Information Security Policy

This Information Security Policy is effective from the date of signature until it is replaced by a new Policy.

Effective date: 18 May 2026.

To achieve its objectives, JOBFIE undertakes to protect information security, ensuring sound information management in order to offer all stakeholders maximum assurances regarding the protection of information processed in the delivery of its technology and digital services.

These systems must be managed diligently, adopting appropriate measures to protect them against accidental or deliberate harm that could affect the availability, integrity or confidentiality of the information processed or the services provided.

The purpose of information security is to safeguard information quality and the continued delivery of services, acting preventively, monitoring day-to-day activity and responding swiftly to incidents.

ICT systems must be protected against rapidly evolving threats capable of affecting the confidentiality, integrity, availability, intended use, and value of information and services. Defending against these threats requires a strategy that adapts to changes in environmental conditions to ensure continuity of service delivery. This means that departments must apply the minimum security measures required by the Esquema Nacional de Seguridad (ENS), continuously monitor service performance levels, track and analyse reported vulnerabilities, and prepare an effective incident response to ensure continuity of the services provided.

Departments must ensure that ICT security is an integral part of every stage of the system lifecycle, from design through decommissioning, including development or procurement decisions and operations activities. Security requirements and funding needs must be identified and included in planning, requests for proposals, and ICT procurement tender documents.

Departments must be ready to prevent, detect, respond to and recover from incidents, in accordance with Article 8 of the ENS (Article 8 — Prevention, detection, response and preservation).

This policy applies to all of the entity's ICT systems and to every member of the organisation involved in services and projects for the public sector that require application of the ENS, without exception.

Accordingly, Management establishes the following information security objectives:

• Provide a framework to increase resilience and enable an effective response.
• Ensure rapid, efficient service recovery following any physical disaster or contingency that might jeopardise operational continuity.
• Prevent information security incidents to the extent technically and economically feasible, and mitigate information security risks arising from our activities.
• Ensure the confidentiality, integrity, availability, authenticity and traceability of information.

One objective must be to comply with applicable legal requirements and with any other requirements to which we subscribe beyond commitments entered into with customers, together with their continuous update. Accordingly, the legal and regulatory framework within which we carry out our activities is:

• REGLAMENTO (UE) 2016/679 DEL PARLAMENTO EUROPEO Y DEL CONSEJO de 27 de abril de 2016 relativo a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de estos datos.
• Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales.
• Real Decreto Legislativo 1/1996, de 12 de abril, Ley de Propiedad Intelectual.
• Ley 2/2019, de 1 de marzo, por la que se modifica el texto refundido de la Ley de Propiedad Intelectual, aprobado por el Real Decreto Legislativo 1/1996, de 12 de abril, y por el que se incorporan al ordenamiento jurídico español la Directiva 2014/26/UE del Parlamento Europeo y del Consejo, de 26 de febrero de 2014, y la Directiva (UE) 2017/1564 del Parlamento Europeo y del Consejo, de 13 de septiembre de 2017.
• Real Decreto 311/2022, de 3 de mayo, por el que se regula el Esquema Nacional de Seguridad.
• Ley 34/2002 de 11 de julio de Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI).
• Ley 39/2015, de 1 de octubre, del Procedimiento Administrativo Común de las Administraciones Públicas.
• Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público.
• Ley 6/2020, de 11 de noviembre, reguladora de determinados aspectos de los servicios electrónicos de confianza.
• Ley 1/2019, de 20 de febrero, de Secretos Empresariales.
• Resolución de 7 de octubre de 2016, de la Secretaría de Estado de Administraciones Públicas, por la que se aprueba la Instrucción Técnica de Seguridad de Informe del Estado de la Seguridad.
• Resolución de 13 de octubre de 2016, de la Secretaría de Estado de Administraciones Públicas, por la que se aprueba la Instrucción Técnica de Seguridad de conformidad con el Esquema Nacional de Seguridad.
• Resolución de 27 de marzo de 2018, de la Secretaría de Estado de Función Pública, por la que se aprueba la Instrucción Técnica de Seguridad de Auditoría de la Seguridad de los Sistemas de Información.
• Resolución de 13 de abril de 2018, de la Secretaría de Estado de Función Pública, por la que se aprueba la Instrucción Técnica de Seguridad de Notificación de Incidentes de Seguridad.

