A. Esquema Nacional de Seguridad (ENS)
Fecha:15/01/24
Versión: 1.3
Revisado: Responsable de seguridad
1. Introduction
This Security Policy follows the indications of the Royal Decree 311/2022, of May 3, which regulates the National Security Scheme (hereinafter, ENS).
INFORMÁTICA MÉDICO FARMACÉUTICA S.L, depends on ICT (Information Technology and Telecommunications) systems to achieve its objectives. These systems must be managed diligently, taking appropriate measures to protect them against accidental or deliberate damage that may affect the security of the information processed or the services provided and always being protected against threats or incidents with potential to affect the confidentiality, integrity, availability, traceability and authenticity of the information processed and the services provided.
To address these threats, a strategy that adapts to changing environmental conditions is required to ensure the continuous provision of services. This implies that departments must implement the minimum security measures required by the ENS, as well as continuously monitor service delivery levels, monitor and analyze reported vulnerabilities, and prepare an effective response to cyber incidents to ensure the continuity of the services provided.
In this way, all staff involved with IMF are aware that ICT security is an integral process at every stage of the system lifecycle, from its conception to its decommissioning, through development or acquisition decisions and operational activities. Security requirements and associated costs must be identified and included in planning, in the request for bids, and in bidding documents for ICT projects.
Therefore, for INFORMÁTICA MÉDICO FARMACÉUTICA S.L., the objective of Information Security is to guarantee the quality of the information and the continuous provision of services, acting preventively, implementing lines of defense and monitoring the daily activity to detect any incident and reacting promptly to incidents to recover the services as soon as possible, as established in the ENS, with the application of the measures listed below.
1.1 Prevention
INFORMÁTICA MÉDICO FARMACÉUTICA S.L must avoid, or at least prevent as far as possible, that the information or services are damaged by security incidents. To this end, the minimum security measures determined by the ENS must be implemented, as well as any additional controls identified through a threat and risk assessment. These controls, and the security roles and responsibilities of all personnel, must be clearly defined and documented. To ensure compliance with the policy, the organization must:
- Authorize systems prior to going into operation.
- Regularly assess security, including assessments of configuration changes made on a routine basis.
- Request periodic review by third parties in order to obtain an independent assessment.
1.2 Detection
Since services can degrade rapidly due to incidents, the operation must be monitored on an ongoing basis to detect anomalies in service delivery levels and act accordingly as set out in Article 9 of the ENS.
Monitoring is especially relevant when establishing lines of defense in accordance with Article 8 of the ENS. Detection, analysis and reporting mechanisms shall be established that reach those responsible on a regular basis and when a significant deviation from parameters that have been pre-established as normal occurs.
1.3 Response
INFORMÁTICA MÉDICO FARMACÉUTICA S.L shall:
- Establish mechanisms to respond effectively to security incidents.
- Designate points of contact for communications with respect to incidents detected in areas of the entity or in other organizations related to INFORMÁTICA MÉDICO FARMACÉUTICA S.L.
- Establish protocols for the exchange of information related to the incident. This includes two-way communications with nationally recognized Emergency Response Teams (CERT) such as Iris-CERT, CCN-CERT and other equivalents.
1.4 Recovery
To restore the availability of services, contingency plans for ICT systems should be developed that include information recovery activities that contribute to service continuity.
2. Our mission
INFORMÁTICA MÉDICO FARMACÉUTICA S.L, has as its mission to provide application development services for public and private administrations in the search for improvement in onco-hematology processes, which translates into an improvement in patient care.
An Information Security Policy has been designed, the main objectives of which are:
- To draw up a set of rules, standards and procedures applicable to management bodies, employees, partners, external service providers, etc.
- To protect, by means of controls/measures, the assets against threats that may result in security incidents.
- Establish an information and data classification system to protect critical information assets.
Specify the effects of non-compliance with the Security Policy in the workplace.
-Evaluate the risks that affect the assets in order to adopt the appropriate security measures/controls.
-Train users in security management and in information and communication technologies.
-Observe and comply with the legislation on data protection, intellectual property, labor, information society services, criminal, etc., affecting the assets of INFORMÁTICA MÉDICO FARMACÉUTICA S.L.
