Catalana de Seguretat i Comunicacions, S.L. (hereinafter CSC<\/strong>) is a technology-based company headquartered in Sant Feliu de Llobregat (Barcelona) with over twenty-five years of experience in the design, installation, and maintenance of fire protection, security, and communications systems. Through its central region branch, which operates under the In Genis<\/strong> brand, it extends its operations to the rest of the country. <\/p>\n\n The nature of our work requires us to handle highly sensitive information on a daily basis: security system configurations at third-party facilities, video surveillance footage, detailed technical blueprints of buildings and infrastructure, personal data regarding employees and client contacts, and contractual documentation that is often confidential. Added to this is the fact that our technicians regularly access client facilities\u2014many of which are publicly owned or highly critical in nature. <\/p>\n\n For all these reasons, information protection is not merely a matter of formal compliance for CSC<\/strong>; rather, it is an integral part of how we work and of the trust we place in others and that others place in us. An incident compromising the confidentiality of a security installation or the availability of our management systems would have direct consequences for our clients, our reputation, and, in some cases, the safety of individuals. <\/p>\n\n This Policy stems from that reality and outlines how CSC<\/strong> understands and manages its information security, the commitments it makes, and what is expected of everyone who is part of the organization or works with us.<\/p>\n\n CSC<\/strong>\u2019s mission is to provide high-level technological solutions in the fields of fire protection, asset security, and communications, supporting our clients from the initial consultation through to the long-term maintenance of installed systems. We operate on the conviction that a job well done is one where the client has no need to worry about anything once the contract is signed. <\/p>\n\n In line with that mission, CSC<\/strong> establishes this Information Security Policy as a mandatory document for employees, collaborators, and suppliers. Its purpose is to ensure that the information we handle\u2014both our own and that of our clients\u2014is protected at all times, and that the delivery of our services is not compromised by incidents that could have been avoided. <\/p>\n\n This Policy establishes the framework ensuring that the access, use, custody, and safeguarding of information assets and security devices are carried out with security guarantees across their various dimensions:<\/p>\n\n Specific Information Security objectives at CSC<\/strong>:<\/p>\n\n This Policy shall be approved by CSC<\/strong> Management.<\/p>\n\n It is mandatory for all personnel, as well as collaborators, suppliers, and subcontractors, who access information or systems under CSC<\/strong>‘s responsibility.<\/p>\n\n The policy is reviewed at least once a year or when significant changes occur.<\/p>\n\n It is communicated to all employees and collaborators, and is available to clients and other interested parties.<\/p>\n\n This Policy shall apply to information systems, devices, and services managed by CSC<\/strong> that fall within the scope of the National Security Scheme (ENS) and\/or are critical to the provision of the services constituting its business activities. In particular, “information system” shall be understood to mean: <\/p>\n\n Thus, the scope is defined as follows.<\/p>\n\n The information systems necessary for the provision of the services of:<\/p>\n\n Design, installation, maintenance, and marketing of:<\/p>\n\n The regulatory framework applicable to CSC<\/strong> and set out in Annex I to this Policy.<\/p>\n\n CSC complies with current legislation and is aware of the special care required to handle personal data, adhering to both European and national laws.<\/p>\n\n To comply with Royal Decree 311\/2022 and the requirements of the ENS, CSC<\/strong> will implement security measures proportionate to the nature of the information and the category of the systems and services to be protected. Security will be understood as a comprehensive process encompassing technical, human, organizational, and legal elements. <\/p>\n\n Special attention will be paid to raising staff awareness and providing training, and the adoption of measures will be required to prevent a lack of organization or training, or inadequate procedures, from becoming sources of risk.<\/p>\n\n Systems and devices shall be designed based on the principle of least privilege and with secure configurations to eliminate unnecessary functions. In particular: <\/p>\n\n To ensure compliance with the ENS and organize information security at CSC<\/strong>, minimum security roles will be designated and an Information Security Committee will be established. The roles include, at a minimum: <\/p>\n\n In addition, CSC<\/strong> has a Services Manager who is the person knowledgeable about data protection.<\/p>\n\n The Information Security Committee shall be constituted based on the aforementioned functions and chaired by Management.<\/p>\n\n The role of Security Manager is outsourced to an individual from the company DM Sistemas.<\/p>\n\n The Information Officer is assigned, among others, the following functions:<\/p>\n\n This function cannot be delegated regarding the final acceptance of information risk.