information Security throughout the entire life cycle of assets and processes (specification, architecture, development, operation, and changes) and provide them to the Information Security Officer for approval.

E.  System Security Administrator

The main functions entrusted to the Information System Security Administrator are:

• Implement, manage, and maintain the security measures applicable to the Information System.
• Ensure strict compliance with the established security controls.
• Ensure that traceability, audit trails, and other required security logs are enabled and recording at the desired frequency, in accordance with the Organization’s established security policy.
• Apply Security Operating Procedures and required security mechanisms and services to the Systems, users, and other related internal and external assets and resources.
• Ensure that approved procedures for managing the Information System and the required security mechanisms and services are applied.
• Manage, configure, and update, where applicable, the hardware and software supporting the Information System’s security mechanisms and services.
• Supervise hardware and software installations, modifications, and upgrades to ensure that security is not compromised.
• Approve changes to the current Information System configuration, guaranteeing that enabled security mechanisms and services remain operational.
• Inform the Security Officer and System Owner of any security-related anomaly, compromise, or vulnerability.
• Monitor the security status of the system.

In the event of information security incidents:

• Register, account for, and manage security incidents within the Systems under their responsibility.
• Execute the approved security plan.
• Isolate the incident to prevent propagation to elements outside the risk situation.
• Make short-term decisions if information has been compromised in a way that could lead to serious consequences (these actions should be reflected in a documented procedure to minimize the System Security Administrator’s margin of discretion).
• Ensure the integrity of critical System elements if their availability has been affected (these actions should be reflected in a documented procedure to minimize the System Security Administrator’s margin of discretion).
• Maintain and recover the information stored by the System and its associated services.
• Investigate the incident: Determine the method, means, motives, and origin of the incident.

F.  Physical Security Officer

The Talent & Administration Manager has been designated as the Physical Security Officer. They are responsible for implementing the security measures within their scope, as determined by the Information Security Officer, and shall report to the latter regarding their degree of implementation, effectiveness, and any incidents.

3.1 INFORMATION SECURITY COMMITTEE

The Information Security Committee has been established and will be composed of the following members:

Any other users and/or managers whose intervention is required due to being affected by the National Security Framework (ENS) or the GDPR may attend at the Committee’s request.

The functions of the Information Security Committee are as follows:

• Address the concerns of Senior Management and the different departments.
• Regularly inform Senior Management on the status of information security.
• Promote the continuous improvement of the Information Security Management System (ISMS).
• Develop the organization’s evolution strategy regarding information security.
• Coordinate the efforts of the different areas in information security to ensure that actions are consistent, aligned with the decided strategy, and to avoid duplication.
• Develop (and regularly review) the Information Security Policy for approval by Management.
• Approve information security regulations.
• Develop and approve the training and qualification requirements for administrators, operators, and users from an information security perspective.
• Monitor the main residual risks assumed by the organization and recommend possible actions regarding them.
• Monitor the performance of security incident management processes and recommend possible actions. In particular, ensure the coordination of different security areas in managing information security incidents.
• Promote periodic audits to verify compliance with the organization’s security obligations.
• Approve information security improvement plans for the organization. Specifically, it will ensure the coordination of different plans that may be carried out in various areas.
• Ensure that information security is considered in all ICT projects, from initial specification to operation. In particular, it shall oversee the creation and use of horizontal services that reduce duplication and support the consistent operation of all ICT systems.
• Resolve conflicts of responsibility that may arise between different managers and/or areas of the Organization, escalating cases where it lacks sufficient authority to decide.
• Regularly gather relevant information from internal or external technical staff to make informed decisions.
• Seek advice on matters requiring a decision or an opinion. This advice will be determined on a case-by-case basis and may take various forms:
  • Specialized internal, external, or mixed working groups.
  • Internal and/or external consultancy.
  • Attendance at courses or other training and experience-sharing environments.

In the event of information security incidents:

• Approve the Security Improvement Plan, along with its corresponding budget allocation.

3.2 HIERARCHY IN THE DECISION-MAKING PROCESS AND COORDINATION MECHANISMS

The different information security roles (main authority and possible delegates) are limited to a simple hierarchy: the Information Security Committee provides instructions to the Information Security Officer, who is responsible for fulfillment, supervising that administrators and operators implement security measures in accordance with the Organization’s approved security policy.

The System Security Administrator reports to the System Owner on:

• Incidents regarding system security.
• Configuration, update, or corrective actions

The System Owner informs the Information Owner of functional incidents relating to the information under their responsibility. The System Owner informs the Service Owner of functional incidents relating to the service under their responsibility. The System Owner reports to the Security Officer regarding:

• Security-related actions, particularly regarding system architecture decisions.
• A consolidated summary of security incidents.
• Metrics on the effectiveness of the protection measures to be implemented.

The Security Officer informs the Information Owner of security-related decisions and incidents affecting the information under their responsibility, specifically regarding residual risk estimation and significant risk deviations from approved margins. The Security Officer informs the Service Owner of security-related decisions and incidents affecting the service under their responsibility, specifically regarding residual risk estimation and significant risk deviations from approved margins. When an Information Security Committee exists, the Security Officer reports to said committee as secretary.

3.3  APPOINTMENT PROCEDURES

The Organization’s Management shall formally appoint:

• The Information Owner; which may be an individual position or a collective body (typically, the Information Security Committee).
• The Service Owners; who may be the same as the Information Owner; this may be an individual position or a collective body (typically, the Information Security Committee).
• The Security Officer, who must report directly to Management or, where one exists, to the Information Security Committee.
• The System Owner, who must report directly to Management or, where one exists, to the Information Security Committee.
• The Security/System Administrator, who reports to the Security Officer.
• The Physical Security Officer, who reports to the System Owner.

The Organization’s Management appoints the System Owner as follows:

• Upon the proposal of the Information Owner, when the Information System processes a single type of information.
• Upon the proposal of the Service Owner, when the Information System provides a single service.
• Directly when the Information System processes different types of information or provides multiple services, after consulting with the relevant Information and Service Owners.

The Organization’s Management appoints the System Security Administrator upon the proposal of either the System Owner or the Information Security Officer.

3.4  PERSONAL DATA

To provide the intended services, personal data must be processed. The Record of Processing Activities (ROPA) details the affected processing operations and their corresponding controllers, as well as the measures adopted resulting from the Data Protection Impact Assessments (DPIA) carried out on said processing. All information systems shall comply with the security levels required by regulations, based on the nature and purpose of the personal data collected in the aforementioned Record of Processing Activities.