3. Scope
This Policy shall apply to the information systems of INFORMÁTICA MÉDICO FARMACÉUTICA S.L, related to the exercise of its competences and to all users with authorized access to them, whether or not they are employees and regardless of the nature of their legal relationship. All of them have the obligation to know and comply with this Information Security Policy and its derived Security Regulations, being the responsibility of the Security Manager to provide the necessary means for the information to reach the affected staff.
Taking into account the mission of INFORMÁTICA MÉDICO FARMACÉUTICA S.L. defined in point 2, the present Security Policy is applicable to the ICT Information Systems and Services that support the development, implementation and application of Farmis Oncofarm® and saraPROMs®.
The organization rejects the application of this Security Policy on those information systems not reflected in this section.
4. Basic Principles
The basic principles are fundamental security guidelines that must always be kept in mind in any activity related to the use of information assets. The following are established:
- Strategic scope: Information security must have the commitment and support of all management levels of the university, so that it can be coordinated and integrated with the rest of the strategic initiatives of the organization to form a coherent and effective implementation of the security process.
- Responsibility determined: In the ICT systems, the Information Manager, who determines the security requirements of the information processed, the Service Manager, who determines the security requirements of the services provided, the System Manager, who is responsible for the provision of services and the Security Manager, who determines the decisions to satisfy the security requirements, will be identified.
- Integral security: Security will be understood as an integral process consisting of all the technical, human, material and organizational elements related to ICT systems, trying to avoid any punctual action or circumstantial treatment. Information security must be considered as part of normal operations, being present and applied from the initial design of the ICT systems.
- Risk Management: Risk analysis and management will be an essential part of the security process. Risk management will allow the maintenance of a controlled environment, minimizing risks to acceptable levels. The reduction of these levels will be achieved through the deployment of security measures, which will strike a balance between the nature of the data and processing, the impact and likelihood of the risks to which they are exposed, and the effectiveness and cost of the security measures. When assessing risk in relation to data security, the risks arising from the processing of personal data should be taken into account.
- Proportionality: The establishment of protection, detection and recovery measures should be proportionate to the potential risks and the criticality and value of the information and services affected.
- Continuous improvement: Security measures shall be re-evaluated and updated periodically to adapt their effectiveness to the constant evolution of risks and protection systems. Information security will be attended, reviewed and audited by qualified, trained and dedicated personnel.
- Security by default: Systems must be designed and configured to ensure a sufficient degree of security by default. The minimum requirements for authorization and access control, protection of facilities, procurement of security products and security services, protection of information, prevention of other interconnected information systems, logging of activity and detection of malicious code, security incidents and least privilege shall apply.
5. Regulatory Framwork
The regulatory framework in which INFORMÁTICA MÉDICO FARMACÉUTICA S.L. activities are developed and, in particular, the provision of its electronic services is integrated by the standards that are referenced in the document: "SGSI05-List of docs and req. Legal".
6. Security Organization
Three (3) levels can be distinguished in the organization chart of INFORMÁTICA MÉDICO FARMACÉUTICA S.L:
Level 1 - General Management:
General Secretary, who understands the mission of the organization, determines the objectives it intends to achieve and responds that they are achieved.
Level 2 - Executive Management:
Services, who understand what each management unit does and how the different units coordinate with each other to achieve the objectives set by the Management.
Level 3 - Operational
Focuses on a specific activity and controls how things are done.
Following the same scheme and in accordance with the ENS, a security organization chart of INFORMÁTICA MÉDICO FARMACÉUTICA S.L is structured in 3 levels:
- Level 1:
- Corporate Security Committee (CSO)
- Information Security Committee (CISO)
- Information Officer.
- Service Manager
- Level 2:
- Information Security Officer.
- Level 3:
- Systems Security Technician.
- Information Systems Managers.
- The specification of security requirements (Level 1) corresponds to those responsible for the information and services, together with the person responsible for the file if there is personal data. The operation (level 3) corresponds to those responsible for the systems, while supervision corresponds to the security manager (level 2) and the security technician (level 3).
Above them all, there is the Security Coordination and Management Committee (level 1). This Security Committee can also assume responsibility for Information and Services.
