Information Security Policy

Approval and Entry into Force.

This Information Security Policy is effective from the date of signature and remains in force until it is replaced by a new Policy.

Mission of the Organization

Doole Health S.L., being aware of the importance of ICT systems (Information and Communication Technologies) to achieve its objectives and assuming its commitment to information security, subjects these systems to appropriate management in order to offer all its stakeholders the highest guarantees regarding the security of the information used.
These systems must be administered diligently, taking appropriate measures to protect them against accidental or deliberate damage that may affect the availability, integrity, or confidentiality of the information processed or the services provided.
The objective of information security is to ensure the quality of information and the continued delivery of services by acting preventively, monitoring daily activity, and responding promptly to incidents.
ICT systems must be protected against rapidly evolving threats with the potential to affect the confidentiality, integrity, availability, intended use, and value of information and services. To defend against these threats, a strategy is required that adapts to changing environmental conditions to ensure the continuous delivery of services. This implies that departments must apply the minimum security measures required by the Esquema Nacional de Seguridad (ENS) and ISO 27001, continuously monitor service delivery levels, track and analyze reported vulnerabilities, and prepare an effective response to incidents to ensure the continuity of services provided.
The various departments must ensure that ICT security is an integral part of every stage of the system life cycle—from conception through withdrawal from service—including development or acquisition decisions and operational activities. Security requirements and funding needs must be identified and included in planning, requests for proposals, and tender specifications for ICT projects.
Departments must be prepared to prevent, monitor, detect, respond to, and recover from incidents, in accordance with Article 8 of the ENS (Article 8. Prevention, detection, response, and preservation. Royal Decree 311/2022, of 3 May 2022, regulating the National Security Framework in the field of Electronic Administration. Updated on 30/03/2021).

Scope

This policy applies to all ICT systems of the entity and to all members of the organization involved in services and projects aimed at the public sector that require the application of the ENS, without exceptions.

Objectives

For all the above, Management establishes the following information security objectives:
– Provide a framework to increase resilience and enable an effective response.
– Ensure the rapid and efficient recovery of services in the event of any physical disaster or contingency that may occur and jeopardize the continuity of operations.
– Prevent information security incidents to the extent that is technically and economically feasible, as well as mitigate information security risks generated by our activities.
– Ensure the confidentiality, integrity, availability, authenticity, and traceability of information.

Regulatory Framework

One of the objectives must be to comply with applicable legal requirements and any other requirements we subscribe to, in addition to commitments made with clients, as well as their continuous updating. To this end, the legal and regulatory framework in which we carry out our activities is:
REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights.
Royal Legislative Decree 1/1996, of 12 April, Intellectual Property Law.
Royal Decree-law 2/2018, of 13 April, amending the recast text of the Intellectual Property Law.
Royal Decree 311/2022, of 3 May, developing the National Security Framework, as amended by Royal Decree 951/2015, of 23 October.
Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI).
ISO/IEC 27001:2022.

ISO 22301:2019 “Security and Resilience – Business Continuity Management Systems – Requirements”

Development

To achieve these objectives, it is necessary to:
• Continually improve our information security system.
• Identify potential threats, as well as the business impact that such threats could cause if materialized.
• Preserve the interests of key stakeholders (clients, shareholders, employees, and suppliers), reputation, brand, and value-creating activities.
• Work jointly with our suppliers and subcontractors to improve IT service delivery, service continuity, and information security, leading to greater efficiency in our activity.
• Assess and ensure the technical competence of staff, as well as ensure adequate motivation to participate in the continuous improvement of our processes, providing the training and internal communication necessary to develop the good practices defined in the system.
• Ensure the proper condition of facilities and suitable equipment, consistent with the company’s activity, objectives, and targets.
• Ensure the continuous analysis of all relevant processes, establishing appropriate improvements in each case based on the results obtained and the objectives set.
• Structure our management system so that it is easy to understand. Our management system has the following structure:
Management of our system is entrusted to the Head of IT Systems, and the system will be available in our information system in a repository accessible according to access profiles granted in accordance with our current access management procedure.
All authorized users will have an individual set of security attributes (privileges), whose assignment, review, and maintenance will be managed individually, ensuring traceability and compliance with the principle of least privilege. This management will be carried out in accordance with the access control procedure and will be periodically reviewed by the Security Officer.

