fjsales@fjove.com

Contact
Contact

INFORMATION SECURITY POLICY

Torrelavega, 1 June 2023
Fernández Jove Group Management

Fernández Jove Grupo bases its operations on the processing of various types of data and information, which enables it to carry out its core business processes. The systems, software, communications infrastructure, files, databases, archives, etc., constitute Fernández Jove Grupo’s main assets; consequently, any damage to or loss of these assets affects the conduct of its operations and may jeopardise the organisation’s continuity.

As priority objectives, the following must be done:

  • To protect the Organisation’s intellectual property so that it is not disclosed or used unlawfully.
  • To ensure an efficient service for our customers, delivering high standards of quality and safety, whilst safeguarding their rights and maintaining their trust.

To ensure that this does not happen, the following policy has been drawn up: Information Security Policy, whose principles and objectives are:

  • Information, both internal and that pertaining to our customers, has a strategic value for the business, which is why it must be protected against unauthorised access and tampering, keeping it confidential and intact.
  • The source of the information must be reliable. The credibility of the information depends on the authenticity of the source.
  • The information must be available, enabling its authorised access whenever it is necessary.
  • Information protection will be achieved by applying control measures to the assets that hold or process it: individuals, media, facilities, communications, systems, applications, etc. These measures must be proportionate to the value of the asset to be protected. The security controls applied shall never exceed the cost of the assets to which they apply or the damage that could be caused to them as a result of their absence.
  • Any technical or organisational measures capable of safeguarding information must be coordinated and aligned with the business.
  • La seguridad de la información no es sólo un acto interno, por lo que se debe obtener un compromiso formal de los proveedores y colaboradores respecto a la gestión de seguridad de la información.
  • La seguridad de la información es responsabilidad de todos. Todo usuario tiene la obligación de atender los requisitos impuestos y atender y comunicar cualquier indicio que pueda comprometerla.
  • The continuity of business-critical operations must be ensured.
  • The requirements for safety and theircompliance must be reviewed and verified periodically.
  • The processing of information and the security measures implemented must always comply with applicable laws, rules and regulations.

To ensure compliance with these principles and objectives of information security of information the following shall be required:

  • Define responsibilities in the area of information security by establishing the appropriate organisational structure.
  • Establish a system for classifying the information and the data a9> in order to protect the critical information assets.
  • To draw up a set of rules, standards, guidelines and/or procedures applicable to the management bodies, employees, partners, external service providers, the organisation’s assets, and operations relating to them, etc.
  • Set out the consequences of failing to comply with the workplace security policy.
  • Assess the risks affecting assets with a view to implementing appropriate security measures and controls, in accordance with the risk analysis and management methodology and criteria adopted by the organisation, as set out in the document “Fernández Jove Grupo.AR.01 Methodology for Risk Analysis and Management”.
  • To protect assets, through controls and measures, against threats that could lead to security incidents.
  • To mitigate the effects of security incidents as quickly as possible, in order to minimise their impact and gather evidence to substantiate the incidents and identify the perpetrator.
  • To monitor the flow of information and data via communications infrastructure or through the dispatch of optical, magnetic or paper-based data storage media, etc.
  • Monitor and log logical and physical access to information and associated systems, and identify those who access them.
  • Verify the effectiveness of security measures and controls through internal security audits carried out by independent auditors.
  • Monitor the effectiveness of safety measures by determining the number of incidents, their nature and their consequences.
  • To train users in security management and information and communications technology.
  • To protect people in the event of natural disasters, fires, floods, terrorist attacks, etc., through emergency plans.
  • Comply with the legislation on matters relating to data protection, intellectual property, employment, regarding services provided by the company and information, criminal law, etc., which affects the assets of the Organisation.
  • Reduce the risk of unavailability through the proper use of the assets of the Organisation.