Information Security Policy

1 Introduction

Shorr Kan Srl (hereinafter, for brevity, “SK”) recognises the need to ensure that its business activity is delivered without interruption and with the highest level of protection for the information assets entrusted to us, whether by contract or by internal choice.

To achieve this result, SK has implemented an Information Security Management System (hereinafter, for brevity, the “ISMS”) compliant with the international information security standard ISO/IEC 27001:2022 and with the codes of practice ISO/IEC 27017:2015 and ISO/IEC 27018:2019.

This standard defines the requirements for an ISMS based on international best practices.

1.1 Principles

SK’s Information Security Policy is guided by the following principles:

• To give the organisation full knowledge of the information it manages and an assessment of its criticality, in order to facilitate the implementation of adequate levels of protection;
• To guarantee the integrity, confidentiality and availability of the information managed;
• To guarantee secure access to information, so as to prevent unauthorised processing or processing carried out without the necessary rights;
• To ensure that the organisation and third parties cooperate in processing information by adopting policies aimed at complying with adequate security levels;
• To ensure that the organisation and the third parties cooperating in the processing of information are fully aware of security issues, including for the services delivered to the market;
• To ensure that anomalies and incidents with repercussions on the information system and on corporate security levels are promptly recognised and correctly managed through efficient prevention, communication and response systems, in order to minimise the impact on the business;
• To ensure that access to company premises and to individual rooms takes place exclusively by authorised personnel, safeguarding the security of the areas and of the assets present;
• To ensure compliance with legal requirements and with the security commitments established in contracts with third parties;
• To ensure the detection of anomalous events, incidents and vulnerabilities of information systems in order to preserve the security and availability of services and information;
• To ensure business continuity and disaster recovery, through the application of security procedures established in advance.

1.2 Benefits

The implementation and maintenance of Proteo has many advantages for SK’s clients, for SK itself and for its employees and collaborators. Among these are:

Greater assurance regarding the delivery of our services to clients;

• The maintenance, and growth, of the value of the SK organisation;
• Compliance with the legal requirements of our country and with any regulations or procedures imposed by our clients.

SK has decided to adopt and maintain full certification according to the ISO/IEC 27001:2022 standard and the codes of practice ISO/IEC 27017:2015 and ISO/IEC 27018:2019.

This means that our effective adoption of information security management best practices is validated by an independent third party, namely a Registered Certification Body.

2 Information security policy

2.1 Information security requirements

It is our intention to identify, maintain, communicate and periodically review the information security requirements we intend to adopt, so that all activities carried out within the context of our ISMS are focused on maintaining these requirements.

Among these requirements we have identified:

• Scope
• Objectives
• Policies
• Operating instructions and procedures
• Controls
• Human and material resources
• Tools and methods.

The main driver we have adopted to identify these requirements is operational business need, which ultimately consists of guaranteeing the delivery of services to our clients.

Within this area of attention we believe we have considered, among other needs:

• Significant developments in the business;
• The threats to which we are exposed, the resulting vulnerabilities and the potential risks;
• Any significant security incidents;
• The evolution of the regulatory or legislative context concerning the secure processing of information.

2.2 Review cycle

The objectives and the resources to be dedicated to the ISMS will be reviewed annually, and this process will be integrated into the annual financial statement preparation procedures, adding a dedicated paragraph on the ISMS to the explanatory notes.

In accordance with the ISO/IEC 27001 standard, we will adopt the Annex A controls that SK deems appropriate to adopt on the basis of our requirements. These controls will be reviewed regularly in the light of the results of risk assessments and in line with the risk treatment plans adopted. For details of which Annex A controls have been implemented and which have been excluded, please refer to the Statement of Applicability (hereinafter the “SOA”).

2.3 Continuous improvement

For us at SK, so-called “continuous improvement” consists of:

• Continuously improving the effectiveness of the ISMS;
• Improving current business processes to align them with best practices as defined in ISO/IEC 27001 and the related standards;
• Obtaining ISO/IEC 27001 certification and maintaining it on a periodic basis;
• Increasing the level of proactivity (and stakeholders’ perception of that proactivity) regarding information security;
• Making information security processes and controls more measurable, in order to provide a solid basis for more conscious and informed decisions;
• Reviewing the most important metrics annually to assess whether they should be changed;
• Listening to and gathering ideas for improving Proteo through regular meetings and other forms of communication with interested parties;
• Examining improvement ideas during periodic management meetings in order to set priorities and assess implementation timescales and benefits.

2.4 Areas of interest and supporting documents

SK defines the policies of conduct regarding the ISMS for a wide variety of areas relating to information security. These policies of conduct are described in detail in a complete set of documents (the Policies) accompanying this general information security policy.

We have defined security Policies for a large number of areas relating to information security that are relevant to our ISMS.

These related Policies are attached to this primary information security policy.

Each of these Policies is defined and agreed with one or more persons with competence in the relevant area and, once approved, is communicated to the resources concerned, who may be either internal or external to the SK organisation.

2.5 Extension to cloud services

SK has established minimum security standards relating to its own use of cloud services and to our clients’ use of the cloud services delivered by SK.

We consider the cloud services we use as extensions of our infrastructure, requiring a level of security applied to information that is equal or greater, depending on the nature of the service and of the resources held or processed within it.

SK requires that the confidentiality, integrity and availability of resources within cloud services be protected and preserved at the same level as resources within its own systems. The cloud services used by SK fall within the scope of SK’s information security management system (ISMS/PROTEO) and are subject to risk assessment and to the application of appropriate technical and organisational controls in line with the procedures defined in the ISMS.

Roles and responsibilities for managing the environment and the cloud services are clearly defined within our organisation and form part of the contractual documentation with clients.

We have established and maintain a clear division of responsibilities between SK and any of our sub-suppliers, including cloud service sub-suppliers.

In particular, the controls applied to cloud services within SK’s ISMS take into consideration:

• The information stored in the cloud service and the risk of potential access and/or management by the cloud infrastructure provider;
• The assets maintained in the cloud service;
• The processes and programs used within the cloud service;
• The risks connected with multi-tenant and/or virtualised services;
• The users of the cloud service;
• The administrators of the cloud service and other parties with privileged access;
• The appropriate roles and responsibilities regarding information, security and privacy management;
• The geographic locations and countries in which the cloud service may store or process data, regardless of the duration of such storage or processing.

SK requires that the cloud services it uses comply with all applicable legislative, regulatory and contractual obligations, including those relating to the protection of personally identifiable information (PII) and to the rights of PII principals. These include the obligations on SK as identified in the relevant articles of the applicable privacy legislation, the GDPR (EU Regulation 2016/679).

2.6 Who this Policy applies to

This Information Security Policy — as well as all the area-specific policies — applies to all systems, people and processes that use the information systems or resources of the SK organisation, including members of the board of directors, managers, employees, collaborators, suppliers and other third parties who have access to SK systems or resources.

All these policies must be adopted and complied with by all SK employees, collaborators and suppliers.

***

This document is an extract from SK’s Information Security Policy. For those who are interested, the complete version is available on request.