Information Security Policy

1. Introduction

CEDESA's journey as an entity began in 2012 as a software project management consultancy that externally coordinated the work of development teams in order to ensure the successful delivery of systems. Subsequently, in 2015, the company CEDESA DIGITAL SL was incorporated, at which point the team began to grow in order to launch a new line of services with an in-house team. From that moment on, CEDESA began to position itself in the field of the digital transformation of the agri-food sector and connected industry. Since CEDESA's beginnings as a company, our organisation has focused on high-performance software development, directing a significant part of our activity towards the agricultural, livestock and food industry. This is a sector in which computerisation and digitalisation still have a long way to go.

The company's promoter, founder and sole shareholder is Juan Jesús Merino Carretero, a young entrepreneur aged 37. He is a Higher Engineer in Computer Science (Ingeniero Superior en Informática) and holds a qualification in IT law. He has extensive experience as a project engineer and IT security engineer. He worked for three years as a research support technician at the University of Extremadura, specifically in the Neural Networks and Signal Processing Group, where algorithms and data structures were developed that were later presented in work with the NASA space agency and the European Space Agency (ESA). He then worked as a secondary school teacher for the Junta de Extremadura (regional government). In 2012 he combined his work as a teacher with consultancy and technical advisory work on software projects. Finally, in 2014 he decided to focus exclusively on his role as a business owner, leaving teaching for good. In 2015 he founded CEDESA DIGITAL, and from the outset he has focused its activity on high-performance software development.

The code of ethics currently upheld at CEDESA DIGITAL is based on, and aligned with, the code of ethics approved by the ACM (Association for Computing Machinery) and the IEEE-CS as the standard for the teaching and practice of software engineering.

Computing, and software development in particular, is one of the fundamental pillars of our society and is involved in a significant part of the lives of all citizens. It is software engineers who contribute to this, directly or indirectly, through design, development, certification, maintenance or testing.

Because of the role they play in the development of systems, they have ample opportunity to do good or cause harm, or to influence these aspects in some way. Generally speaking, they work with confidential information and have access to a very large volume of data, which calls for a high level of commitment and confidentiality. To safeguard the use made of both the information and the access to different systems, CEDESA needs to have a code of ethics aligned with these situations.

Our code of ethics is therefore based on 8 principles:

1. Public: software engineers shall act consistently with the public interest.
2. Client and employer: software engineers shall act in a manner that serves the best interests of their clients and employers, consistent with the public interest.
3. Product: software engineers shall ensure that their products and the corresponding modifications meet the highest possible standards.
4. Judgment: software engineers shall maintain integrity and independence in their professional judgment.
5. Management: software engineering managers and leaders shall promote and subscribe to an ethical approach to the management of software development and maintenance.
6. Profession: software engineers shall advance the integrity and reputation of the profession, consistent with the public interest.
7. Colleagues: software engineers shall be fair to and supportive of their colleagues.
8. Self: software engineers shall participate in continuous learning regarding the practice of their profession and shall promote an ethical approach to the practice of the profession.

2. Objectives

• ▸To respond to the needs and expectations of our stakeholders, especially our clients.
• ▸To manage and control the processes involved effectively, together with the analysis and management of existing risks.
• ▸To comply with the applicable legislation on quality and information security that affects the company's assets.
• ▸
  To identify and appropriately protect the assets related to the information of clients, the company and other stakeholders in order to prevent:

  • Their loss or misuse.
  • Financial losses or damage to the company's image.
  • The total or partial stoppage of business processes.
• ▸To adapt to the economic and technological evolution of markets.
• ▸To raise awareness among, train and motivate staff regarding the importance of an integrated Management System and its development and implementation.
• ▸To improve continually.

3. Regulatory framework

The information security regulatory framework within which CEDESA carries out its activity is essentially the following:

• Organic Law 3/2018 of 5 December on the Protection of Personal Data (Ley Orgánica 3/2018).
• Royal Decree 1720/2007 of 21 December approving the Regulation implementing Organic Law 15/1999 on the Protection of Personal Data (Real Decreto 1720/2007).
• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
• Royal Decree 311/2022 of 3 May regulating the National Security Framework (Real Decreto 311/2022, Esquema Nacional de Seguridad, ENS).
• Royal Decree 951/2015 of 23 October amending Royal Decree 3/2010 of 8 January regulating the National Security Framework in the field of e-government (Real Decreto 951/2015).
• Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (Ley 34/2002, LSSI).
• Law 6/2020 of 11 November regulating certain aspects of electronic trust services (Ley 6/2020).
• Royal Legislative Decree 1/1996 of 12 April approving the Consolidated Text of the Intellectual Property Law (Real Decreto Legislativo 1/1996).
• Royal Decree 4/2010 of 8 January regulating the National Interoperability Framework in the field of e-government (Real Decreto 4/2010, ENI).
• CCN-STIC guides 802, 807, 808, 809 and 825 (National Cryptologic Centre, CCN).
• Technical Security Instructions on conformity with the National Security Framework (Resolution of 13 October 2016 of the Secretary of State for Public Administrations) and on the Audit of the Security of Information Systems (Resolution of 27 March 2018 of the Secretary of State for the Civil Service).
• UNE-ISO/IEC 27002:2013 Code of practice for information security management.
• UNE-ISO/IEC 27001:2022 Requirements for information security management systems.
• UNE-EN ISO 9001:2015 Quality management systems.
• Articles 5, 198 and 199 of the Criminal Code (Código Penal).

4. Risk management

CEDESA has defined risk assessment procedure PG14 for the detection, assessment and treatment of risks.

5. Revisions