INFORMATIONSECURITY ANDPRIVACY POLICY

PUBLIC INFORMATIONPUBLIC

1Normative

AFTER

INFORMATION SECURITY AND PRIVACY POLICY

Control Box
Title:

Information Security and Privacy Policy

Document Type:

Normative

File Name:

PO-Security and Privacy Policy
PublicClassification:

Approved

State:

Security and Privacy Manager

Author:Review and approval
Reviewed by:Approved by:

Security and Privacy Manager
Senior Management

Distribution list
Corporate

NPAW staff and relevant stakeholders

PUBLIC

2

Normative

AFTER

INFORMATION SECURITY AND PRIVACY POLICY

INDEX
1 OBJECT
42 SCOPE
43 DEFINITIONS AND ACRONYMS
44 SPECIFICATIONS
54.1 OBJECTIVES OF THE INFORMATION AND PRIVACY SECURITY POLICY
54.2 RISK MANAGEMENT
64.3 ROLES, RESPONSIBILITIES, AND AUTHORITIES
64.4 FRAMEWORK FOR THE SETTING OF INFORMATION SECURITY AND PRIVACYGOALS
74.5 IMS OBJECTIVES
74.6 ORGANIZATION AND RESPONSIBILITIES
84.7 APPLICATION OF THE POLICY
94.8 TRAINING AND AWARENESS
94.9 AUDIT
94.10 VALIDITY AND UPDATE
95 SANCTIONS
106 RATIFICATION
10PUBLIC

3NormativeAFTERINFORMATION SECURITY AND PRIVACY POLICY

1 OBJECTThis policy is intended to provide the directives or guidelines that must be followed to protect theOrganization's information from a wide range of threats, in order to:●●●●

Guarantee the security of the operations carried out, through the Information Systems.
Guarantee the privacy in the processing of personal data in the operations carried out,through the Information Systems.
Minimize the risks of damage.
Ensure compliance with the objectives of the Organization.

NPAW is willing to ensure that the principles of the Information Security and Privacy Policy form
part of the Organization's culture, for which it has implemented an Information Security andPrivacy Management System based on an internationally recognized standard.
All NPAW personnel, relevant stakeholders, and management must be aware of and comply
with this policy.
This Policy will be developed through regulations, procedures, operating instructions, guides,manuals, and all those organizational instruments considered useful to achieve its objectives.

2 SCOPE
The scope of the Information Security and Privacy Policy coincides with the scope of theIntegrated Management System (IMS).
This document develops the requirements demanded by the ISO/IEC 27001:2022 Standard inits section: 5.2 "Policy", and those corresponding to the ISO/IEC 27701:2019, Information
Privacy Management System.

3 DEFINITIONS AND ACRONYMS
For the purposes of a correct interpretation of this Policy, the following definitions are included:●Information: Data that has meaning, in any format or support. It refers to allcommunication or representation of knowledge.

●Information System: It refers to a set of related and organized resources for thetreatment of information, according to certain procedures, both computer and manual.

PUBLIC

4

NormativeAFTERINFORMATION SECURITY AND PRIVACY POLICY

4 SPECIFICATIONS
4.1 OBJECTIVES OF THE INFORMATION AND PRIVACY SECURITY
POLICYThe main objective of the creation of this Information Security and Privacy Policy, by theSecurity and Privacy Manager of the Integrated Management System (IMS) and NPAW'sManagement, is to guarantee customers and service users access to information with thequality and level of service required for the agreed performance, as well as to avoid serious loss
or alteration of information and unauthorized access to it.
A framework is established for the achievement of the information security and privacy
objectives for the Organization. These objectives will be achieved through a series oforganizational measures and concrete and clearly defined rules.
This Security and Privacy Policy will be maintained, updated, and adequate for the purposes ofthe organization.
The principles that must be respected, based on the basic dimensions of security and privacy,
are the following:●

Confidentiality: Property through which the information managed by NPAW can only beaccessed by whoever is authorized to do so, prior identification, at the time and by themeans enabled.

