SICOMORO SERVICIOS INTEGRALES, S.L. (hereinafter SICOMORO) is a company in the Information and Communications Technology (ICT) sector, dedicated to the commercialization, development, implementation, and maintenance of software solutions, as well as management services and call center operations for ticket sales and access control systems, specifically aimed at cultural and leisure centers, in accordance with the current Statement of Applicability.
Our vision is to provide these services reliably, securely, robustly, flexibly, and profitably, with a management approach that anticipates and adapts to change, learns from experience, and fosters continuous innovation, while fulfilling the needs and expectations of our clients and other relevant stakeholders.
We have defined a set of core values to be shared across the organization, which integrate key aspects of information security management. These values help us foster a corporate culture, a way of working, and a decision-making framework within our company:
- Our specialization and continuous professional development.
- Ensuring that information security and respect for personal data are consistently upheld.
- Preserving the confidentiality of information by preventing disclosure and unauthorized access.
- Maintaining the integrity of information by ensuring its accuracy and preventing its degradation.
- Guaranteeing the availability of information across all media whenever it is needed.
Management places special emphasis on and uses as its primary risk assessment criteria the evaluation of the Confidentiality, Integrity, Availability, Authenticity, and Traceability of information, especially that of our clients.
Accordingly, SICOMORO is committed to developing, implementing, and maintaining its Quality Management System (QMS) and Information Security Management System (ISMS) with the objective of continuous improvement—both in how we deliver our services and in how we manage information from our clients and within our own organization.
It is therefore the policy of SICOMORO to:
- Establish annual objectives relating to Quality and Information Security.
- Comply with business requirements, legal and regulatory obligations, contractual duties, and client-specific requirements.
- Provide training and awareness activities for all personnel regarding Quality and Information Security processes, and to implement the necessary resources to ensure business continuity.
- Promote and commit to continuous improvement.
- Perform ongoing risk and opportunity assessments concerning information assets and processes.
- Define treatment plans and implement controls to mitigate identified risks.
- Assign employee responsibilities regarding:
- Reporting security breaches.
- Preserving the confidentiality, integrity, and availability of information assets in line with this policy.
- Complying with all policies and procedures related to the Quality and Information Security Management Systems.
The Quality and Information Security Manager is directly responsible for maintaining this policy and for providing guidance and advice to ensure its effective implementation.
SICOMORO also carries out continuous evaluation of its suppliers. Failure to meet established supply requirements may result in a supplier being classified as Non-Approved.
Version 6 — June 10, 2019
Signed by Management
SCP