Security Policy
The purpose of this Policy is to achieve adequate protection of Pandora FMS information, preserving the following security qualities

Confidentiality: Ensure that the information is accessible only to those who are authorized to have access to it.

Integrity: Ensure the accuracy and integrity of the information and the methods of its processing.

Availability: Ensure that authorized users have access to the information and its associated assets when required.

These basic principles must be preserved and ensured in any form that the information takes, whether in digital, printed, visual or spoken format, and regardless of whether it is processed in Pandora FMS facilities or outside them. Likewise, these principles must be considered in the following security areas:

• Physical: Covering the security of dependencies, facilities, hardware systems, supports and any physical asset that processes or may process information.
• Logical: Including the aspects of protection of applications, networks and prototypes of digital communication and computer systems.
• Corporate-political: Made up by the security aspects related to the organization itself, to internal rules, regulations and legal regulations.

Pandora FMS bases its activity on the processing of different types of data and information. This allows to run basic business processes. In such a way that the damage or loss of the organization’s assets affects the performance of its operations and may jeopardize the continuity of the organization. To prevent this from happening, an Information Security Policy has been designed, whose main objectives are:

• Protecting, through controls and security measures, the company’s assets against threats that may lead to security incidents.
• Mitigating the effects of security incidents, which may affect both members of the organization and external stakeholders.
• Establishing an information and data classification system in order to protect critical information assets, both internal and those that may be of interest to external stakeholders.
• Defining the responsibilities in terms of information security by generating the corresponding organizational structure.
• Developing a set of rules, standards and procedures applicable to management bodies, employees, partners, external service providers, etc. These security policies and compliance with ISO 27001 standards will be particularly relevant to customers, suppliers and external organizations and must be communicated in a timely manner. Of course, internally there will be greater communication of the operation of the ISMS and all internal policies and regulations.
• Specifying the effects of non-compliance with the Safety Policy in the workplace, through continuous training and internal communication.
• Continuously assessing the risks affecting the assets in order to adopt the appropriate security measures/controls.
• Verifying the operation of security measures and controls through internal security audits carried out by independent auditors.
• Training users in security management and information and communications technologies.
• Controlling the traffic of information and data through communications infrastructures or by sending optical, magnetic, paper data carriers, etc.
• Observing the legislation on data protection, intellectual property, labor, information society services, criminal, etc., that affects the assets of Pandora FMS and its relationship with external stakeholders.