The specific description of the responsibilities can be found in the document: ISMS06-Roles and Responsibilities.
6.1 Designation procedures
The performance of the responsibilities defined in this Security Policy will be determined by the access to the different positions that have been linked to them. In the event of the disappearance or change of name of any of these positions, the Managing Director of INFORMÁTICA MÉDICO FARMACÉUTICA S.L. will be responsible for assigning the new position to which the figure will be linked.
7. Personal data
MFI carries out processing operations in which it makes use of personal data subject to the provisions of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016.
The security policies applicable to these processing operations are governed by MFI's Personal Data Processing Register; it lists the data processing operations affected by the Regulation.
All of MFI's information systems shall conform to the security required by the nature and purpose of the personal data collected in the aforementioned Data Processing Register.
8. Risk managment
MFI carries out processing operations in which it makes use of personal data subject to the provisions of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016.
The security policies applicable to these processing operations are governed by MFI's Personal Data Processing Register; it lists the data processing operations affected by the Regulation.
All of MFI's information systems shall conform to the security required by the nature and purpose of the personal data collected in the aforementioned Data Processing Register.
8.1. Risks arising from the processing of personal data
When assessing risk in relation to data security, risks arising from the processing of personal data, such as accidental or unlawful destruction, loss or alteration of personal data transmitted, stored or otherwise processed, or unauthorized communication of or access to such data, which may in particular result in physical, material or immaterial damage, must be taken into account.
The log of your processing activities will be published and risk management will be carried out through Risk Analysis and EPID, if necessary.
9. Development of the Security Policy
This Information Security Policy will be complemented by means of various security regulations and recommendations (security regulations and procedures, technical security procedures, reports, records and electronic evidence). The Information Security Committee is responsible for its annual review and/or maintenance, proposing, if necessary, improvements to it.
The body of regulations on information security will be developed in three levels by scope of application, level of technical detail and mandatory compliance, so that each regulation of a certain level of development is based on the higher level regulations. These levels of regulatory development are as follows:
1. First normative level: security policies.
2. Second normative level: constituted by the security regulations.
3. Third normative level: procedures, guides and technical instructions. These are documents that, in compliance with the Information Security Policy, determine the actions or tasks to be carried out in the performance of a process.
The Managing Director of INFORMÁTICA MÉDICO FARMACÉUTICA S.L is responsible for the approval of the Information Security Policy, being the Security Manager in charge of the approval of the remaining documents, being also responsible for its dissemination so that the affected parties are aware of it.
Conflict resolution shall be carried out through the Security Committee.
10. Obligations of the personnel
All members of INFORMÁTICA MÉDICA MÉDICO FARMACÉUTICA S.L have the obligation to know and comply with this Information Security Policy and the Security Regulations developed from it, being the responsibility of the Security Committee to provide the necessary means for the information to reach those affected, always taking into account the budgetary availabilities of INFORMÁTICA MÉDICA FARMACÉUTICA S.L.
All employees of INFORMÁTICA MÉDICA MÉDICO FARMACÉUTICA S.L under the scope of the ENS will attend an awareness action on ICT security at least once every two years. A program of continuous awareness actions will be established to attend all members of INFORMÁTICA MÉDICA MÉDICO FARMACÉUTICA S.L related to the development of applications related to the public administration, in particular those of new incorporation, always taking into account the budgetary availabilities of INFORMÁTICA MÉDICO FARMACÉUTICA S.L. An awareness action will be carried out during the two years following the approval of this Security Policy and in a continuous way for the newly incorporated personnel.
Where appropriate, if specific training is required for the secure handling of the systems, persons with responsibility for the operation or administration of ICT systems will receive it to the extent that they need it to perform their work.
11. Third parties
When INFORMÁTICA MÉDICO FARMACÉUTICA S.L provides services to other organizations or handles information from other organizations, they will be informed about this Information Security Policy. To this end, channels will be established for the reporting and coordination of the respective ENS Security Committees and procedures will be established for the reaction to security incidents.
