INFORMATION SECURITY POLICY
Introduction and Scope
This policy applies to all professionals of GESTART ASSESSORS SL (hereinafter referred to as “GES-START”).
GES-START recognizes that information and the systems managing it are strategic and essential assets for the proper development of its professional activity. These assets include technological infrastructure, storage media, software, documentation, and external services that support the company’s operations. Their proper protection is essential to ensure operational continuity, internal efficiency, and the trust of clients, partners, and other stakeholders in the provision of GES-START’s accounting, tax, and labor advisory services.
This Information Security Policy sets out guidelines for the proper management, use, and safeguarding of these assets, with the aim of minimizing risks and ensuring regulatory compliance.
Framework and Principles
The Information Security Policy establishes a working framework to protect information and the systems that manage it, preventing unauthorized access, misuse, improper disclosure, interruption, modification, or destruction. It also reflects the company’s commitment to information protection and compliance with applicable regulations.
All guidelines included in this policy form part of the Information Security Management System (ISMS), which GES-START maintains, reviews, and updates at least once a year. This system is designed to comply with the ISO 27001 standard and to guarantee the fundamental principles of confidentiality, integrity, and availability.
Furthermore, this Policy is published on the Intranet and forms part of the mandatory onboarding training that all professionals must complete during their integration process.
GES-START’s Commitment
To ensure compliance with this policy, GES-START commits to:
- Implementing and continuously improving the ISMS in accordance with ISO 27001 and applicable regulations.
- Ensuring that all professionals understand and apply information security policies, protecting the company’s data.
- Ensuring that collaborators and suppliers who access or manage information comply with the established security requirements and are informed of the necessary guidelines.
- Clearly defining the roles and responsibilities of the individuals or teams responsible for implementing and maintaining security measures.
- Applying appropriate security controls to protect information against risks and incidents, in accordance with business needs and regulatory requirements.
Responsibilities and Control
GES-START professionals must comply with security policies, protect information assets, and immediately report any incidents. The Security Officer and the Security Committee oversee the ISMS, ensure its effectiveness, and review the policy at least once a year, ensuring its proper dissemination throughout the organization.
Security Controls
GES-START applies technical and organizational measures in areas such as access control, information classification, physical and logical security, vulnerability management, backups, business continuity, and internal training, among other controls, in line with industry best practices.
Communication and Contact
For any additional information regarding our Information Security Policy or to share suggestions, please contact us at: compliance@rcd.legal.
