Information security policy

Commitment and objectives

Quodus.ai, as a company dedicated to serving institutions in making better use of their spaces and physical infrastructure, is committed to information security and to its proper management, in order to offer all its stakeholders the greatest guarantees regarding the security of the information it uses. For all of the above, Management sets the following information security objectives:

• To provide a framework for increasing resistance, or resilience, so as to respond effectively to critical security situations.
• To ensure the fast and efficient recovery of services in the face of any physical disaster or contingency that might occur and put the continuity of operations at risk.
• To prevent information security incidents as far as is technically and economically feasible, and to mitigate the information security risks arising from our activities.
• To guarantee the confidentiality, integrity, availability, authenticity and traceability of information.

Achieving these objectives requires:

• Continually improving our information security system.
• Complying with the applicable legal requirements and with any other requirements we subscribe to, as well as the commitments made to our clients, and keeping them continuously up to date.

Principles

To this end, it undertakes its commitment to information security in accordance with the reference standards ISO/IEC 27001:2022 and Royal Decree 311/2022, and General Management therefore establishes the following principles:

• Competence and leadership from management as a commitment to developing the Information Security Management System.
• Identifying the internal and external interested parties relevant to the Information Security Management System, and meeting their requirements.
• Understanding the context of the organization and identifying its opportunities and risks with regard to information security, as the basis for planning actions to address, accept or treat them.
• Ensuring the satisfaction of our clients, including the parties interested in the company’s results, in everything relating to the performance of our activities and their impact on society.
• Setting objectives and targets focused on evaluating information security performance, and on continual improvement in our activities, as governed by the Management System that implements this policy.
• Compliance with the requirements of the legislation and regulations applicable to our activity, the commitments made to clients and interested parties, and all internal rules or guidelines to which the company is subject.
• Ensuring the confidentiality of the data managed by the company and the availability of its information systems, both in the services offered to clients and in internal management, preventing undue alteration of information.
• Ensuring the ability to respond to emergencies, restoring critical services in the shortest possible time.
• Establishing the appropriate measures to treat the risks arising from the identification and assessment of assets.
• Motivating and training all staff working in the organization, both to perform their jobs properly and to act in accordance with the requirements of the reference Standard, providing a suitable environment for the operation of processes.
• Maintaining fluid communication, both internally between the different levels of the company and with clients.
• Evaluating and ensuring the technical competence of staff to perform their duties, and ensuring they are suitably motivated to take part in the continual improvement of our processes.
• Ensuring that facilities are in good condition and equipment is adequate, in keeping with the company’s activity, objectives and targets.
• Ensuring the continuous analysis of all relevant processes, establishing the appropriate improvements in each case according to the results obtained and the objectives set.

These principles are adopted by General Management, which provides the necessary means and gives its employees sufficient resources to fulfill them, setting them out and making them public through this Information Security Policy.

Legal and regulatory framework

The legal and regulatory framework within which we carry out our activities is:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
• Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights.
• Royal Legislative Decree 1/1996, of 12 April, approving the consolidated text of the Intellectual Property Law, regularizing, clarifying and harmonizing the legal provisions in force on the matter.
• Royal Decree-law 2/2018, of 13 April, amending the consolidated text of the Intellectual Property Law.
• Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market (eIDAS Regulation).
• Law 31/1995, of 8 November, on the Prevention of Occupational Risks, and Royal Decree 39/1997, of 17 January, approving the Regulation of Prevention Services.
• Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE).
• Royal Decree-law 13/2012, of 30 March, the cookie law.
• Resolution of 7 October 2016, of the Secretary of State for Public Administrations, approving the Technical Security Instruction on the Security Status Report.
• Resolution of 13 October 2016, of the Secretary of State for Public Administrations, approving the Technical Security Instruction on conformity with the National Security Framework.
• Resolution of 27 March 2018, of the Secretary of State for Civil Service, approving the Technical Security Instruction on Information Systems Security Audits.
• Resolution of 13 April 2018, of the Secretary of State for Civil Service, approving the Technical Security Instruction on Notification of Security Incidents.
• Royal Decree 311/2022, of 3 May, regulating the National Security Framework (Esquema Nacional de Seguridad).

Management system

Our management system has been structured so that it is easy to understand.

Management of our system is entrusted to the person responsible for Management, and the system will be available in a repository in our information system, which can be accessed according to the access profiles granted under our current access management procedure.

These principles are adopted by Management, which provides the necessary means and gives its employees sufficient resources to fulfill them, setting them out and making them public through this Integrated Management Systems Policy.

Roles and responsibilities

The security roles or functions defined in the ISMS are:

This definition is completed in the job profiles and the system documents.

They are appointed and renewed by ratification in the security committee.

Security committee

The committee for the management and coordination of security is the body with the greatest responsibility within the information security management system, so that all the most important security decisions are agreed by this committee. The members of the information security committee are:

• Information Manager.
• Services Manager.
• Security Manager.
• System Manager.
• Company Management (partner-directors).

These members are appointed by the committee, the only body that can appoint, renew and dismiss them.

The security committee is an autonomous, executive body with the autonomy to make decisions, and it need not subordinate its activity to any other part of our company.

This policy is complemented by the other policies, procedures and documents in force that implement our management system.