<\/p>\n\n The Head of the Service shall be responsible for, among other things:<\/p>\n\n This function cannot be delegated regarding the final acceptance of the risk associated with the service.<\/p>\n\n The Security Manager will perform the following functions:<\/p>\n\n The System Manager shall perform, among others, the following functions:<\/p>\n\n The person responsible for data protection will perform the functions described in their job description and in accordance with applicable personal data protection regulations.<\/p>\n\n Functions of the Information Security Committee:<\/p>\n\n These functions may be delegated to other bodies within the organization.<\/p>\n\n The System Manager shall act as secretary of the Committee:<\/p>\n\n The assignment of security roles and functions will be carried out by the Security Committee leadership. Security roles will be reviewed periodically (a review at least every four years is recommended), and any vacancy must be filled within a specified timeframe of less than one month, in accordance with the internal selection and appointment procedure. The appointment will be formally communicated to the individuals concerned. <\/p>\n\n Any conflict between those responsible or regarding risk ownership shall be resolved by the Information Security Committee, acting as a technical-organizational arbitration body.<\/p>\n\n This Policy shall be implemented through internal regulations, standards, and procedures addressing the requirements and controls mandated by the ENS and data protection regulations; such documentation shall be made available to interested parties and entities.<\/p>\n\n The annual review will be the responsibility of the Safety Committee, which will propose improvements for approval. All safety regulations will be published internally in the subdirectory: Z:\\07 CALIDAD\\ENS<\/strong> <\/p>\n\n The following basic principles shall be taken into account in security decisions:<\/p>\n\n CSC<\/strong> implements a protection strategy based on multiple layers (organizational, physical, and logical measures) designed to ensure that, should one layer be compromised, an appropriate response can be mounted against unavoidable incidents; this reduces the likelihood of the system being compromised in its entirety and minimizes the ultimate impact on it.<\/p>\n\n The organization of security is established through the identification and definition of the various activities and responsibilities regarding system security management, and the implementation of a structure to support them.<\/p>\n\n In general, each and every user of CSC<\/strong>‘s information systems is responsible for the security of information assets through their proper use.<\/p>\n\n To ensure a better response to security incidents, CSC<\/strong> will maintain cooperative security relationships with competent authorities, IT or communication service providers, and public or private bodies dedicated to promoting the security of information systems.<\/p>\n\n In particular, information security management is the specific responsibility of a group of individuals and committees with concrete functions, defined and documented in Section 6 of this policy.<\/p>\n\n Risk analysis and management will be an essential part of the security process and will be a continuous, constantly updated activity.<\/p>\n\n Risk management will enable the maintenance of a controlled environment, minimizing risks to acceptable levels. Reduction to these levels will be achieved through the appropriate application of security measures, in a manner that is balanced and proportionate to the nature of the information being processed, the services to be provided, and the risks involved. <\/p>\n\n All systems subject to this Policy must conduct a risk analysis, evaluating the threats and risks to which they are exposed. This analysis shall be repeated: <\/p>\n\n The measures adopted to mitigate or eliminate risks must be justified, and in any event, there must be proportionality between them and the risks.<\/p>\n\n Risk management will be documented in the Risk Analysis and Management reports.<\/p>\n\n Personnel-related security is fundamental to reducing the risks of human error, theft, fraud, or the misuse of facilities and services.<\/p>\n\n All CSC<\/strong> members are required to be familiar with and comply with this Information Security Policy, and it is the responsibility of the Security Committee to provide the necessary means to ensure that the information reaches the relevant parties.<\/p>\n\n All safety policies and procedures must be regularly communicated to all workers and, where applicable, third-party users.<\/p>\n\n All CSC<\/strong> members will receive security awareness training at least once a year. A continuous awareness program will be established to cover all members of the organization, particularly new hires. <\/p>\n\n Personnel responsible for the use, operation, or administration of ICT systems will receive training on the secure handling of these systems to the extent required to perform their duties. Such training is mandatory prior to assuming responsibility, whether for an initial assignment, a change of position, or a change in responsibilities within the same role. <\/p>\n\n All employees will be required to sign a confidentiality agreement to prevent the disclosure of confidential information. For projects that so require, specific confidentiality agreements will be signed. <\/p>\n\n Upon the termination of the employment or contractual relationship with employees or external personnel, their access permissions to facilities and information will be revoked, and they will be required to return any information or equipment provided to them for the performance of their duties.