●Integrity: Property that guarantees the validity, accuracy, and completeness of theinformation managed by NPAW, its content being provided by those affected without any
type of manipulation and allowing it to be modified only by whoever is authorized to doso.

●

Availability: Property of being accessible and usable at agreed intervals. The
information managed by NPAW is accessible and usable by authorized and identifiedclients and users at all times, its own persistence being guaranteed in the face of any
foreseen eventuality.

●Privacy: Property that guarantees the respect and protection of the personal data ofindividuals (data subjects) managed by NPAW, ensuring that they are treated in an
appropriate, lawful and transparent manner.

Additionally, given that any Information Security and Privacy Management System must comply
with current legislation, the following principle will be adhered to:

PUBLIC

5

Normative

AFTER

INFORMATION SECURITY AND PRIVACY POLICY●Legality: Referring to compliance with the laws, rules, regulations, or provisions towhich NPAW is subject, especially in matters of personal data protection.

NPAW, in order to offer its customers greater reliability in its services, and wanting to go beyond
the requirements of data protection regulations, has implemented a privacy management
system, integrating it into the Information Security and Privacy Management System. Thiscommitment is reflected in the involvement of NPAW employees, who are trained andparticipate in the system, and in the requirement of compliance to our service providers.

4.2 RISK MANAGEMENT
Information Security and Privacy management at NPAW is risk-based, in accordance with theinternational standard ISO/IEC 27001:2022 and ISO/IEC 27701:2019.
It is articulated through a general process of assessment and risk treatment, which canpotentially affect the information security and privacy of the services provided, consisting of:●

Identify threats, that will exploit vulnerabilities in the information systems that support,or on which information security and privacy depend.

●

Analyze the risk, based on the consequence of materializing the threat and theprobability of occurrence.

●

Assess the risk, according to a previously established and approved level of broadly
acceptable, tolerable, and unacceptable risk.

●Treat risk unacceptable, through appropriate controls or safeguards.

This process is cyclical and must be carried out periodically, at least once a year. An owner will
be assigned for each identified risk, and multiple responsibilities may fall on the same person orcommittee.

4.3 ROLES, RESPONSIBILITIES, AND AUTHORITIESThe information security and privacy organization is organized around an Integrated
Management System (IMS) and a series of committees and roles involved in its scope.

PUBLIC

6

NormativeAFTERINFORMATION SECURITY AND PRIVACY POLICY

4.4 FRAMEWORK FOR THE SETTING OF INFORMATION SECURITY
AND PRIVACY GOALSThe setting of information security and privacy objectives is carried out taking into account thefollowing inputs:●

Reports from the Integrated Management System Security and Privacy Officer, approved
by NPAW Management.

●

Opportunities for improvement found during the operation of the IMS.

●

Contributions of the Data Protection Officer (DPO), who supervises and advises oncompliance with data protection and privacy regulations, as well as on the identificationand mitigation of risks associated with the processing of personal data.

●

Contributions from the Processing Owners (PTs), who in the different areas supervise
the performance of personal data processing in accordance with the established rules.

When setting objectives, it must be taken into account that they must be measurable andachievable, hence the planning for their achievement must include:●

What is going to be done●

The necessary resources●

Who will be responsible●

The deadline for its achievement●

How the results will be evaluated●If applicable, the indicator associated with said objective

The Management, together with the Security and Privacy Manager of the Integrated
Management System, will be responsible for defining the information security and privacyobjectives for NPAW. These must be specific and consistent with its Information Security andPrivacy Policy, mission, vision, and values.

4.5 IMS OBJECTIVESThe NPAW IMS must guarantee:●

That policies, regulations, procedures, and operational guides be developed to support
the information security and privacy policy.

PUBLIC

7

Normative

AFTER

INFORMATION SECURITY AND PRIVACY POLICY●Identify the information that must be protected.

●

That risk management be established and maintained in line with the requirements of
the IMS policy and the NPAW strategy.

●That a methodology be established for the assessment and treatment of risk.

●

That criteria be established with which to measure the level of compliance with the IMS.

●

That the level of compliance of the IMS be reviewed.