To achieve these objectives, it is necessary to:

• Continuously improve our information security management system.
• Identify potential threats and the business impact should those threats materialise.
• Protect the interests of key stakeholders (customers, shareholders, employees and suppliers), reputation, brand and value‑creating activities.
• Work jointly with suppliers and subcontractors to improve IT service delivery, service continuity and information security, leading to greater efficiency in our operations.
• Assess and ensure staff technical competence and motivation to participate in continuous process improvement, providing training and internal communications so that good practices defined by the system are followed.
• Ensure facilities and equipment remain fit for purpose and aligned with the company's activities, objectives and targets.
• Continuously analyse all relevant processes, implementing improvements as appropriate based on results and on objectives set.
• Structure our management system so that it is easy to understand.

Management of our system is assigned to the Information Systems Manager, and the system will be available in our information system repository, accessible according to access profiles granted under the access management procedure in force.

System security documentation is organised in folders on the company's file server, subdivided by standard topics and operational frameworks, containing procedures, records and evidence, with access restricted to company personnel; external unauthorised personnel may not access it.

Security documentation is structured as:

• Security Policy.
• Security regulations: documents describing the use of equipment, services and facilities. They define what constitutes misuse, staff responsibility for compliance or breach, rights, duties and disciplinary measures under applicable law.
• Specific documents: security documentation developed according to applicable CCN‑STIC guides.
• Security procedures: documents detailing how system elements are operated.

This policy is supplemented by the other policies, procedures and documents in force that implement our management system.

The essential responsibility lies with the organisation's General Management, which must organise functions and responsibilities and provide the appropriate resources to achieve ENS objectives. Managers are also responsible for leading by example and complying with the established security rules.

These principles are endorsed by Management, which provides the necessary means and equips employees with sufficient resources for compliance, as reflected and made publicly known through this Integrated Management Systems Policy.

The security roles or functions defined are:

This definition of duties and responsibilities is supplemented in job profiles and in the system documents “Register of officers, roles and responsibilities”.

Conflict resolution

Any differences of view that could give rise to a conflict shall be addressed within the Security Committee, and the General Management criterion shall always prevail.

The procedure for appointment and renewal will be ratification within the security committee.

The committee for security management and coordination is the body with the highest responsibility within the information security management system, so that the most important security-related decisions are agreed by this committee.

These members are appointed by the committee, the only body that may appoint them, renew their terms or remove them.

The security committee is an autonomous, executive body with decision-making autonomy and does not need to subordinate its activity to any other element of our company.

Information security organisation is developed in the document that supplements this Security Organisation Policy.

This policy is supplemented by the other policies, procedures and documents in force that implement our management system.

All in-scope systems under this Policy must perform a risk analysis, assessing threats and risks to which they are exposed. This analysis is reviewed regularly:

• at least once a year;
• when the information handled changes;
• when the services provided change;
• when a serious security incident occurs;
• when serious vulnerabilities are reported.

To harmonise risk analyses, the ICT Security Committee will set a reference valuation for the different types of information handled and services provided. The ICT Security Committee will drive resource availability to meet security needs across systems, promoting horizontal investments.

Risk analysis will take into account the methodology set out in the Risk Analysis procedure.

All JOBFIE members must know and comply with this Information Security Policy and the Security Regulations; the ICT Security Committee is responsible for providing the necessary means to ensure information reaches those affected.

All JOBFIE members will attend at least one ICT security awareness session each year. A continuous awareness programme will be established for all JOBFIE members, especially newcomers.

Individuals responsible for using, operating or administering ICT systems will receive training on secure system use as required for their duties. Training is mandatory before taking on a responsibility, whether a first assignment or a change of role or duties.

This Policy applies to all JOBFIE personnel and external personnel performing tasks within the company.

Human Resources will include information security responsibilities in job descriptions, inform all hired personnel of their obligations regarding compliance with the Information Security Policy, manage confidentiality commitments with personnel, and coordinate user training tasks related to this Policy.

The Security Management Officer (RGS) [CISO] is responsible for monitoring, documenting and analysing reported security incidents, and for communicating with the Information Security Committee and information owners.

The Information Security Committee is responsible for implementing the means and channels required for the Security Management Officer (RGS) [CISO] to manage incident and system anomaly reports. The Committee will also stay informed, oversee investigations, monitor how information evolves and promote resolution of information security incidents.