<\/p>\n\n All personnel\u2014whether in-house or external\u2014associated with CSC<\/strong>\u2019s information systems within the scope of the ENS shall be trained and informed regarding their security-related duties, obligations, and responsibilities. Their activities shall be supervised to verify adherence to established procedures. <\/p>\n\n The meaning and scope of the safe use of the system will be defined and set out in safety rules to be approved by Management or the relevant higher authority. Likewise, the training and experience requirements necessary for personnel to perform their duties will be determined. <\/p>\n\n Information system security will be addressed, reviewed, and audited by qualified, dedicated, and trained personnel throughout all phases of the system’s lifecycle: planning, design, acquisition, construction, deployment, operation, maintenance, incident management, and decommissioning.<\/p>\n\n We will require, in an objective and non-discriminatory manner, that the organizations providing us with services employ qualified professionals and maintain appropriate levels of management and maturity regarding the services delivered.<\/p>\n\n In addition, a schedule for periodic information security awareness training is established for all job roles.<\/p>\n\n Digital access control is described in the ENS Manual.<\/p>\n\n CSC<\/strong> has implemented access control mechanisms for the information system, limiting access to duly authorized users, processes, devices, and other information systems, and exclusively to permitted functions.<\/p>\n\n The objective of access control to information systems is to:<\/p>\n\n Only authorized persons will have access to the facilities.<\/p>\n\n CSC<\/strong> has implemented physical access control mechanisms\u2014preventing unauthorized physical access as well as damage to information and resources\u2014through security perimeters, physical controls, and general area protections.<\/p>\n\n CSC<\/strong> has the necessary protective measures in place to:<\/p>\n\n This Policy applies to all physical resources related to CSC<\/strong> information systems: facilities, equipment, cabling, records, storage media, etc.<\/p>\n\n Those responsible for the different departments will define the levels of physical access of CSC<\/strong> personnel to the restricted areas under their responsibility.<\/p>\n\n Information Owners will formally authorize CSC<\/strong> employees to work off-site with information regarding their business when they deem it appropriate.<\/p>\n\n All CSC<\/strong> personnel are responsible for compliance with the clean screen and clean desk policy, in order to protect information related to daily work within offices and in designated areas outside of them.<\/p>\n\n The various departments must ensure that ICT security is an integral part of every stage of the system lifecycle\u2014from conception to decommissioning, including development or acquisition decisions and operational activities. Security requirements and funding needs must be identified and included in the planning, requests for proposals, and tender specifications for ICT projects. <\/p>\n\n When acquiring information security products or contracting for such services, CSC<\/strong> will give preference\u2014commensurate with the system category\u2014to products and services that possess certification, verified security functionalities, or technical references attesting to their suitability.<\/p>\n\n The contracting of security services shall be guided by the provisions regarding professionalism.<\/p>\n\n The procurement and contracting policy is complemented by internal procedures governing the engagement of third parties.<\/p>\n\n The systems will be designed and configured to grant the minimum privileges necessary for their proper operation, which entails incorporating the following aspects:<\/p>\n\n CSC<\/strong> is committed to ensuring system integrity through a change management process that controls the updating of physical or logical components by requiring authorization prior to their installation in the system. This assessment will be conducted primarily by the Security Officer, with the approval of the CSC<\/strong> Security Committee; the Committee will evaluate the impact on system security before changes are implemented and will maintain a documented record of changes deemed significant or having implications for system security. <\/p>\n\n Periodic security reviews will be used to assess the security status of the systems\u2014taking into account manufacturer specifications, vulnerabilities, and relevant updates\u2014and to respond diligently in managing risk based on that status.<\/p>\n\n Continuous monitoring by the CSC<\/strong> will enable the detection of anomalous activities or behaviors and a timely response.<\/p>\n\n The continuous assessment of the security status of assets will make it possible to measure their evolution, detecting vulnerabilities and identifying configuration deficiencies.