When INFORMÁTICA MÉDICO FARMACÉUTICA S.L. uses third party services or transfers information to third parties, they will be informed of this Security Policy and the Security Regulations that involve such services or information. This third party will be subject to the obligations set out in the aforementioned regulations. With this, the supplier must ensure that its staff is adequately trained in security in accordance with the requirements of INFORMÁTICA MÉDICO FARMACÉUTICA S.L.
12. Continuous improvement
The information security management is a process subject to permanent updating. Changes in the organization, threats, technologies and/or legislation are an example in which a continuous improvement of the systems is necessary. Therefore, it is necessary to implement a permanent process that will involve, among other actions:
a) Review of the Information Security Policy.
b) Review of services and information and their categorization.
c) Annual execution of risk analysis.
d) Conducting internal audits or, where appropriate, external audits.
e) Review of security measures.
f) Revision and updating of rules and procedures.
13. Entry into effect
This Information Security Policy is effective from the day following the date of its approval by the Management of INFORMÁTICA MÉDICO FARMACÉUTICA S.L. and until it is replaced by a new Policy.
B. Security Policy
In response to a new technological environment where the convergence between information technology and communications are facilitating a new paradigm of productivity for companies, INFORMÁTICA MÉDICO FARMACÉUTICA S.L (IMF), is highly committed to maintaining a competitive service by offering a responsible business model, based on the permanent search for economic, social and environmental balance, where the development of good practices in Information Security is essential to achieve the objectives of confidentiality, integrity, availability and legality of all information managed.
Consequently, IMF defines the following principles within the framework of the Information Security Management System (ISMS):
Confidentiality: the information handled by IMF will be known only by authorized persons, after identification, at the time and by the means authorized.
Integrity: the information processed by IMF will be complete, exact and valid, being its content the one provided by the affected persons without any kind of manipulation.
Availability: the information processed by MFI will be accessible and usable by authorized and identified users at all times, being guaranteed its own persistence in the face of any foreseen eventuality.
Legality: IMF will ensure compliance with any applicable legislation or contractual requirements. And in particular, the regulations in force related to the processing of personal data.
IMF for the correct performance of its business functions is based on and is assisted by the processing of different types of data and information, supported by systems, programs, communications infrastructure, files, databases, files, etc., constituting these, one of the main assets of IMF. Damage or loss of these assets affects the performance of its services and may jeopardize the continuity of the organization. In order to prevent this from happening, an Information Security Policy has been designed with the following main purposes:
-Protect, through controls/measures, assets against threats that may lead to security incidents.
-Mitigate the effects of security incidents.
-Establish an information and data classification system to protect critical information assets.
-Define responsibilities for information security by creating the corresponding organizational structure.
-Elaborate a set of rules, standards and procedures applicable to management bodies, employees, partners, external service providers, etc.
-Specify the effects of non-compliance with the Security Policy in the workplace.
-Evaluate the risks affecting the assets in order to adopt the appropriate security measures/controls.
-Verify the functioning of security measures/controls through internal security audits carried out by independent auditors.
-Train users in security management and information and communications technology.
-Control information and data traffic through communications infrastructures or by sending optical, magnetic, paper, etc. data carriers.
-Observe and comply with legislation on data protection, intellectual property, labor, information society services, criminal law, etc., affecting MFI's assets.
-Protect the organization's intellectual capital from unlawful disclosure and use.
-Reduce the chances of unavailability through the proper use of the organization's assets.
-Defend assets against internal or external attacks so that they do not become security incidents.
-Monitor the functioning of security measures by determining the number of incidents, their nature and their effects.
IMF's Management assumes the responsibility to support and promote the establishment of the organizational and technical control measures necessary to comply with this Information Security Policy. As well as, to provide those resources that are necessary to resolve as quickly and effectively as possible, the nonconformities and incidents of information security that may arise, and the implementation of the necessary measures to prevent their recurrence.
This Policy shall be maintained, updated and adequate for the organization's purposes, aligned with the organization's risk management context. To this effect, it will be reviewed on a planned basis or whenever significant changes occur, in order to ensure that its suitability, adequacy and effectiveness are maintained.
Similarly, a formally defined risk assessment procedure is in place to manage the risks faced by IMF.
In turn, all policies and procedures included in the ISMS will be reviewed, approved and promoted by IMF's Management.