INFORMATION SECURITY PRINCIPLES AND GOALS
These principles, as well as the Information Security Management System on which they are based, use the ISO27001 standard as a frame of reference.
Cobega Group’s information security objectives are aligned with those of the business, giving priority to compliance with the legal obligations in force and being applicable to the activity carried out.
Commitment to compliance with the General Data Protection Regulation of the European Union and the regulations on personal data protection in force in the countries where Cobega operates shall be considered a priority information security objective.
In addition to the legal security requirements, Cobega has the obligation and commitment to comply with the contractual and specific security requirements of its customers and suppliers in relation to the information to which they have access by virtue of their contractual relations with them.
Cobega will have the human, organizational, technological, and documentary resources necessary to protect the company's information, avoiding incidents that could endanger it.
At all levels of Cobega there will be a commitment to comply with the objectives set for information security and to implement the established controls and prevention measures.
For all levels of Cobega there is an obligation to comply with the established rules and procedures, always focusing on protecting the information assets and personal data processed by Cobega.
The company shall adopt the necessary measures to ensure that personnel are aware of the safety obligations that affect the performance of their duties, as well as the consequences of non-compliance.
Cobega will promote a constant training and awareness activity at all levels in the field of information security, drawing up a training action plan, monitoring its execution and evaluating its results.
Cobega's security strategy will comply with the principles of confidentiality, integrity, availability, authenticity, and traceability of information:
- The principle of confidentiality guarantees that the information is only accessible to users authorized to access it and that it may not be disclosed to third parties without the corresponding authorization.
- The principle of integrity ensures that data is kept free from unauthorized modification and that existing information has not been altered by unauthorized individuals or processes.
- The principle of availability guarantees that information will be constantly accessible and usable, ensuring the continuity of processes and the business. This principle goes hand in hand with the principle of resilience, which consists of ensuring the capability of systems and information to recover from an incident that temporarily prevents access to them.
- The principle of authenticity guarantees that the origin and identities associated with the information are really those that appear in the attributes of the information. This principle goes hand in hand with the principle of non-repudiation, which consists of ensuring that a user cannot deny the authorship of an act in the system or the linkage to a piece of data or set of data.
- The principle of traceability guarantees the possibility of always determining the identity of the individuals accessing the information and their activity in relation to it, as well as the different states and routes that the information has followed.
- A principle of proportionality shall be applied between the controls to be applied and the severity of the risk to be prevented, detected, or mitigated.
In new services and developments, the principle of security by design and by default will be applied.
Cobega is committed and oriented towards continuous improvement, with the objective of ensuring that security management is always adequate and effective, periodically re-evaluating security measures and controls to adapt them to significant changes in the business, the company's information systems and the evolution of technology.
Barcelona, April 26th, 2024