<\/p>\n\n Security measures will be periodically re-evaluated and updated to align their effectiveness with evolving risks and protection systems, potentially leading to a rethinking of security arrangements should the need arise.<\/p>\n\n The inclusion of any physical or logical element in the system’s updated asset catalog, or its modification, shall require prior formal authorization.<\/p>\n\n Continuous assessment and monitoring will enable the security posture of the systems to be adjusted in light of configuration deficiencies, identified vulnerabilities, and relevant updates, as well as facilitate the early detection of any incidents affecting them.<\/p>\n\n CSC<\/strong> will pay special attention to information stored on or in transit via portable or mobile equipment or devices, peripheral devices, storage media, and communications over open networks, all of which must be specifically analyzed to ensure adequate protection. It will also establish protective measures for the security of information stored on or in transit through insecure environments. <\/p>\n\n Procedures shall be implemented to ensure the long-term recovery and preservation of electronic documents produced by the information systems falling within the scope of this Royal Decree, where required.<\/p>\n\n Any information in non-electronic format that has been the cause or direct consequence of the electronic information referred to in this Royal Decree must be protected with the same level of security as the latter. To this end, measures appropriate to the nature of the medium shall be applied, in accordance with the applicable regulations. <\/p>\n\n The systems will have backups, and the necessary mechanisms will be established to ensure the continuity of operations in the event of the loss of standard means.<\/p>\n\n CSC<\/strong> establishes information security protection measures\u2014particularly to safeguard the perimeter\u2014especially when connecting to public networks, and specifically where such networks are used wholly or primarily to provide publicly available electronic communications services. In all cases, risks arising from the system’s network-based interconnection with other systems will be analyzed, and the connection point will be controlled. Publicly available electronic connections. <\/p>\n\n In any event, the risks arising from the system’s interconnection with other systems will be analyzed, and the connection point will be controlled. The provisions of the ENS Manual will be followed to ensure proper interconnection between systems. <\/p>\n\n CSC<\/strong> will log user activities, retaining the minimum information necessary to monitor, analyze, investigate, and document improper or unauthorized activities, thereby making it possible to identify the person acting at any given time.<\/p>\n\n In order to preserve the security of information systems, and in accordance with the provisions of the General Data Protection Regulation and in compliance with the principles of purpose limitation, data minimization, and storage limitation set forth therein, CSC<\/strong> may, to the extent strictly necessary and proportionate, analyze incoming or outgoing communications\u2014and solely for information security purposes\u2014in order to prevent unauthorized access to networks and information systems, halt denial-of-service attacks, and prevent the malicious distribution of harmful code as well as other damage to the aforementioned networks and information systems.<\/p>\n\n To enable corrective action or, where appropriate, the assignment of accountability, every user accessing the information system must be uniquely identified, ensuring it is known at all times who has been granted access rights, the nature of those rights, and who has performed a specific activity.<\/p>\n\n The primary objectives of incident management are to:<\/p>\n\n CSC<\/strong> will notify INCIBE-CERT\u2014which will immediately inform CCN-CERT\u2014of incidents affecting them, through the System Administrator.<\/p>\n\n CSC<\/strong> has security incident management procedures in place in accordance with Article 33 and the corresponding Technical Security Instruction, as well as detection mechanisms, classification criteria, analysis and resolution procedures, and communication channels for interested parties.<\/p>\n\n System security shall encompass measures regarding prevention, detection, and response, with the aim of minimizing vulnerabilities and ensuring that threats do not materialize\u2014or, should they do so, do not seriously affect the information handled or the services provided.<\/p>\n\n Prevention measures may incorporate components aimed at deterrence or reducing the area of \u200b\u200bexposure; they must eliminate or reduce the likelihood of threats materializing.<\/p>\n\n Detection measures will be aimed at uncovering the presence of a cyber incident.<\/p>\n\n Response measures will be managed in a timely manner and will be aimed at restoring information and services that may have been affected by a security incident.<\/p>\n\n The information system shall ensure the preservation of data and information in electronic format.<\/p>\n\n Likewise, the system will keep services available throughout the lifecycle of the digital information, through a design and procedures that serve as the foundation for the preservation of digital heritage.