Information Security Policy

1. Objective, scope and user

AP Interactive Solutions S.L. has the mission of providing cloud infrastructure services, technical cybersecurity services (audits, pentesting, vulnerability management, incident response), custom software development and managed services for public and private clients, as well as the operation of its own SaaS platforms.

AP Interactive's objective is to be a benchmark in technical cybersecurity and cloud infrastructure services, meeting the requirements of security standards such as ISO 27001 and the Spanish National Security Framework (ENS), establishing continuous improvement in its Information Security Management System (ISMS) that minimises risks, complies with applicable regulations and reinforces the trust of our clients and strategic partners.

The purpose of this document is therefore to ensure that information — both our own and that of third parties — is protected to an appropriate level. This document applies to the entire scope of the ISMS; that is, to all types of information, regardless of format, whether paper or electronic documents, applications and databases, people's knowledge, etc.

AP Interactive depends on ICT (Information and Communication Technology) systems to achieve its objectives. These systems must be administered diligently, taking appropriate measures to protect them against accidental or deliberate damage that could affect the availability, integrity or confidentiality of the information processed or the services provided.

ICT systems must be protected against rapidly evolving threats with the potential to affect the confidentiality, integrity, availability, intended use and value of information and services. This means the organisation must apply the minimum security measures required by the National Security Framework, continuously monitor service levels, track and analyse reported vulnerabilities, and prepare an effective incident response to guarantee the continuity of the services provided.

General provisions:

Review: this policy will be reviewed and, where appropriate, updated at least annually or following significant changes in the organisation's context or regulatory requirements.
Dissemination: it is communicated to all personnel and relevant interested parties, ensuring its understanding and application.
Approval: signed and approved by management as a sign of its commitment.

2. Regulatory framework

The regulatory basis affecting AP Interactive's activities, as regards information security, is made up of the following legislation:

Royal Decree 311/2022, of 3 May, regulating the National Security Framework (ENS) within electronic administration.
Royal Decree 951/2015, of 23 October, National Interoperability Framework (ENI).
Resolution of 13 April 2018 of the Secretary of State for Public Function, approving the Technical Security Instruction on Notification of Security Incidents.
Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 (General Data Protection Regulation, GDPR).
Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).
Law 11/2020, on urgent measures in the field of cybersecurity.
Law 34/2002, of 11 July, on information society services and electronic commerce.
Royal Legislative Decree 1/1996, of 12 April, approving the consolidated text of the Intellectual Property Law.
Law 40/2015, of 1 October, on the Legal Regime of the Public Sector.
Royal Decree 1553/2005, of 23 December, regulating the national identity document and its electronic signature certificates.
Consolidated text of the Public Sector Contracts Law, approved by Royal Legislative Decree 3/2011, of 14 November, and its implementing regulations.

Maintenance of the regulatory framework is the company's responsibility and will be kept in an annex to this document, including the mandatory technical security instructions issued by the National Cryptologic Centre (CCN). The company is also responsible for identifying the CCN security guides applicable to improve compliance with the National Security Framework.

3. Compliance with ENS articles

To achieve compliance with the articles of Royal Decree 311/2022, AP Interactive has implemented several security measures proportionate to the nature of the information and services to be protected, taking into account the category of the affected systems and the size of the organisation.

Security as an integral process (art. 6) and least privilege (art. 20)

Security is a process made up of all the technical, human, material and organisational elements related to the system. The application of the ENS will be governed by this principle, which excludes any one-off action or circumstantial treatment. Maximum attention will be paid to the awareness of the people involved and their managers, so that neither ignorance, nor a lack of organisation and coordination, nor inadequate instructions become a source of security risk. Systems will be designed to ensure security by default:

The system will provide the minimum functionality required for the organisation to achieve its objectives.
Operation, administration and activity-logging functions will be the minimum necessary, accessible only by authorised people, locations or equipment, with possible time and access-point restrictions.
Unnecessary or inappropriate functions will be removed or disabled through configuration control.
Ordinary use of the system must be simple and secure, so that insecure use requires a conscious act by the user.

Periodic reassessment (art. 10)

The company has implemented regular security controls and assessments (including routine evaluation of configuration changes) to know the security status of systems at all times relative to manufacturer specifications, vulnerabilities and applicable updates, reacting diligently. Before new elements — physical or logical — are introduced, they will require formal authorisation. Periodic review by third parties will also be requested to obtain an independent assessment.

