• Products

Information Systems Security Policy

CONTENTS

 

1. APPROVAL AND ENTRY INTO FORCE

This document was approved by the Management of ID WASTE, hereinafter the Organisation, on 4 January 2021. This Information Security Policy is effective from that date until it is replaced by a new Policy.

 

2. OBJECTIVES, MISSION AND VISION OF THE ORGANISATION

In managing its interests, the Organisation promotes activities and provides environmental services in the field of waste management in order to offer the best solutions to waste collection companies, public administrations and users of collection services, helping to meet the needs and aspirations of its customers.

The mission of ID WASTE is to carry out, with the highest quality and good service, the sale, installation and maintenance of fleet and data management systems for waste collection services, and the purchase and sale of products to promote the separate collection of waste and other related products.

The vision of ID WASTE is to contribute to improving the separate collection of waste through the use of innovative products, equipment and technologies that make this task easier for the different agents involved in the process.

 

3. OBJECTIVES OF THE SECURITY POLICY

The information and communication technologies security policy of the Organisation, hereinafter the ICT Security Policy of the Organisation, pursues the following objectives:

  • a) To guarantee that the data hosted by the Organisation are managed in accordance with ICT security standards and good practices.
  • b) To raise the level of ICT security awareness wherever this Policy applies, ensuring that the staff at its service are aware of their obligations and responsibilities.
  • c) To lay the foundations of a comprehensive ICT security management model in the Organisation, covering the technical, organisational and procedural aspects in a continuous improvement cycle.
  • d) To demonstrate the Organisation’s commitment to information security through its support for the Security Committee, providing it with the means and powers necessary to carry out its functions.
  • e) To define, develop and implement the technical, organisational and management controls necessary to guarantee, in an effective and measurable way, the preservation of the levels of confidentiality, availability and integrity of information approved by the Organisation.
  • f) To guarantee the continuity of the services offered by the Organisation to its customers
  • g) To continuously create and promote a “security culture”, both internally among all staff and externally among customers and suppliers, which ensures the efficiency and effectiveness of the controls implemented and increases customer confidence.

 

4. POLICY REVIEW

This policy will be reviewed at least once a year and whenever there are relevant changes in the Organisation, in order to ensure that it is aligned with the strategy and needs of the Organisation.

The Policy will be proposed and reviewed by the Security Committee and approved and disseminated by Management so that all parties involved are aware of it.

In the event of conflicts or differing interpretations of this policy, the matter will be referred to the Security Committee for resolution.

 

5. REGULATORY FRAMEWORK

For the purposes of this Policy, the reference regulatory framework is that established by the legislation in force on ICT security.

Due to the personal and confidential nature of the information handled and of the services made available to Public Administrations, citizens and the companies that work for them, the Organisation carries out its activities in accordance with the regulations in force in these areas, among which the following are currently particularly relevant:

  • a) Royal Decree 3/2010, of 8 January, regulating the National Security Framework (ENS) in the field of e-Government.
  • b) Royal Decree 951/2015, of 23 October, amending Royal Decree 3/2010, of 8 January, regulating the National Security Framework in the field of e-Government.
  • c) Royal Decree 311/2022, of 3 May, regulating the National Security Framework in the field of e-Government.
  • d) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
  • e) Law 59/2003, of 19 December, on electronic signatures.
  • f) Law 9/2017, of 8 November, on Public Sector Contracts, transposing into Spanish law Directives 2014/23/EU and 2014/24/EU of the European Parliament and of the Council of 26 February 2014.

 

6. SCOPE

This Policy shall apply to and be mandatory for the entire Organisation, its resources and the processes affected by the ENS and the GDPR, whether internal or external and linked to the Organisation through contracts or agreements with third parties.

 

7. ICT SECURITY PRINCIPLES
7.1. Basic principles of the ICT security policy

The ICT security policy of the Organisation will, as a general rule, be developed in accordance with the following principles:

  • a) Principle of confidentiality: ICT assets must be accessible only to those users, bodies and entities or processes expressly authorised to do so, respecting the obligations of secrecy and professional confidentiality.
  • b) Principle of integrity and quality: the integrity and quality of the information, as well as of the processes for handling it, must be maintained, establishing mechanisms to ensure that the processes of creating, processing, storing and distributing information help to preserve its accuracy and correctness.
  • c) Principle of availability and continuity: a high level of availability of ICT assets will be guaranteed, and they will be provided with the plans and measures necessary to ensure the continuity of services and recovery from possible serious contingencies.
  • d) Principle of traceability: measures will be implemented to ensure that it is possible at all times to determine who did what and when, in order to be able to analyse the security incidents detected.
  • e) Principle of authenticity: measures must be put in place to guarantee the source of the information from which the data originate and that the entities where the information originates are who they claim to be.
  • f) Principle of risk management and comprehensive security: a continuous process of risk analysis and treatment must be put in place as the basic mechanism on which the security management of ICT assets must rest.
  • g) Principle of cost proportionality: the implementation of measures to mitigate the security risks of ICT assets must follow an approach of proportionality in economic and operational costs.
  • h) Principle of awareness and training: initiatives will be put in place to enable users to know their duties and obligations regarding the secure handling of information. Likewise, specific ICT security training will be promoted for all those who manage and administer information and telecommunications systems.
  • i) Principle of prevention, reaction and recovery: specific plans and lines of work will be developed to prevent fraud, non-compliance or incidents related to ICT security.
  • j) Principle of continuous improvement or periodic reassessment: the degree of effectiveness of the ICT security controls implemented will be reviewed in order to adapt them to the constant evolution of risks and of the technological environment.
  • k) Principle of security throughout the life cycle of ICT assets, or lines of defence: security specifications will be included in all phases of the life cycle of services and systems, accompanied by the corresponding control procedures.
  • l) Principle of differentiated functions: responsibility for systems security will be differentiated from responsibility for the service and from responsibility for the information. The roles and responsibilities of each of these functions must be duly defined and documented.
7.2. Minimum Security Requirements

This security policy will be established in accordance with the basic principles indicated and will be developed by applying the following minimum requirements:

  • a) Organisation and implementation of the security process: the organisational structure for information security management will be competent to maintain, update and enforce the Information Security Policy in the Organisation, as well as to guarantee the implementation of the security process in the Organisation.
  • b) Risk analysis and management: risk analysis and management will be an essential part of the security process. Risk management will make it possible to maintain a controlled environment, minimising risks to acceptable levels. These levels will be reduced through the deployment of security measures, which will strike a balance between the nature of the data and the processing, the impact and likelihood of the risks to which they are exposed, and the effectiveness and cost of the security measures. When assessing risk in relation to data security, the risks arising from the processing of personal data must be taken into account.
  • c) Staff management: the necessary mechanisms will be implemented so that anyone who accesses, or may access, information assets knows their responsibilities, thereby reducing the risk arising from misuse of those assets.
  • d) Professionalism: systems security will be handled, reviewed and audited by qualified, dedicated and trained staff at all phases of its life cycle. The staff who handle, review and audit systems security will receive the specific training necessary to guarantee the security of the applicable information technologies. Security service providers will be required, objectively and without discrimination, to have qualified professionals and suitable levels of management and maturity in the services provided.
  • e) Access authorisation and control: access to information assets by users, processes and other information systems will be limited through the implementation of identification, authentication and authorisation mechanisms in line with the criticality of each asset. In addition, use of the system will be logged in order to ensure the traceability of access and to audit its proper use, in accordance with the Organisation’s activity.
  • f) Protection of facilities: information assets will be located in secure areas, protected by physical access controls appropriate to their level of criticality. The systems and information assets contained in those areas will be sufficiently protected against physical or environmental threats.
  • g) Product acquisition: when acquiring security products, certification of the security functionality related to the purpose of the acquisition will be required, at the discretion of the security officer and applying the principle of proportionality. The contracting of security services will be governed by the principle of professionalism.
  • h) Security by default: security will be understood as a comprehensive process made up of all the technical, human, material and organisational elements related to the system. Information security must be considered part of normal operations, being present and applied from the initial design of information systems.
  • i) System integrity and updating: the Organisation’s IT system will be designed and maintained by the Information Systems manager according to technical, efficiency and security criteria. Any physical or logical element will require formal authorisation prior to its installation on the system. Formal prior authorisation will also be required for any change to the hardware and software configuration of equipment or any uninstallation of programs from the predefined platform. As a general rule, no software will be installed unless the corresponding licence is held, either because it has been acquired by the Organisation or because it is free software with an applicable licence. In all cases, the system administrator will install the software once authorised
  • j) Protection of stored information and information in transit: in the structure and organisation of system security, special attention will be paid to information stored or in transit through insecure environments, such as laptops, personal digital assistants (PDAs), peripheral devices, information media and communications over open networks or with weak encryption. Security also includes the procedures that ensure the long-term recovery and preservation of the electronic documents produced by the Organisation.
  • k) Prevention with regard to other interconnected information systems: the procedures necessary to achieve proper management of the security, operation and updating of Information and Communication Technologies will be established. Information transmitted over communication networks must be adequately protected, taking into account its level of sensitivity and criticality, through mechanisms that guarantee its security.
  • l) Activity logging: user activities will be logged, retaining the information necessary to monitor, analyse, investigate and document improper or unauthorised activities, making it possible to identify at all times the person acting.
  • m) Security incidents: appropriate mechanisms will be implemented for the correct identification, recording and resolution of security incidents.
  • n) Business continuity: appropriate mechanisms will be implemented to ensure the availability of information systems and to maintain the continuity of business processes, in accordance with the service level needs of their users.
  • o) Continuous improvement of the security process: security measures will be periodically reassessed and updated to adapt their effectiveness to the constant evolution of risks and protection systems. Information security will be handled, reviewed and audited by qualified, trained and dedicated staff.