Security Organization

The essential responsibility lies with the organization’s General Management, which is responsible for organizing functions and responsibilities and providing adequate resources to achieve the objectives of the ENS. Managers are also responsible for setting a good example by following established security rules.
These principles are assumed by Management, which provides the necessary means and equips its employees with sufficient resources for compliance, setting them out and making them publicly known through this Integrated Management Systems Policy. The defined security roles or functions are:

Implementation, Management, and Maintenance of Security Measures
This definition of duties and responsibilities is completed in the job profiles and in the system documents “Register of Persons Responsible, Roles, and Responsibilities.”

Security Committee

The procedure for designation and renewal shall be ratification by the Security Committee.
The committee for the management and coordination of security is the body with the greatest responsibility within the information security management system; therefore, all major decisions related to security are agreed by this committee.
The members of the Information Security Committee are:
– Information Owner
– Services Owner
– Security Officer
– System Owner
– ISMS Owner
– Managing Director
These members are appointed by the committee, the only body that can appoint, renew, and dismiss them.
The Security Committee is an autonomous, executive body with decision-making autonomy and does not have to subordinate its activity to any other element of our company.
The organization of Information Security is developed in a complementary document. Among its functions, it highlights ensuring compliance with the ENS and, among its main tasks, the resolution of conflicts, since differences in criteria that may lead to a conflict will be addressed within the Security Committee, and in all cases the criterion of the General Management will prevail.

Risk Management

All systems subject to this Policy must undergo a risk analysis, assessing the threats and risks to which they are exposed. This analysis is reviewed regularly:
– At least once a year;
– When the information handled changes;
– When the services provided change;
– When a serious security incident occurs;
– When serious vulnerabilities are reported.
To harmonize risk analyses, the ICT Security Committee will establish a baseline assessment for the different types of information handled and the different services provided. The ICT Security Committee will drive the availability of resources to meet the security needs of the various systems, promoting horizontal investments.
For conducting the risk analysis, the risk analysis methodology developed in the “Risk Analysis” procedure will be taken into account.

Personnel Management

All members of our Organization are obliged to know and comply with this Information Security Policy and the Security Regulations, and it is the responsibility of the ICT Security Committee to provide the necessary means to ensure the information reaches those affected.
All members of our Organization will attend an ICT security awareness session at least once a year. A continuous awareness program will be established to cover all members of the organization, particularly new hires.
Individuals with responsibility for the use, operation, or administration of ICT systems will receive training for the secure handling of systems to the extent necessary to perform their work. Training will be mandatory before assuming a responsibility, whether it is their first assignment or a change of position or responsibilities.

Professionalism and Security of Human Resources

This Policy applies to all staff of the organization and to external personnel performing tasks within the company.
The HR area will include information security functions in employee job descriptions, will inform all hired personnel of their obligations regarding compliance with the Information Security Policy, will manage confidentiality commitments with staff, and will coordinate user training tasks regarding this Policy.
The Security Management Officer (RGS) [CISO] is responsible for monitoring, documenting, and analyzing reported security incidents, as well as communicating with the Information Security Committee and the Information Owners.
The Information Security Committee will be responsible for implementing the means and channels necessary for the Security Management Officer (RGS) [CISO] to handle reports of incidents and system anomalies. The Committee will also keep abreast of and oversee investigations, monitor the evolution of information, and promote the resolution of information security incidents.
The Security Management Officer (RGS) [CISO] will participate in preparing the Confidentiality Commitment to be signed by employees and third parties performing functions in the organization, in advising on sanctions to be applied for non-compliance with this Policy, and in handling information security incidents.
All organizational personnel are responsible for promptly reporting identified information security weaknesses and incidents.

Professionalism of Human Resources

– Determine the necessary competence of personnel to carry out work affecting Information Security.
– Ensure that individuals are competent based on appropriate education, training, or experience.
– Demonstrate, through necessary documented information, the competence of personnel in Information Security.

The objectives of controlling personnel security are:
– Reduce the risks of human error, initiation of irregularities, misuse of facilities and resources, and unauthorized handling of information.
– Explain security responsibilities at the recruitment stage, include them in the agreements to be signed, and verify their compliance during the performance of employee tasks.
– Ensure that users are aware of information security threats and concerns and are trained to support the organization’s Information Security Policy in the course of their normal duties.
– Establish confidentiality commitments with all personnel and users outside of information processing facilities.
– Establish the tools and mechanisms necessary to promote the communication of existing security weaknesses, as well as incidents, in order to minimize their effects and prevent recurrence.