Personnel management (art. 15) and professionalism (art. 16)

All members of AP Interactive within the scope of the ENS will attend a security awareness session at least once a year. A continuous awareness programme will be established, in particular for new joiners. Those responsible for the use, operation or administration of ICT systems will receive training for the secure handling of systems; this training is mandatory before assuming a responsibility. Given the company's size, training will be adapted to each member's specific role, being more intensive in secure development for developers and in risk management for the Security Officer.

Risk-based management (art. 7) and risk analysis and management (art. 14)

All systems affected by this Policy, as well as all personal data processing, must be subject to a risk analysis. This analysis will be repeated:

Regularly, at least once a year.
When the information handled and/or the services provided change significantly.
When a serious security incident occurs or serious vulnerabilities are detected.

The ENS Security Officer is responsible for ensuring the risk analysis is carried out, as well as for identifying gaps and weaknesses and bringing them to the attention of the Information Security Committee.

Security incidents (art. 25); prevention, detection, reaction and retention (art. 8)

AP Interactive has implemented a comprehensive process for detecting, reacting to and recovering from security incidents, through procedures covering detection mechanisms, classification criteria, analysis and resolution procedures, communication channels to interested parties, and the logging of actions, which is used for continuous improvement. When a significant deviation from pre-established normal parameters occurs, the necessary detection, analysis and reporting mechanisms are activated. Reaction measures include:

Mechanisms to respond effectively to security incidents.
A designated point of contact for incident communications.
A protocol for exchanging incident-related information, including communications with CCN-CERT.
Means and techniques to guarantee the recovery of the most critical services.

Lines of defence (art. 9) and protection against interconnected systems (art. 23)

The company has implemented a multi-layered protection strategy (organisational, physical and logical) so that when one layer fails, time is gained for an adequate reaction, the likelihood of the system as a whole being compromised is reduced, and the final impact is minimised. This strategy protects the perimeter, in particular when connecting to public networks; the risks arising from interconnection with other systems will be analysed and the connection point controlled.

Differentiation of responsibilities (art. 11) and organisation of the security process (art. 13)

The company has organised its security by designating different roles with clearly differentiated responsibilities, as set out in the "Security organisation" section.

Authorisation and access control (art. 17)

The company has implemented access control mechanisms for the information system, limiting access to what is strictly necessary and duly authorised.

Protection of facilities (art. 18)

Since AP Interactive operates a 100% remote model, the protection of facilities is adapted to this context through:

Physical access control to personal equipment (disk encryption, automatic locking).
Individual responsibility of each member for the physical security of their workspace.
Secure remote-work policies.
Prohibition of working with sensitive information in insecure public spaces.

Acquisition of security products and contracting of security services (art. 19)

When acquiring products, the company will ensure that such products have certified security functionality related to the purpose of their acquisition, except where proportionality requirements regarding the risks assumed do not justify it.

Protection of stored and in-transit information (art. 22) and business continuity (art. 26)

The company has implemented mechanisms to protect stored or in-transit information, especially in insecure environments (laptops, tablets, storage media, open networks, etc.). Systems will have backups and the mechanisms necessary to guarantee continuity of operations in the event of loss of the usual working means.

Activity logging and malware detection (art. 24)

The company has enabled user activity logs, retaining the information needed to monitor, analyse, investigate and document improper or unauthorised activities, allowing the person acting to be identified at all times, for the exclusive purpose of complying with the ENS, with full guarantees of the right to privacy and in accordance with personal data protection regulations.

4. Information Security Policy principles

This Policy responds to the best-practice recommendations for Information Security set out in the International Standard ISO/IEC 27001 and the National Security Framework, as well as to compliance with applicable personal data protection legislation (GDPR). AP Interactive applies the following principles:

Strategic scope: information security must have the commitment and support of AP Interactive's members, coordinated and integrated with the rest of its strategic initiatives.
Comprehensive security: it will be considered part of normal operations, present throughout the design, development and maintenance of information systems.
Risk management: risk analysis and management will be an essential part of the process, maintaining a controlled environment and minimising risks to acceptable levels.
Proportionality: protection, detection and recovery measures will be proportionate to the potential risks and to the criticality and value of the information and services.
Continuous improvement: security measures will be reassessed and updated periodically to keep their effectiveness aligned with the evolution of risks.
Security by default: systems will be designed and configured to guarantee a sufficient degree of security by default.

Since Information Security concerns the entire company, this Policy must be known, understood and assumed by all its members, as well as by any third party accessing the company's assets.

5. Security organisation

The organisation of Information Security at AP Interactive is established in the internal document «Job description». To ensure compliance with the legally required measures, the following security roles or profiles have been created:

Information Owner: sets the security requirements for information.
Service Owner: sets the security requirements for services.
Security Officer: maintains and verifies the appropriate level of security of the information handled and the electronic services provided.
System Owner: develops, operates and maintains the information system throughout its lifecycle, and prepares the necessary operating procedures.

