( legal )

SECURITY POLICY.

POL.ORG.01 Information Security Policy · Madrid, 30 September 2026 · cybersec@clouddistrict.com

1. Approval and entry into force

This Information Security Policy is effective from the date of signature until it is replaced by a new Policy. Approval of this version of the policy supersedes any previous version.

2. Mission of the organisation

At Cloud District, our mission is to drive the digital transformation of companies and organisations through the design and development of innovative, sustainable digital products with real impact, combining technology, data, artificial intelligence and a deeply humanistic culture.

In order to achieve its objectives, Cloud District undertakes its commitment to information security by committing to its proper management, so as to offer all its stakeholders the highest guarantees regarding the security of the information used.

These systems must be managed with due diligence, taking appropriate measures to protect them against accidental or deliberate damage that may affect the availability, integrity or confidentiality of the information processed or the services provided.

The objective of information security is to guarantee the quality of information and the continued provision of services, acting preventively, monitoring day-to-day activity and reacting promptly to incidents.

ICT systems must be protected against rapidly evolving threats with the potential to affect the confidentiality, integrity, availability, intended use and value of information and services. Defending against these threats requires a strategy that adapts to changing environmental conditions in order to guarantee the continuous provision of services. This means that the areas must apply the minimum security measures required by the Spanish National Security Framework (Esquema Nacional de Seguridad, ENS), continuously monitor service delivery levels, track and analyse reported vulnerabilities, and prepare an effective response to incidents to guarantee the continuity of the services provided.

The different areas must ensure that ICT security is an integral part of every stage of the system life cycle, from its conception to its decommissioning, including development or acquisition decisions and operational activities. Security requirements and funding needs must be identified and included in planning, in requests for proposals and in tender specifications for ICT projects.

The areas must be prepared to prevent, detect, respond to and recover from incidents, in accordance with Article 8 of the ENS (Article 8. Prevention, detection, response and preservation).

3. Scope

This policy applies to all ICT systems of the entity and to all members of the organisation involved in Services and Projects for the public sector that require the application of the ENS, without exception.

4. Objectives

In view of the above, Management sets the following information security objectives:

Provide a framework to increase resilience in order to deliver an effective response.
Ensure the rapid and efficient recovery of services in the event of any physical disaster or contingency that may occur and put the continuity of operations at risk.
Prevent information security incidents to the extent that is technically and economically feasible, and mitigate the information security risks arising from our activities.
Guarantee the confidentiality, integrity, availability, authenticity and traceability of information.

5. Regulatory framework

One of the objectives must be to comply with the applicable legal requirements and with any other requirements to which we subscribe, in addition to the commitments made to customers, and to keep them continuously up to date. To this end, the legal and regulatory framework within which we carry out our activities is:

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
Royal Legislative Decree 1/1996, of 12 April, approving the Intellectual Property Law.
Law 2/2019, of 1 March, amending the consolidated text of the Intellectual Property Law, approved by Royal Legislative Decree 1/1996, of 12 April, and transposing into Spanish law Directive 2014/26/EU of the European Parliament and of the Council of 26 February 2014 and Directive (EU) 2017/1564 of the European Parliament and of the Council of 13 September 2017.
Royal Decree 311/2022, of 3 May, regulating the National Security Framework (ENS).
Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI).
Law 39/2015, of 1 October, on the Common Administrative Procedure of Public Administrations.
Law 40/2015, of 1 October, on the Legal Regime of the Public Sector.
Resolution of 7 October 2016 of the Secretariat of State for Public Administrations, approving the Technical Security Instruction on the Security Status Report.
Resolution of 13 October 2016 of the Secretariat of State for Public Administrations, approving the Technical Security Instruction on Conformity with the National Security Framework.
Resolution of 27 March 2018 of the Secretariat of State for the Civil Service, approving the Technical Security Instruction on Information Systems Security Audits.
Resolution of 13 April 2018 of the Secretariat of State for the Civil Service, approving the Technical Security Instruction on Security Incident Notification.
Law 10/2021, on Remote Working.
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). The responsible use of AI at Cloud District is governed by POL.ORG.02 Responsible AI Use Policy.
Royal Decree 729/2023, of 22 August, establishing the Spanish Agency for the Supervision of Artificial Intelligence (AESIA).