The Security Management Officer (RGS) [CISO] will participate in preparing the Confidentiality Commitment signed by employees and third parties performing functions at JOBFIE, advise on sanctions for breach of this Policy, and handle information security incidents.

All JOBFIE personnel are responsible for promptly reporting weaknesses and information security incidents that are detected.

Human resources professionalism

• Determine the competence required of personnel to perform work affecting Information Security.
• Ensure that individuals are competent on the basis of appropriate education, training or experience.
• Demonstrate through documented information where personnel competence in Information Security is required.

The objectives of controlling personnel security are to:

• Reduce risks of human error, irregularities, misuse of facilities and resources, and unauthorised handling of information.
• Explain security responsibilities at recruitment and include them in agreements to be signed, verifying compliance during performance of the employee's duties.
• Ensure users are aware of information security threats and concerns and are able to support the organisation's Information Security Policy in their normal duties.
• Establish confidentiality commitments with all personnel and users outside information processing facilities.
• Provide tools and mechanisms to encourage reporting existing security weaknesses and incidents in order to minimise their impact and prevent recurrence.

Access control to information systems aims to:

• Prevent unauthorised access to information systems, databases and information services.
• Implement security in user access through authentication and authorisation techniques.
• Control security in connections between the JOBFIE network and other public or private networks.
• Review critical events and activities performed by users on systems.
• Raise awareness of responsibility for the suitable use of passwords and equipment.
• Ensure information security when laptops and personal computers are used for remote work.

The objectives of this policy regarding facility protection are to:

• Prevent unauthorised access, damage and interference with JOBFIE premises, facilities and information.
• Protect JOBFIE critical information processing equipment by placing it in protected areas within a defined security perimeter, with appropriate security measures and access controls. Also consider protection when equipment is moved or remains outside protected areas for maintenance or other reasons.
• Control environmental factors that could impair proper operation of computing equipment hosting JOBFIE information.
• Implement measures to protect information handled by staff in offices within the normal scope of their routine duties.
• Provide protection proportionate to identified risks.

This Policy applies to all physical resources related to JOBFIE information systems: facilities, equipment, cabling, files, storage media, etc.

The Security Management Officer (RGS) [CISO], together with Information Owners as applicable, will define physical and environmental security measures to protect critical assets on the basis of a risk analysis and will supervise their application. Compliance with physical and environmental security provisions will also be verified.

Department heads will define JOBFIE personnel physical access levels to restricted areas under their responsibility. Information Owners will formally authorise off‑site work involving their business information by JOBFIE employees when they consider it appropriate.

All JOBFIE personnel are responsible for complying with the clean desk and clean screen policy to protect information related to daily office work.

Departments must ensure ICT security is an integral part of every stage of the system lifecycle, from design through decommissioning, including development or procurement decisions and operations activities. Security requirements and funding needs must be identified and included in planning, requests for proposals, and ICT procurement tender documents.

Information security will also be considered in acquisition and maintenance of information systems, limiting and managing change.

The policy for developing and acquiring information systems is developed in the document: Policy on Acquisition, Development and Maintenance of Systems.

JOBFIE considers it strategic for information security to be integrated into processes throughout the lifecycle. Information systems and services must include security by default from creation through decommissioning, with security embedded in development and/or procurement decisions and all operations activities, making security an integral, cross-cutting process.

JOBFIE commits to ensuring system integrity through a change management process that controls updating of physical or logical elements by prior authorisation before installation in the system. Such assessment will be performed mainly by the systems management function, which will evaluate impact on system security before changes are made and will document control of changes assessed as significant or with implications for system security.

Periodic security reviews will assess systems' security posture relative to manufacturers' specifications, vulnerabilities and applicable updates, reacting diligently to manage risk given the security state of these systems.

JOBFIE implements protection measures for stored or in-transit information security across insecure environments. Insecure environments include laptops, personal digital assistants (PDA), peripheral devices, information media and communications over open networks or with weak encryption.

JOBFIE implements protection measures for information security, especially to protect the perimeter, in particular when connecting to public networks, especially when they are used wholly or mainly to provide electronic communications services available to the public.

Risks arising from system interconnection via networks with other systems will in any case be analysed, and the interconnection point will be controlled.

To help ensure business continuity, JOBFIE adopts measures so that systems have backups and mechanisms necessary to maintain operations if usual working resources are lost.

JOBFIE establishes a continuous improvement process for information security applying the criteria and methodology set out in international standards such as ISO 27001.