●

That non-conformities are corrected through the implementation of corrective actions.

●That personnel receive training and awareness on information security and dataprotection.

●

That all personnel be informed about the obligation to comply with the information
security and privacy policy.

●

The allocation of the necessary resources to manage the IMS.

●Theidentification

andcompliance with all legal, regulatory, and contractualrequirements.
●

That the security and privacy measures implemented are monitored and periodicallyreviewed to ensure their effectiveness and adaptation to changes in the regulatory,
technological and business environment.

●

That the information security and privacy implications with respect to business
requirements be identified and analyzed.

●

That the degree of maturity of the information security and privacy management systemitself be measured.

●That continuous improvement be carried out on the IMS.

4.6 ORGANIZATION AND RESPONSIBILITIES●The General Directorate of NPAW is responsible for approving this policy.

●

The Information Security and Privacy Management Committee is responsible forreviewing this policy.

●The IMS Security Manager is responsible for maintaining this policy.

●

The Data Protection Officer supervises and advises on compliance with the measures
implemented.

●

The Data Controllers supervise the processing of personal data.

PUBLIC

8

NormativeAFTERINFORMATION SECURITY AND PRIVACY POLICYThis policy must be reviewed regularly along with the rest of the Corporate Policies based onthe agreed review scheme, and whenever relevant changes are made, in order to ensure that it
is aligned with the company's strategy.

4.7 APPLICATION OF THE POLICYNPAW has developed this document that contains the General Policy for Information Securityand Privacy and that has been approved by the General Management and made known to allcompany personnel.

4.8 TRAINING AND AWARENESSThe Security and Privacy Officer of the Integrated Management System must ensure that all
personnel involved in the IMS are aware of this policy, its objectives and processes, through its
dissemination, training and awareness-raising actions. In the case of data protection training, it
shall take into account the requirements of the Data Protection Officer and the Data Controllers.
It must also guarantee the distribution of the documents that apply to each level, according tothe different roles defined in the company.

4.9 AUDIT
The General Directorate of NPAW must guarantee and verify, through internal and externalaudits, the degree of compliance with the guidelines of this Policy and that these are operated
and implemented correctly, taking responsibility for compliance with the corrective measuresthat may have been determined in order to maintain continuous improvement.

4.10 VALIDITY AND UPDATEThis policy is effective from the moment of its publication and is reviewed at least once a year.
The objective of the periodic reviews is to adapt it to the changes in the context of theorganization, with attention to external and internal issues, analyzing the incidents that haveoccurred in information security and the Non-Conformities found in the IMS. All this harmonizedwith the results of the different risk assessment processes.
When reviewing the Policy, all the Standards and other documents that develop it will also bereviewed, following a periodic update process subject to relevant changes that may occur:

PUBLIC

9NormativeAFTERINFORMATION SECURITY AND PRIVACY POLICY
company growth and organizational changes, changes in infrastructure, development of newservices, among others.
As a consequence, a list of objectives and actions to be undertaken and executed during thefollowing year will be drawn up to guarantee Information Security and Privacy and the properuse of the resources that support and process it in NPAW.

5 SANCTIONS
Failure to comply with the Information Security and Privacy Policy and other regulations andprocedures that develop it, will result in the application of sanctions, according to the magnitudeand characteristics of the non-compliance aspect, in accordance with current labor legislation.

6 RATIFICATION
All the undersigned assume and fully accept the contents of this Policy and undertake to apply itin their respective areas in order to achieve the proper functioning of the Integrated
Management System.

Barcelona, November 15, 2023

Digitally signed bySERGISERGI LAENCINALAENCINAVERDAGUER - DNI
VERDAGUER - 33956835A
Date: 2023.11.15
DNI 33956835A 12:37:00 +01'00'

Firmado digitalmente33940740P
por 33940740P SERGISERGI VERGES VERGES (R: B64908460)
Fecha: 2023.11.15(R: B64908460) 11:48:21 +01'00'

Sergi Vergés

Sergi Laencina

Senior Management

The person in charge of IMS

PUBLIC10