{"id":1520,"date":"2025-03-31T11:27:18","date_gmt":"2025-03-31T11:27:18","guid":{"rendered":"https:\/\/indigitall.ankaa.dev\/?page_id=1520"},"modified":"2025-07-08T11:21:12","modified_gmt":"2025-07-08T11:21:12","slug":"security-policy","status":"publish","type":"page","link":"https:\/\/indigitall.ankaa.dev\/en\/security-policy\/","title":{"rendered":"Security Policy"},"content":{"rendered":"","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false},"class_list":["post-1520","page","type-page","status-publish","hentry"],"acf":{"flexible_content":[{"acf_fc_layout":"hero_utility_page","pretitle":"Legal Page","title":"Security Policy"},{"acf_fc_layout":"legal_text","info_items":[{"title":"name","text":"SMART2ME, S.L"},{"title":"CIF","text":"B86653938"},{"title":"ADDRESS","text":"Paseo de la Castellana, 139, 28020 Madrid"},{"title":"PHONE","text":"+1 (213) 336-4050"},{"title":"EMAIL","text":"rgdp@indigitall.ankaa.dev"}],"content":"INDIGITALL\u2019s Information Security Management System pursues as a fundamental objective the protection of information by offering its workers, collaborators, suppliers and clients a safe work environment through the appropriate security measures and operational processes.\r\n
\r\n
\r\n

INFORMATION SECURITY POLICY<\/h1>\r\n

1. APPROVAL AND ENTRY INTO FORCE<\/h2>\r\n

Text approved on March 19, 2025, by resolution of the General Manager of SMART2ME, S.L (hereinafter INDIGITALL).\r\nThis \u201cInformation Security Policy,\u201d hereinafter referred to as the Policy, will be effective from its date of approval and will remain in force until it is replaced by a new Policy.<\/p>\r\n\r\n

2. INTRODUCTION<\/h2>\r\n

INDIGITALL relies heavily on ICT systems (Information and Communication Technologies) to achieve its objectives and recognizes that digital transformation has led to an increase in risks associated with the information systems that support public services. As a provider to the public sector, INDIGITALL must adequately manage these risks.\r\nThe objective of this risk management is to protect Information and Communication Technology systems from accidental or deliberate harm that could affect the availability, integrity, confidentiality, authenticity, or traceability of the information processed by INDIGITALL within the framework of services provided to the public sector, and more specifically to residential and social-health centers.\r\nICT systems must be protected against rapidly evolving threats that can impact the confidentiality, integrity, availability, intended use, and value of information and services. To defend against these threats, a strategy that adapts to changing environmental conditions is required to ensure the continuous delivery of services. This means that departments must apply the minimum security measures required by the National Security Framework, continuously monitor service delivery levels, track and analyze reported vulnerabilities, and prepare an effective response to incidents to ensure service continuity.\r\nThe different departments of INDIGITALL must ensure that ICT security is an integral part of every stage of the system lifecycle, from conception to decommissioning, including development or acquisition decisions and operational activities. Security requirements and funding needs must be identified and included in planning, requests for proposals, and contracting of ICT projects.\r\nDepartments must be prepared to prevent, detect, respond to, and recover from incidents, in accordance with Article 8 of the National Security Framework (ENS).<\/p>\r\n\r\n

3. SCOPE<\/h2>\r\n

3.1 Subjective Scope<\/h2>\r\n

This Policy applies to all INDIGITALL personnel, as well as all individuals or entities, both internal and external, providing services to INDIGITALL, whether on their own premises or remotely.<\/p>\r\n\r\n

3.2 Objective Scope<\/h2>\r\n

This Policy applies to INDIGITALL\u2019s information systems related to the \u201cmarketing automation\u201d Platform services in a SaaS model.<\/p>\r\n\r\n

4. REGULATORY FRAMEWORK<\/h2>\r\n

The identification and maintenance of the regulatory framework will be the responsibility of INDIGITALL\u2019s Security Officer and will be governed by the procedure for identifying and assessing legal requirements. Mandatory technical security instructions published by resolution of the Secretary of State for Digitalization and Artificial Intelligence of the Ministry of Economic Affairs and Digital Transformation, or the entity assuming those functions, will be included.\r\nLikewise, the Security Officer will also be responsible for identifying CCN security guidelines, which will be applied to improve compliance with the National Security Framework (ENS).<\/p>\r\n\r\n

5. MINIMUM SECURITY REQUIREMENTS<\/h2>\r\n

INDIGITALL\u2019s Security Policy regulates the continuous management of the security process. This Policy has been established in accordance with the basic principles set out in Chapter II of the ENS and is developed considering the application of the following minimum security requirements:<\/p>\r\n

a)\u2003Organization and implementation of the security process (art.13)\r\nb)\u2003Risk analysis and management (art.14)\r\nc)\u2003Personnel management (art.15)\r\nd)\u2003Professionalism (art.16)\r\ne)\u2003Authorization and access control (art.17)\r\nf)\u2003Protection of facilities (art.18)\r\ng)\u2003Procurement of security products and contracting of security services (art.19)\r\nh)\u2003Minimum privilege (art.20)\r\ni)\u2003System integrity and updating (art.21)\r\nj)\u2003Protection of stored and in-transit information (art.22)\r\nk)\u2003Prevention regarding other interconnected information systems (art.23)\r\nl)\u2003Activity logging and detection of malicious code (art.24)\r\nm)\u2003Security incidents (art.25)\r\nn)\u2003Business continuity (art.26)\r\n\u00f1)\u2003Continuous improvement of the security process (art.27)<\/p>\r\n

To meet these minimum requirements, INDIGITALL will apply the security measures in Annex II of the ENS, considering:<\/p>\r\n\r\n