The protection of information and of the systems that process it is of strategic importance for the Organisation in achieving its short- and long-term objectives, while at the same time safeguarding the confidentiality of the data of the clients who receive its services. Recognising the critical importance of information, information systems and cloud infrastructure in carrying out its operations, KEDIVIM implements an Information Security Policy aimed at:

  • ensuring the confidentiality, integrity and availability of the information it manages
  • ensuring the proper operation of information systems and cloud services
  • responding promptly to incidents that may jeopardise the Organisation’s operations
  • meeting legislative and regulatory requirements
  • continuously improving the level of Information Security.

To this end:

  • the organisational structures needed to monitor Information Security matters are defined
  • the technical measures for controlling and restricting access to information, information systems and cloud infrastructure are defined
  • the method of classifying information according to its importance and value is specified
  • the actions required to protect information during processing, storage and transfer, both on local systems and in the cloud, are described
  • the ways of informing and training the Organisation’s employees and partners on Information Security matters are specified
  • the ways of handling Information Security incidents are specified
  • the ways of ensuring the secure continuity of the Organisation’s operations in the event of information system failures or disasters, including cloud infrastructure, are described.

The Organisation carries out assessments of the risks related to Information Security at regular intervals and takes the necessary measures to address them. It applies a framework for evaluating the effectiveness of Information Security procedures, through which performance indicators are defined, their measurement methodology is described and periodic reports are produced, which are reviewed by the Administration with a view to the continuous improvement of the system. The Information Security Officer is responsible for checking and monitoring the policies and procedures related to Information Security and for taking the necessary initiatives to eliminate all factors that may jeopardise the availability, integrity and confidentiality of the Organisation’s information. All employees of the Organisation and its partners with access to the Organisation’s information and information systems are responsible for complying with the rules of the Information Security Policy in force. KEDIVIM is committed to the uninterrupted monitoring of and compliance with the regulatory and legislative framework and to the continuous implementation and improvement of the effectiveness of its Information Security Management System.