<\/p>\n\n CSC<\/strong> will maintain continuity plans enabling the recovery of essential activities (monitoring, handling of critical incidents, restoration of minimum services) within appropriate timeframes, proportional to the criticality of the service.<\/p>\n\n Furthermore, it has contingency plans in place that enable the recovery of activities\u2014at least to a minimum level\u2014within a reasonable timeframe. Service continuity management will therefore include various controls for identifying and mitigating risks, as well as a procedure to limit their adverse consequences and ensure the resumption of essential activities in the shortest possible time. <\/p>\n\n The service continuity strategy is documented, based on identified risks and defined controls; these will be regularly reviewed and updated to verify their suitability.<\/p>\n\n CSC<\/strong> will foster continuous improvement by applying criteria and methodologies from international standards such as ISO 27001.<\/p>\n\n When CSC<\/strong> provides services to other organizations or handles third-party information, it shall adhere to this Policy, and reporting and coordination channels between Security Committees, as well as incident response procedures, shall be established.<\/p>\n\n When CSC<\/strong> uses third-party services or discloses information, the third party shall be subject to the obligations of this Policy and applicable security regulations. Contracts will require security, confidentiality, and audit rights clauses commensurate with the risk. <\/p>\n\n It will be ensured that third-party personnel possess a level of awareness and training equivalent to that required by CSC<\/strong> for tasks affecting sensitive assets or data. If any requirement cannot be met by the third party, the Security Manager will issue a report detailing the risks and necessary compensating measures; this report must be approved by the relevant Information and Service Owners before proceeding. <\/p>\n\n CSC<\/strong> complies with applicable data protection regulations (GDPR and LOPDGDD) and has established a privacy governance framework that includes policies, procedures, and technical and organizational measures proportionate to the risks arising from the processing of personal data captured by security systems (images, identifiers, location data, etc.).<\/p>\n\n CSC<\/strong> will ensure, among other actions:<\/p>\n\n CSC<\/strong> will document its privacy framework in specific policies and maintain procedures for managing and continuously reviewing risks associated with the processing of personal data.<\/p>\n\n Date:<\/strong> 4<\/strong> February<\/strong> February<\/strong> , 2026<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":" 1. Introduction Catalana de Seguretat i Comunicacions, S.L. (hereinafter CSC) is a technology-based company headquartered in Sant Feliu de Llobregat (Barcelona) with over twenty-five years of experience in the design, installation, and maintenance of fire protection, security, and communications systems. Through its central region branch, which operates under the In Genis brand, it extends its…<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"class_list":["post-4004","page","type-page","status-publish","hentry"],"taxonomy_info":[],"featured_image_src_large":false,"author_info":{"display_name":"ingenis_admin","author_link":"https:\/\/in-genis.es\/en\/author\/ingenis_admin\/"},"comment_info":0,"_links":{"self":[{"href":"https:\/\/in-genis.es\/en\/wp-json\/wp\/v2\/pages\/4004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/in-genis.es\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/in-genis.es\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/in-genis.es\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/in-genis.es\/en\/wp-json\/wp\/v2\/comments?post=4004"}],"version-history":[{"count":2,"href":"https:\/\/in-genis.es\/en\/wp-json\/wp\/v2\/pages\/4004\/revisions"}],"predecessor-version":[{"id":4007,"href":"https:\/\/in-genis.es\/en\/wp-json\/wp\/v2\/pages\/4004\/revisions\/4007"}],"wp:attachment":[{"href":"https:\/\/in-genis.es\/en\/wp-json\/wp\/v2\/media?parent=4004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}2. The organization’s mission<\/h2>\n\n
\n
\n
3. Scope<\/h2>\n\n
\n
\n
4. The regulatory framework within which the activities will take place<\/h2>\n\n
5. Compliance with safety requirements<\/h2>\n\n
\n
6. Governance Model<\/h2>\n\n
\n
6.1 Security roles or functions<\/h3>\n\n
\n
\n
\n
\n
\n
\n
\n
6.2 Appointment and renewal procedures<\/h3>\n\n
6.3 Conflict resolution<\/h3>\n\n
7. Development of the Information Security Policy<\/h2>\n\n
7.1 Organization and implementation of the security process<\/h3>\n\n
7.2 Risk analysis and management<\/h3>\n\n
\n
7.3 Personnel management<\/h3>\n\n
7.4 Professionalism<\/h3>\n\n
7.5 Access authorization and control<\/h3>\n\n
\n
7.6 Protection of installations<\/h3>\n\n
\n
7.7 Procurement of security products and contracting of security services<\/h3>\n\n
7.8 Least privilege<\/h3>\n\n
\n
7.9 System integrity and updating<\/h3>\n\n
7.10 Protection of information at rest and in transit<\/h3>\n\n
7.11 Prevention regarding other interconnected information systems<\/h3>\n\n
7.12 Activity logging and malicious code detection<\/h3>\n\n
7.13 Security incidents<\/h3>\n\n
\n
7.14 Business continuity<\/h3>\n\n
8. Third Parties<\/h2>\n\n
9. Risks arising from the processing of personal data<\/h2>\n\n
\n