 

8. ICT SECURITY ORGANISATION
8.1. General responsibility

Preserving ICT security will be considered a common objective of all persons at the service of the Organisation, who will be responsible for the correct use of the information and communication technology assets made available to them.

In the event of non-compliance with the security guidelines and regulations set out in this policy and the obligations arising from them, the Organisation reserves the right to take disciplinary action.

Given their importance in implementing security, this policy sets out some of the functions of the bodies that the Organisation considers necessary for the correct management of security.

8.2. ICT Security Committee of the Organisation
  • a) The ICT Security Committee is created within the Organisation as a cross-cutting collegiate body for coordination and governance in matters of security within the Organisation.
  • b) The Committee will be made up of each of the representatives of the IT Area and the Security Officer.
  • c) The Committee’s own functions will be:
    • 1. Defining, approving and monitoring ICT security objectives, initiatives and strategic plans.
    • 2. Ensuring the availability of the resources necessary to develop the defined initiatives and strategic plans.
    • 3. Submitting proposals for the review of the ICT security regulatory framework to the competent body for formal processing.
    • 4. Establishing common guidelines and supervising compliance with ICT security regulations.
    • 5. Supervising and approving the level of risk and decision-making in the response to security incidents affecting ICT assets.
  • d) The Committee will meet at least once a year and will be governed by this policy.
  • e) The Committee will appoint from among its members an ICT incident response group, called the “Crisis Committee”, whose function will be to take urgent decisions in the event of a serious contingency affecting the security of critical information systems of the Organisation.
  • f) Support and advice to the Committee will be provided by the ICT Security Officer and the ICT Security Office.
8.3. ICT Security Officer
  • a) The appointment of the Security Officer will be the prerogative of the Organisation’s Security Committee.
  • b) The ICT Security Officer will have the following functions within their Department:
    • 1. Defining and monitoring actions related to the ICT security of the Entity’s information assets and risk management.
    • 2. Advice and support on security matters.
    • 3. Coordination of ICT security matters.
    • 4. Proposing and monitoring training and awareness programmes.
    • 5. Reporting periodically to the Security Committee on the status of ICT Security and related activities.
  • c) Assuming the functions included in articles 10, 27.3 and 34.6, Annex II (section 2.3) and Annex III (sections 2.1.b and 2.2.b) of Royal Decree 3/2010, of 8 January, regulating the National Security Framework in the field of e-Government.
  • d) Assuming the functions included in Regulation (EU) 2016/679 on the protection of personal data, approved on 25 May 2016, which entered into force on 25 May 2017.
8.4. ICT Security Office
  • a) The ICT Security Office will be made up of the Area Managers of the Organisation, although it may call on any persons the Office considers necessary to carry out the work entrusted to it.
  • b) This ICT Security Office will also include the Organisation’s Security Officer, who will be responsible for reviewing and preparing proposals to be submitted to and discussed by the ICT Security Committee.
  • c) The ICT Security Office will have the following powers:
    • 1. Defining the technical and operational approach to ICT security objectives, initiatives and strategic plans, in accordance with the guidelines of the ICT Security Committee.
    • 2. Preparing proposals for the review of the ICT security regulatory framework.
    • 3. Preparing reports and proposals on legal and regulatory compliance.
    • 4. Preparing reports on the ICT security level of assets.
    • 5. Reporting periodically to the ICT Security Committee on the status of the Organisation’s IT Security.
  • d) The ICT Security Office will be governed by this Policy.
8.5. Responsible parties

The Information Owner determines the security requirements for the information processed in the Organisation.

The Service Owner determines the hardware and software infrastructure of the information system, the criteria for use, the services offered, the formats and any other aspect of the operation of the Organisation’s information system.

The Security Officer determines how to meet the security requirements of both the information and the services offered, including the definition of security procedures and, where appropriate, the adoption of urgent measures in the event of possible deficiencies or threats in the Organisation.

