Information Security Policy

Introduction

Objectives

Establish principles to ensure that the information technology assets of Sofis Solutions (people, processes, information, and technology) are adequately protected.

Justification

Need for a policy that establishes a comprehensive framework to safeguard the organization's information assets and ensure the confidentiality, integrity, and availability of data.

Scope

This policy applies to:

1. All employees, contractors, consultants, temporary staff, interns, and any other type of professional relationship with Sofis Solutions, including third-party personnel.
2. All locations where Sofis Solutions' information technology assets are hosted or used.
3. All information technology assets of Sofis Solutions.
4. Any information not specifically identified as the property of other parties that is transmitted or stored on Sofis Solutions' information technology assets or assets contracted by the company (including files, emails, and instant messaging).
5. All devices connected to Sofis Solutions' networks or used to access its assets.

Audience

All Sofis Solutions staff and other interested parties.

Responsibilities

Roles and Responsibilities

1. The Management of Sofis Solutions holds final responsibility for managing security risks and threats and oversees the strategy, funding, and resources for information security, relying on managers and coordinators.
2. Management has the authority to:
   1. Establish the strategy, governance, and oversight of information security.
   2. Assign management responsibilities for information security.
3. Management is responsible for:
   1. Providing leadership in information security policies, standards, and guidelines.
   2. Identifying and documenting information security controls and monitoring their effectiveness.
   3. Overall management of Sofis Solutions' information security risks and threats.
   4. Providing support and raising awareness on cybersecurity issues.
   5. Managing information security incidents.
   6. Supporting privacy and compliance events under the existing privacy policy framework.
4. Managers, Heads, and Service Coordinators are responsible for managing information security risks and threats within their areas of responsibility.
5. Information and IT asset owners are responsible for:
   1. Assessing, reporting, and escalating information security risks and threats, including those related to availability, confidentiality, and integrity associated with their information and IT assets.
   2. Assessing and managing information security risks and threats related to their service providers.
   3. Supervising access to their IT assets.
   4. Ensuring the management of their information security controls.
   5. Complying with general requirements established or approved by the organization, as well as relevant legal, regulatory, and applicable policies.
6. Sofis Solutions collaborators are responsible for complying with the security policy.
7. Collaborators are responsible for supervising and safeguarding the data and information systems within their defined scope of control and ownership. They are required to comply with policies and standards related to risks and to immediately report any actual or potential information security incident or threat through defined procedures.

Development

Definition of Information Security

Information security refers to the preservation of confidentiality, availability, and integrity of the company's or third-party information.

Guidelines and Requirements

1. An inventory of information and information technology assets must be maintained.
2. Information security risks and threats must be managed throughout the lifecycle of information technology assets.
3. Information technology assets must be secured according to the level of risk they represent and with appropriate mitigation controls.
4. All access to IT assets must be approved based on need and periodically reviewed.
5. Information security events and anomalous activities must be monitored and analyzed in a timely manner.
6. Information security incidents must be managed and mitigated in a timely manner.
7. Business continuity and disaster recovery plans must be developed and tested.
8. Information and IT assets must be managed in accordance with applicable laws, regulations, and contracts.
9. Remote access is restricted to Sofis Solutions' business operation requirements and must include secure configurations and robust encryption methods.
10. The information security policy serves as a framework for a documented and integrated program that includes policies, processes, and procedures related to access, use, protection, and management of logical and physical assets.
11. Under the framework of this policy, information security objectives are periodically established within the ISMS (Information Security Management System), ensuring alignment with legal, regulatory, contractual, business requirements, specific objectives, and the organization's strategy.
12. Security incidents must be reported immediately to Management.
13. Information security performance indicators must be reported to Management at least annually.
14. Information security risk indicators must be reported at least annually to Management and to the Coordinator of the Sustainable Integrated Management System.

Commitment to Continuous Improvement

This Policy establishes a commitment to the continuous improvement of the established Information Security Management System. This includes management based on the PDCA cycle, considering, among other tools: the management of related risks and threats, implementation of controls and reviews, and evaluation of system effectiveness through periodic reviews, internal and external audits, and improvement processes established at Sofis Solutions.

Consequences of Policy Violations

Violations of this policy will be considered grounds for disciplinary measures as generally provided by the applicable jurisdiction's regulations for each employee and specifically in the employment contract and confidentiality agreement.

Exceptions

Any exception to this policy requires formal approval from Management or a duly delegated individual.

Questions and Contact Information

If you have questions or inquiries regarding this information security policy or any content mentioned herein, you may contact us by email at seguridad@sofis.lat

Version: 6

Approval date: 07-07-2025.