An Information Security Committee has also been established as a collegiate body that handles Information Security requests, reports regularly on the security status and advises on the matter.

6. Organisational framework

6.1 Human resources security management

Personnel management will be carried out taking into account the security criteria established in this Policy, safeguarding its requirements at all times, including the pre-employment, employment and contract-termination phases.

6.1.1 Training and awareness. AP Interactive will ensure that members receive an appropriate level of Information Security training and awareness, especially in confidentiality and information-leak prevention. Members are obliged to act diligently with respect to information.

6.1.2 Clean desk policy.

Sessions will be locked when leaving the desk, manually or automatically.
Screens will be positioned so they are not visible to unauthorised people, and the workspace will be kept tidy and clear of documents or media accessible by third parties.

6.1.3 Remote work / teleworking. All members work from remote locations, so the following measures are established:

The corporate VPN is used for server management.
Access to other corporate systems (repositories, cloud, etc.) is carried out via secure connections (HTTPS, SSH).
Any external collaborator requiring access must have authorisation from the Security Officer.

The equipment used for remote connection may be owned by the partners, but must meet: A) the ability to connect via VPN; B) an operating system updated with the latest patches; C) antivirus software installed; D) a personal firewall installed. The teleworking service will be monitored and controlled, logging both the connection and the activity. For more detail, the organisation has a Teleworking and Mobile Devices Policy.

6.2 Asset management

The information assets needed to deliver AP Interactive's business processes will be identified and inventoried, keeping the inventory up to date. Assets will be classified according to the type of information handled. Each asset will have an owner responsible for managing it throughout its lifecycle, maintaining a formal record of authorised access, and ensuring it is inventoried, correctly classified and adequately protected.

6.2.1 Management of personal devices. Team members use personal equipment for daily work, and must comply with:

Operating system updated with the latest security patches.
Automatic session lock after 5 minutes of inactivity.
Personal firewall enabled.
Reporting to the Security Officer of any incident affecting the confidentiality, integrity or availability of these devices.

6.2.2 Information lifecycle management. The lifecycle of an information asset consists of the phases of: (1) creation or collection, (2) distribution, (3) use or access, (4) storage and (5) destruction. Retention periods will be based on regulatory, legal and business requirements; when retention is not required, information will be disposed of by means that guarantee its confidentiality during the destruction process.

6.2.3 Backup management.

Backups of applications, files and databases will be made at least weekly, unless no update occurred in that period; frequency may be increased for high-impact information.
Backups will receive the same security protections as the original data, with appropriate access controls.
Wherever possible, backup information will be encrypted; mandatory for certain confidential information.
Periodic, documented restoration tests will be carried out.
A retention period until destruction will be set, storing backups in secure locations with restricted access, preferably at a different site from where they were generated.
An additional write-protected copy of sensitive information will exist, to guarantee its integrity against incidents such as ransomware.

6.3 Information classification

An information classification model is defined to implement the technical and organisational measures needed to maintain availability, confidentiality and integrity. The full detail is in the internal document «Information Classification Policy»; a summary follows.

6.3.1 Types of information. Information is classified according to its medium: logical media (office tools, email or information systems developed in-house or by a third party).

6.3.2 Classification levels:

Public use
Internal use
Confidential
Restricted

6.3.3 Management of privileged information. Confidential or restricted information will be handled with special care, with additional security measures, sent encrypted and via secure protocols.

6.3.4 Information labelling. Documents and materials (including annexes, copies, translations or extracts) will be labelled according to the classification levels, except for "Public use" information. Labelling will reflect the classification scheme, be easily recognisable, and be accompanied by guidance on its placement and on the permitted exceptions.

6.3.5 Information handling. Appropriate procedures will be developed for the correct handling of information according to its classification, keeping privileged information in custody throughout its lifecycle.

6.3.6 Information privacy. AP Interactive is committed to protecting the privacy of: clients' personal data (GDPR), employees' personal data (GDPR) and clients' confidential information (non-disclosure agreements, NDAs). For more detail, see the Privacy Policy.

6.4 Information leak prevention

An information leak is an uncontrolled outflow of information (intentional or not) that causes it to reach unauthorised people or its owner to lose control over access. AP Interactive defines procedures to prevent such situations and to act when a leak is reported. All members receive training on leak prevention, including: handling of high-criticality devices, network monitoring (detection of anomalous transfers), email use, oral transmission of information, use of mobile devices, control of removable devices and Internet use.

