Information security policy

Abridged version for web publication

Document code	PO-001
Revision	2.0
Approval date	21/07/2026
Last updated	21/07/2026
Classification	Public use

1. Introduction

The Management of EVENBYTES S.L. recognises that the information system supporting the delivery of its activities is a fundamental asset.

Given the impact this system has on the development and delivery of services, EVENBYTES maintains a firm commitment to protecting its most significant assets. This commitment forms part of a strategy focused on business continuity, risk management and the strengthening of a robust information security culture.

Customer satisfaction and the confidentiality of information are the cornerstone of our policy.

Comprehensive Security Framework

EVENBYTES has established the implementation, operation and maintenance of a Comprehensive Security Framework, aligned with the requirements of UNE-ISO/IEC 27001:2023, the Esquema Nacional de Seguridad (ENS — Spanish National Security Framework) under Royal Decree 311/2022, and the NIS2 Directive, ensuring risk management, resilience and service continuity.

This framework is based on the following key principles:

Risk-based approach: systematic and proactive management of threats and vulnerabilities, ensuring defence in depth against cyber threats.
Regulatory compliance: conformity with ISO 27001, the ENS and NIS2, as well as with applicable legal and regulatory requirements.
Continuous cybersecurity improvement: organisational resilience through ongoing monitoring, auditing and updating of security controls.
Strengthening supply chain security: third parties are required to comply with equivalent security standards.

2. Scope

The organisation establishes this Information Security Policy for the information systems and essential services of EVENBYTES that fall within the scope of ISO 27001, the Esquema Nacional de Seguridad (ENS) and the NIS2 Directive.

The information systems supporting the following services/activities:

Development, implementation, installation, maintenance and support of apps, IT systems and proprietary products contracted by private companies, Public Administrations and public bodies
Cloud software development
Data projects (Data Engineering, Business Intelligence and Artificial Intelligence)
Document management
Digital transformation
Process optimisation
ORIGAMEE, Metadrive, Drivewatcher
Google licence reselling

The scope of this policy applies to all EVENBYTES information systems, processes and activities supporting the above services, without any limitation. It also extends to all employees and interested parties, who must comply with information security principles, operating procedures and applicable legal and regulatory requirements.

3. Regulatory Framework

EVENBYTES undertakes to comply with all regulations applicable to its activity, including general and specific legislation on information security, cybersecurity and data protection.

National Regulations

Real Decreto 311/2022, of 3 May: regulates the Esquema Nacional de Seguridad (ENS).
Ley Orgánica 3/2018, of 5 December: Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
Real Decreto-ley 12/2018, of 7 September: Security of network and information systems.
Real Decreto 43/2021, of 26 January: Cybersecurity measures and incident notification obligations.
CCN-STIC Guides (800 Series): recommendations of the Centro Criptológico Nacional (National Cryptologic Centre) for implementing the ENS.

European Regulations

Directive (EU) 2022/2555 (NIS2): security requirements for operators of essential services and companies in strategic sectors.
Regulation (EU) 2016/679 (GDPR): protection of personal data in the European Union.
Regulation (EU) 2019/881 (Cybersecurity Act): framework for the cybersecurity certification of ICT.
Regulation (EU) 2690/2024: implementing provisions of the NIS2 Directive regarding cybersecurity risk management.

4. Roles: Functions and Responsibilities

4.1. Information Owner

The Information Owner is responsible for establishing the security requirements for the information processed in the organisation’s systems, ensuring its proper classification, protection and regulatory compliance.

4.2. Service Owner

The Service Owner defines and oversees the security requirements of the services provided, ensuring their resilience and alignment with the ENS and NIS2.

4.3. Security Officer / ISMS

The Security Officer ensures the application of the security measures set out both in Normative Annex A (UNE-ISO/IEC 27002:2023) and in Annex II of the ENS, overseeing their implementation and ensuring alignment with NIS2. They manage the Incident and Risk Register, coordinate the response to cyber incidents and notify serious incidents to CCN-CERT or INCIBE within a maximum of 24 hours of their detection.

4.4. System Owner

The System Owner is responsible for managing and overseeing the life cycle of the information system, ensuring its alignment with the security measures of ISO 27001, the ENS (RD 311/2022) and the NIS2 Directive. Critical updates will be implemented within a maximum of 30 days of their release.

5. Vulnerability Management

EVENBYTES will establish a continuous process for detecting, analysing and managing vulnerabilities in its information systems, using tools such as SonarQube, Jenkins and Nessus, together with penetration testing based on recognised standards (OWASP, MITRE ATT&CK). Reviews will be carried out quarterly.

Remediation deadlines

Severity	Maximum remediation time	Internal notification
Critical	30 days	24 hours
High	60 days	48 hours
Medium / low	90 days	—

In the event of critical vulnerabilities that could compromise the organisation’s security, EVENBYTES will notify the competent authorities (CCN-CERT or INCIBE) in accordance with the NIS2 Directive and RD 311/2022.

6. Personal Data

EVENBYTES processes personal data and maintains a record of processing activities, accessible only to authorised persons. This record sets out the processing operations carried out, the data concerned and those responsible for managing them.

All EVENBYTES information systems will comply with the security levels required by current legislation to guarantee the confidentiality, integrity and availability of personal data, in accordance with the GDPR, the LOPDGDD and the measures established in the ENS.

EVENBYTES has a Data Protection Officer (DPO), whose role is to ensure compliance with personal data protection legislation. The DPO acts as the point of contact with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD).

7. Staff Obligations

All EVENBYTES employees are required to be familiar with and comply with this Information Security Policy. An ongoing information security awareness programme will be established for all members of EVENBYTES, with particular attention to new employees.

Staff whose duties involve the use, operation or administration of ICT systems within the scope of the ENS must receive specific security training before taking on their responsibilities.

8. Third Parties

Third parties that access EVENBYTES systems or manage the organisation’s information must comply with security requirements equivalent to those established in the ENS and the NIS2 Directive. To this end, they must:

Sign confidentiality and information protection agreements, guaranteeing compliance with applicable regulations.
Apply security measures aligned with ISO 27001, the ENS and NIS2, including appropriate technical, organisational and risk management controls.
Undergo periodic audits where applicable, to verify their alignment with the required security measures.

9. Revision History

This Policy will be reviewed at least once a year, or whenever regulatory, technological or strategic changes occur that affect information security.

Revision	Date	Reason for change
1.0	17/09/2025	Document created
2.0	21/07/2026	Document updated and approved

Management ensures that the Information Security Policy is understood, implemented and kept up to date at all levels of the Organisation.

Santander, 21 July 2026

Signed: Jacinto Antonio Pelayo · CEO · Evenbytes S.L.