Authorization and Access Control to Information Systems

The objectives of access control are:
– Prevent unauthorized access to information systems, databases, and information services.
– Implement user access security through authentication and authorization techniques.
– Control security in the connection between the organization’s network and other public or private networks.
– Review critical events and activities carried out by users in the systems.
– Raise awareness of responsibility for the use of passwords and equipment.
– Ensure information security when laptops and personal computers are used for remote work.

Protection of Facilities

The objectives of this policy regarding the protection of facilities are to:
– Prevent unauthorized access, damage, and interference to the organization’s headquarters, facilities, and information.
– Protect the organization’s critical information processing equipment by placing it in protected areas and safeguarding it with a defined security perimeter, with appropriate security measures and access controls; also consider its protection during transfer and while outside protected areas for maintenance or other reasons.
– Control environmental factors that could impair the proper functioning of computing equipment that hosts the organization’s information.
– Implement measures to protect information handled by personnel in offices as part of their normal duties.
– Provide protection proportional to the identified risks.
This Policy applies to all physical resources related to the organization’s information systems: facilities, equipment, cabling, files, storage media, etc.
The Security Management Officer (RGS), together with the Information Owners, as appropriate, will define the physical and environmental security measures for the protection of critical assets, based on a risk analysis, and will oversee their implementation. The RGS will also verify compliance with physical and environmental security provisions.
Department heads will define physical access levels for organizational personnel to restricted areas under their responsibility. Information Owners will formally authorize off-site work with business information for organizational employees when deemed appropriate.
All organizational personnel are responsible for complying with the clean screen and clean desk policy to protect information related to day-to-day office work.

Procurement of Products

Departments must ensure that ICT security is an integral part of each stage of the system life cycle—from conception to withdrawal from service—including development or acquisition decisions and operational activities. Security requirements and funding needs must be identified and included in planning, requests for proposals, and tender specifications for ICT projects.
In addition, information security will be taken into account in the acquisition and maintenance of information systems, limiting and managing change.
The policy on the development and acquisition of information systems is set out in the document: “Policy on Acquisition, Development and Maintenance of Systems.”

Security by Default

The organization considers it strategic that processes integrate information security as part of their life cycle. Information systems and services must include security by default from their creation to their withdrawal, incorporating security into development and/or acquisition decisions and into all operational activities, establishing security as an integral and cross-cutting process.

System Integrity and Updating

Our Organization undertakes to ensure system integrity through a change management process that enables control of the updating of physical or logical elements by requiring prior authorization before installation in the system. This assessment will primarily be carried out by the systems management, which will evaluate the impact on system security before making changes and will document those changes assessed as significant or with implications for system security.
Through periodic security reviews, the security posture of systems will be assessed with respect to manufacturer specifications, vulnerabilities, and applicable updates, acting diligently to manage risk in light of their security status.

Protection of Information at Rest and in Transit

The organization establishes protective measures for Information Security for information stored or in transit through untrusted environments. Untrusted environments include laptops, personal digital assistants (PDAs), peripheral devices, information media, and communications over open networks or with weak encryption.

Prevention for Interconnected Information Systems

The Organization establishes protective measures for Information Security specifically to protect the perimeter, particularly when connecting to public networks, especially when such networks are used wholly or primarily for providing electronic communications services available to the public.
In all cases, risks arising from the interconnection of the system, via networks, with other systems will be analyzed and their interconnection points will be controlled. This includes electronic connections available to the public.

Activity Logs

The organization will log user activities, retaining the information necessary to monitor, analyze, investigate, and document improper or unauthorized activities, allowing the person acting to be identified at all times.
The main objectives of Incident Management are to:
– Establish a system for detecting and reacting to malicious code.
– Have procedures for managing security incidents and weaknesses detected in information system components.
– Ensure these procedures cover detection mechanisms, classification criteria, analysis and resolution procedures, as well as communication channels to stakeholders and the logging of actions taken.
– Use these logs for the continuous improvement of system security.
– Ensure that IT services return to optimal performance.
– Reduce potential risks and impacts caused by incidents.
– Safeguard the integrity of systems in the event of a security incident.
– Communicate the impact of an incident as soon as it is detected to trigger alerts and implement an appropriate corporate communication plan.
– Promote business efficiency.

Business Continuity

With the aim of ensuring business continuity, the organization establishes measures so that systems have backups and the necessary mechanisms to guarantee the continuity of operations in the event of loss of usual working means.

Continuous Improvement of the Security Process

The organization establishes a continuous improvement process for information security by applying the criteria and methodology set out in the standard.