The system administrator develops, operates and maintains the Organisation’s information system.

Discrepancies in security matters will be resolved according to the criterion of highest hierarchy.

The powers of each responsible party, as well as the coordination and conflict resolution mechanisms, are set out in the Security Roles and Responsibilities Regulations and the Security Regulations.

 

9. DEVELOPMENT OF THE SECURITY POLICY
9.1. Development instruments

The Organisation’s Information Security Policy will be developed through service instructions and circulars addressing specific aspects. These instructions and circulars may take any of the following forms:

The following instruments will be used:

Security standards: they standardise the use of specific aspects of the system. They indicate correct use and users’ responsibilities. They are mandatory.

Procedures: they specify workflows for carrying out tasks, indicating what needs to be done, step by step, but without going into detail (on suppliers, brands or technical commands). They are useful for repetitive tasks.

Technical instructions (TI): they develop the Procedures to the highest level of detail (indicating the suppliers, brands and technical commands used to carry out the tasks).

The security regulations will be available on the intranet to all members of the Organisation who need to know them.

9.2. Approval of regulations

Throughout the Organisation, security standards will be approved in accordance with the provisions of this policy and the specific regulations developed for this purpose within the Organisation.

9.3. Penalties for non-compliance

Non-compliance with the Information Security Policy and the standards that develop it may give rise to the corresponding disciplinary liability, which will be handled in accordance with the disciplinary regulations in force at any given time.

 

10. AWARENESS AND TRAINING

Awareness and training seek to achieve several objectives. On the one hand, and fundamentally, full awareness that information security affects all members of the Organisation and all the activities and services that make it up.

On the other hand, in line with the Principle of Comprehensive Security, putting in place the means necessary for all persons involved in the day-to-day running of the Organisation and their line managers to have the appropriate sensitivity towards the responsibility involved in handling customer information.

 

11. RISK ANALYSIS AND MANAGEMENT

All systems subject to this Policy must undergo risk analysis and management, assessing the assets, threats and vulnerabilities to which they are exposed and proposing appropriate countermeasures to mitigate the risks. Although continuous control of changes made to the systems is required, this analysis will be repeated:

  • a) At least once a year (through formal review and approval).
  • b) When a serious security incident occurs.

Risk analysis and management will use the MAGERIT methodology (Information Systems Risk Analysis and Management Methodology), developed by the Spanish Higher Council for e-Government.

 

12. INFORMATION SECURITY

An Information Classification of the Organisation will be developed in order to identify the different types of information according to their sensitivity, establish how to label the media containing them, and determine what may and may not be done at each classification level.

 

13. PERSONAL DATA

The provisions of the GDPR and the national legislation on this matter will apply.

Each area will be responsible for managing and maintaining the security of the personal data included in the processing operations for which it is responsible.

All information systems of the Organisation will comply with the security levels required by these regulations.

 

14. STAFF OBLIGATIONS

All members of the Organisation and third parties providing services of any kind contracted by the Organisation, or which are in any way provided under the control and/or direction of the Organisation, are obliged to know and comply with this Information Security Policy and the Security Regulations, which will be communicated to those concerned.

An ongoing awareness programme will be established for all members of the Organisation, in particular for new staff.

Staff must use the security incident reporting procedures provided for this purpose if they detect a possible incident.

Persons with responsibility for the use, operation or administration of information systems will receive training in the secure handling of the systems.

 

15. THIRD PARTIES

When the Organisation provides services to other bodies or handles information from other bodies, they will be made aware of this Information Security Policy, channels will be established for reporting and coordination between the respective Information Security Committees, and action procedures will be established for responding to security incidents.

When the Organisation uses third-party services or transfers information to third parties, they will be made aware of this Security Policy and of the Security Regulations relating to those services or information. The third party must agree to be bound by the obligations set out in those regulations, and may develop its own operating procedures to meet them. Specific procedures for reporting and resolving incidents will be established. It will be ensured that third-party staff are adequately aware of security matters, at least to the same level as that established in this Policy.

When any aspect of the Policy cannot be met by a third party as required in the preceding paragraphs, a report from the Security Officer will be required specifying the risks incurred and how to address them. This report must be approved by the owners of the information and services concerned, as well as by the data controller provided for in the GDPR, before proceeding.

 

Barcelona, 22 May 2023

Frederic Puig
General Manager

Signature of Frederic Puig, General Manager

  • Become a Customer

LEADING THE WAY TO THE FUTURE

Fabrik blends steel technology leadership with outstanding problem-solving capabilities to support customers and suppliers in shaping the future of automotive transportation.

Let’s Talk