6.5 Access control

All of AP Interactive's information systems will have an access control system, focused on securing user access and preventing unauthorised access (including password protection). Access control is understood from a logical perspective. For more detail, the organisation has an internal «Access Control Policy».

6.5.1 Access rights. Only the privileges necessary to perform each function will be granted, based on:

Role-based access control: access profiles per application and/or system assigned to users.
Need to know: access only when there is a legitimate need for the activity.
Least privilege: permissions granted will be the minimum.
Segregation of duties: proper separation of duties when assigning access rights.

6.5.2 Logical access control. A password policy aligned with security best practices will be established, defining password requirements and renewal periods, detailed in the internal document «Acceptable Use Policy», and known by all members.

6.6 Cloud security

AP Interactive will maintain a cloud working policy establishing the appropriate measures for the confidentiality, integrity and availability of information, depending on the service model:

Infrastructure: the provider monitors the environment to detect unauthorised changes; strong authentication and access control for administrators; facilities and configurations logged and connected to guarantee traceability.
Secure configuration: hardening of cloud resources.
Encryption: data in transit and at rest.
Backup and DR: cloud recovery strategies.
Platform: security mechanisms corresponding to the secure software lifecycle (see section 6.9).
Software: the company and provider will follow OWASP as a guide for application security.

6.7 Operational security

All services that process or store the company's information will have appropriate security measures that optimise their maturity level (monitoring, change control, reviews, etc.). Networks will be managed, controlled and monitored appropriately to protect against threats, including network access controls.

6.8 Telecommunications security

The mandatory use of a corporate VPN, firewalls for data filtering, IDS/IPS for intrusion detection and prevention, TLS/SSL encryption for communications and multi-factor authentication (MFA) on critical services is established. Communications will be carried out exclusively over secure networks, with the use of unprotected public networks without a VPN being prohibited. All members will use only authorised channels and report any anomaly immediately.

6.9 Security in the systems development lifecycle

All acquisition, development and maintenance of systems will meet minimum security requirements in line with industry best practices, including test management, change tracking and software inventory. AP Interactive will take information security into account in its selection, development and implementation processes for applications, products and services.

6.10 Supplier security

The criticality of all services that may be outsourced will be assessed to identify those relevant from a security standpoint. Selection processes, contractual requirements (including termination), service-level monitoring, data return and the supplier's security measures — which will be at least equivalent to those in this Policy — will be carefully managed. For more detail, the organisation has an internal «Procurement, Supplier and Third-Party Management Policy».

6.11 Incident management

Members are obliged to identify and notify the Security Officer of any incident or offence that could compromise the security of information assets. An incident response management procedure will be defined, with categorisation, business impact analysis and escalation. For more detail, the organisation has an internal «Incident Management Policy».

6.12 Business continuity

AP Interactive will have a Business Continuity Plan to guarantee the continuity of its essential or critical services in possible crisis scenarios. This Plan will be updated and tested periodically, and complemented by a Disaster Recovery Plan aligned with business continuity. The company will train its employees in Business Continuity, reviewing such training periodically.

6.13 Cryptographic key management

Standards are established to ensure the secure creation, use, storage and destruction of the cryptographic keys that protect confidential information, covering their entire lifecycle. Responsibility for key management lies with the System Owner, who ensures that keys are accessible only to authorised users and systems, including key generation, distribution, storage, use, renewal, revocation and destruction.

6.14 Regulatory compliance of systems

AP Interactive will allocate the resources necessary to comply with all legislation and regulation applicable to its activity in the field of information security, establishing the responsibility for such compliance on all its members.

6.15 Security audits and vulnerability management

Periodic identification of technical vulnerabilities of systems and applications will be carried out, according to their exposure, applying the necessary corrective measures as soon as possible. Identification, management and remediation will follow a risk-based approach, taking into account the criticality and exposure of assets.

6.16 Exception management

Any exception to this Policy must be recorded and reported to the Security Officer. Exceptions will be analysed to assess the risk they could introduce and, based on their categorisation, must be assumed by the requester together with the business owners.

6.17 Disciplinary sanctions

Any violation of this Policy may result in the corresponding disciplinary actions in accordance with AP Interactive's internal process. It is the responsibility of all members to notify the Security Officer of any event or situation that could constitute a breach of the defined guidelines.

Approved on 19 February 2026. Version 01 · Implementation.
Prepared by the Security Officer · Reviewed and approved by Management — AP Interactive Solutions S.L.

Original document available as PDF:download signed PDF.