6. Implementation

To achieve these objectives it is necessary to:

Continuously improve our information security system.
Identify potential threats, as well as the impact on business operations that such threats could cause should they materialise.
Safeguard the interests of its main stakeholders (customers, shareholders, employees and suppliers), its reputation, its brand and its value-creating activities.
Work together with our suppliers and subcontractors to improve the delivery of IT services, service continuity and information security, resulting in greater efficiency in our activity.
Assess and guarantee the technical competence of staff and ensure their appropriate motivation to take part in the continuous improvement of our processes, providing suitable training and internal communication so that they develop the good practices defined in the system.
Guarantee the proper condition of the facilities and suitable equipment, in line with the company's activity, objectives and goals.
Guarantee the continuous analysis of all relevant processes, establishing the appropriate improvements in each case, based on the results obtained and the objectives set.
Structure our management system so that it is easy to understand.

Management of our system is entrusted to the Security Officer, and the system will be available in our information system in a repository, which can be accessed according to the access profiles granted under our current access management procedure.

Documentation relating to system security is held in the «SGSI Cloud District» shared drive in Google Drive, structured by framework (ENS, ISO/IEC 27001, GDPR and AI Governance) and, within each framework, by measure or clause, with access restricted to the company's authorised staff.

Security documentation is structured as follows:

Security Policy.
Security regulations: documents describing the use of equipment, services and facilities. They describe what is considered misuse, staff responsibility with regard to compliance with or breach of the regulations, rights, duties and disciplinary measures in accordance with current legislation.
Specific documents: security documentation developed in accordance with the applicable CCN-STIC guides.
Security procedures: documents detailing how to operate the elements of the system.

This policy is complemented by the other policies, procedures and documents in force to develop our management system.

7. Security organisation

Ultimate responsibility lies with the organisation's General Management, as it is responsible for organising functions and responsibilities and for providing adequate resources to achieve the objectives of the ENS. Managers are also responsible for setting a good example by following the established security rules.

These principles are embraced by Management, which provides the necessary means and gives its employees sufficient resources to comply with them, setting them out and making them public through this Policy.

The defined security roles or functions are:

RoleDuties and responsibilities

Information Owner (RINFO)Take decisions regarding the information processed

Service Owner (RSER)Take decisions regarding the servicesCoordinate the implementation of the systemContinuously improve the system

Security Officer (RSEG or CISO)Determine the suitability of technical measuresProvide the best technology for the service

System Manager (RSIS)Administer the systemsContinuously improve the system

ManagementProvide the resources needed for the systemLead the system

Security Administrator (AS)Implementation, management and maintenance of security measures.

This definition of duties and responsibilities is completed in the job profiles and in ACT.ORG.03 Appointment of Security Roles and REG.ORG.01 Areas and Roles.

CONFLICT RESOLUTION

Differences of opinion that could lead to a conflict shall be dealt with within the Security Committee, and the decision of General Management shall prevail in all cases.

8. Security Committee

Its members shall be appointed and renewed by ratification in the Security Committee.

The committee for the management and coordination of security is the body with the greatest responsibility within the information security management system, so that all the most important security-related decisions are agreed by this committee.

The members of the Information Security Committee are:

SECURITY OFFICER
SYSTEM MANAGER
SERVICE OWNER
INFORMATION OWNER
COMPANY MANAGEMENT The Security Committee shall be made up of the holders of the positions and roles indicated in this policy. Membership of the Committee shall be acquired and lost automatically upon acquiring or losing the corresponding position. Additional members shall be appointed and removed by Management, on a proposal from the Chair of the Committee.

