Apeiroo Labs Cybersecurity

CONTACT

CONTACT

CYBERSECURITY
POLICY

 

APEIROO LABS, S.L. es una empresa de ciberseguridad con más de 25 años de experiencia, cuya misión es prevenir y gestionar los riesgos de las personas y las organizaciones a través de la protección de su activo más importante: la información.

APEIROO LABS, S.L. has established an integrated management system based on:

  • UNE-ISO/IEC 27001:2022 (Information Security)
  • UNE-ISO 9001:2015 (Quality)
  • UNE-ISO 14001:2015 (Gestión ambiental)
  • UNE-ISO/IEC 20000-1:2018 (IT Service Management)
  • National Security Scheme (ENS), in accordance with Royal Decree 311/2022
  • UEC-ISO/IEC 42001:2023 (Sistema de gestión de inteligencia artificial)

Con el objetivo de garantizar la protección de la información, la calidad de los servicios, la gestión ambiental responsable y la mejora continua de sus procesos. The scope of these systems extends to:

  • All of the organization's information and communication technologies (ICT).
  • All employees, collaborators, and third parties.
  • All services and projects provided by the organization.

In particular, the information system supports the processes of:

  • Security assessments, penetration testing, vulnerability analysis, forensic analysis.
  • Auditorías técnicas (código, redes, wifi).
  • Inteligencia y contrainteligencia.
  • Integration, monitoring, and management of security systems.
  • Cybersecurity and regulatory compliance consulting services.

En materia de inteligencia artificial, esta política se aplica al uso profesional de herramientas y servicios de IA proporcionados por terceros en las actividades de APEIROO. Su gestión comprende la selección y autorización de los usos, la protección de la información, la revisión de los resultados y el seguimiento de los riesgos e impactos asociados.

APEIROO LABS, S.L. establishes the following guidelines as its Política del Sistema de Gestión Integrado las siguientes directrices:

  • Provide workers with the skills and knowledge necessary for the proper performance of their duties and promote awareness and training in information security.
  • Mantener compromiso con la mejora continua de los procesos, procedimientos, productos y servicios, y del desempeño ambiental, mediante el uso de indicadores.

  • Use standard procedures, methodologies, and work tools and perform internal audits to ensure their correct utilization.

  • Keep the planning of all projects updated and perform the necessary monitoring and control to serve as a reference framework and ensure the fulfillment of established objectives in time, cost, and quality.

  • Identify and control project risks and implement mitigation or contingency measures.

  • Guarantee the correct implementation of the requirements agreed upon with the client and manage any changes in a controlled manner.

  • Analyze the different solution alternatives and select, design, and implement the solution that best fits the required functionality.

  • Ensure the availability of information systems, both in the services offered to clients and in internal management.

  • Guarantee and validate with the client that the system fulfills the expected functionality.

  • Ensure data confidentiality.

  • Avoid undue alterations in the information.

  • Control all changes made to project deliverables and ensure the correct upload of developments to the client’s production environments.

  • Proteger el medioambiente en el ámbito de nuestras actividades: prevenir la contaminación, usar los recursos de forma responsable, controlar los consumos y gestionar correctamente los residuos, con perspectiva de ciclo de vida en compras, equipos y proveedores, y con criterios de actuación ante emergencias con posible repercusión ambiental.

  • Cumplir con la legislación vigente en materia de los sistemas de información y ambiental, así como todos los requisitos aplicables.

This Policy is understood, implemented, and kept up to date at all levels of the organization and has the full commitment and support of the Management of APEIROO LABS, S.L.

REGULATORY FRAMEWORK

One of the objectives must be to comply with applicable legal requirements and any other requirements we subscribe to, in addition to the commitments made with clients, as well as their continuous updating. To this end, the legal and regulatory framework in which we carry out our activities is:

  • REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
  • Organic Law 3/2018, of December 5, on Personal Data Protection and the Guarantee of Digital Rights.
    Royal Legislative Decree 1/1996, of April 12, Intellectual Property Law.
    Law 2/2019, of March 1, amending the consolidated text of the Intellectual Property Law, approved by Royal Legislative Decree 1/1996, of April 12, and incorporating into Spanish law Directive 2014/26/EU of the European Parliament and of the Council of February 26, 2014, and Directive (EU) 2017/1564 of the European Parliament and of the Council of September 13, 2017.
  • Royal Decree 311/2022, of May 3, regulating the National Security Scheme.
  • Law 34/2002 of July 11 on Information Society Services and Electronic Commerce (LSSI).
  • Law 40/2015, of October 1, on the Legal Regime of the Public Sector.
  • Law 39/2015, of October 1st, on the Common Administrative Procedure of Public Administrations.