The Security Committee is an autonomous, executive body with independent decision-making powers and does not have to subordinate its activity to any other part of our company.

The composition of the Committee and the appointment of the responsible roles are set out in ACT.ORG.01 Security Committee Constitution Minutes and ACT.ORG.03 Appointment of Security Roles.

This policy is complemented by the other policies, procedures and documents in force to develop our management system.

9. Risk Management

All systems subject to this Policy shall undergo a risk analysis, assessing the threats and risks to which they are exposed. This analysis is reviewed regularly:

at least once a year;
when the information handled changes;
when the services provided change;
when a serious security incident occurs;
when serious vulnerabilities are reported.

To harmonise risk analyses, the Security Committee shall establish a reference valuation for the different types of information handled and the different services provided. The Security Committee shall promote the availability of resources to meet the security needs of the different systems, encouraging cross-cutting investments.

Risk analyses shall follow the risk analysis methodology set out in PRO.PL.01 Risk Analysis Procedure.

10. Personnel Management

All members of Cloud District are required to know and comply with this Information Security Policy and the Security Regulations, which are signed during the onboarding process, the Security Committee being responsible for providing the means necessary for the information to reach those concerned.

All members of Cloud District shall attend an ICT security awareness session at least once a year. A continuous awareness programme shall be established for all members of Cloud District, in particular new joiners.

Persons with responsibilities for the use, operation or administration of ICT systems shall receive training in the secure handling of systems to the extent they need it to perform their work. Training shall be mandatory before taking on a responsibility, whether it is their first assignment or a change of job or of responsibilities within it.

11. Professionalism and human resources security

This Policy applies to all Cloud District staff and to external personnel performing tasks within the company.

People (human resources area) shall include information security duties in employees' job descriptions, inform all staff it hires of their obligations regarding compliance with the Information Security Policy, manage Confidentiality Agreements with staff and coordinate user training activities with respect to this Policy.

The Security Officer (RSEG) is responsible for monitoring, documenting and analysing reported security incidents, and for reporting them to the Information Security Committee and to information owners.

The Information Security Committee shall be responsible for implementing the means and channels necessary for the Security Officer (RSEG) to handle reports of incidents and system anomalies. The Committee shall also keep informed, oversee the investigation, monitor the progress of information and promote the resolution of information security incidents.

The Security Officer (RSEG) shall take part in preparing the Confidentiality Agreement to be signed by employees and third parties performing duties at Cloud District, in advising on the sanctions to be applied for non-compliance with this Policy and in handling information security incidents.

All Cloud District staff are responsible for reporting information security weaknesses and incidents detected in a timely manner.

Human resources professionalism

Determine the competence required of staff to carry out work that affects Information Security.
Ensure that people are competent on the basis of appropriate education, training or experience.
Demonstrate, through the necessary documented information, the competence of staff in Information Security.

The objectives of personnel security controls are:

Reduce the risks of human error, irregularities, misuse of facilities and resources, and unauthorised handling of information.
Explain security responsibilities at the recruitment stage, include them in the agreements to be signed and verify compliance with them while employees perform their tasks.
Ensure that users are aware of information security threats and concerns and are trained to support the organisation's Information Security Policy in the course of their normal duties.
Establish confidentiality agreements with all staff and users outside the information processing facilities.
Establish the tools and mechanisms necessary to encourage the reporting of existing security weaknesses and incidents, in order to minimise their effects and prevent their recurrence.

12. Authorisation and access control to Information Systems

The objectives of access control to information systems are to:

Prevent unauthorised access to information systems, databases and information services.
Implement security in user access through authentication and authorisation techniques.
Control security in the connection between the Cloud District network and other public or private networks.
Review critical events and the activities carried out by users on the systems.
Raise awareness of users' responsibility for the use of passwords and equipment.
Guarantee information security when laptops and personal computers are used for remote work.

13. Protection of facilities

The objectives of this policy regarding the protection of facilities are to:

Prevent unauthorised access, damage and interference to Cloud District's premises, facilities and information.
Protect Cloud District's critical information processing equipment by placing it in protected areas, within a defined security perimeter, with appropriate security measures and access controls. Likewise, provide for its protection while it is being moved and while it is outside the protected areas for maintenance or other reasons.
Control the environmental factors that could impair the proper functioning of the computing equipment that holds Cloud District's information.
Implement measures to protect the information handled by staff in the offices in the normal course of their usual duties.
Provide protection proportionate to the risks identified.

This Policy applies to all physical resources related to Cloud District's information systems: facilities, equipment, cabling, files, storage media, etc.

The Security Officer, together with the Information Owners, as appropriate, shall define the physical and environmental security measures for the protection of critical assets, based on a risk analysis, and shall supervise their implementation. The Security Officer shall also verify compliance with physical and environmental security provisions.

The heads of the different areas shall define the physical access levels of Cloud District staff to the restricted areas under their responsibility. Information Owners shall formally authorise Cloud District employees to work off-site with information about their business when they consider it appropriate.

All Cloud District staff are responsible for complying with the clear screen and clear desk policy, to protect information related to daily work in the offices.

14. Acquisition of products

In addition, information security shall be taken into account in the acquisition and maintenance of information systems, limiting and managing change.

The policy for the development and acquisition of information systems is set out in PRO.EXP.02 Acquisition of New Components.

15. Security by default

Cloud District considers it strategic for the entity that its processes integrate information security as part of their life cycle. Information systems and services must include security by default from their creation to their decommissioning, with security included in development and/or acquisition decisions and in all operational activities, establishing security as an integral, cross-cutting process.

16. System integrity and updating

Cloud District is committed to guaranteeing system integrity through a change management process that controls the updating of physical or logical elements by requiring authorisation prior to their installation in the system. This assessment shall be carried out mainly by systems management, which shall assess the impact on system security before changes are made and shall keep documented control of those changes assessed as significant or as having implications for system security.

Periodic security reviews shall assess the security status of the systems in relation to manufacturers' specifications and the vulnerabilities and updates that affect them, reacting diligently to manage risk in light of their security status.

17. Protection of information stored and in transit

Cloud District establishes protection measures for the security of information stored or in transit through insecure environments. Laptops, personal digital assistants (PDAs), tablets, peripheral devices, information media and communications over open networks or with weak encryption shall be considered insecure environments.

18. Prevention of interconnected information systems

Cloud District establishes information security protection measures, especially to protect the perimeter, in particular if it connects to public networks, especially those used wholly or mainly for the provision of publicly available electronic communications services.

In all cases, the risks arising from the interconnection of the system with other systems through networks shall be analysed, and its point of connection shall be controlled.

19. Activity logs

Cloud District shall log user activities, retaining the information necessary to monitor, analyse, investigate and document improper or unauthorised activities, making it possible to identify the person acting at any time.

The main objectives of Incident management are to:

Establish a system for detecting and responding to malicious code.
Have procedures for managing security incidents and weaknesses detected in the elements of the information system.These procedures shall cover detection mechanisms, classification criteria, analysis and resolution procedures, as well as the channels for communication to stakeholders and the recording of actions taken.This record is used for the continuous improvement of system security.
Ensure that IT services return to optimal performance.
Reduce the potential risks and impacts the incident may cause.
Safeguard the integrity of the systems in the event of a security incident.
Communicate the impact of an incident as soon as it is detected in order to raise the alarm, and implement an appropriate business communication plan.
Promote business efficiency.

20. Business continuity

In order to guarantee the continuity of its activities, Cloud District establishes measures so that systems have backups and establishes the mechanisms necessary to guarantee the continuity of operations in the event of loss of the usual means of work.

21. Continuous improvement of the security process

Cloud District establishes a process for the continuous improvement of information security, applying the criteria and methodology established in both national standards (National Security Framework, medium level) and international standards (ISO 27001).