Information Security Policy
This document sets out the principles underpinning the Information Security Policy of Sociedad Anónima Electrónica Submarina S.M.E. (hereinafter “SAES”). The organisation relies on ICT (Information and Communication Technologies) systems to achieve its objectives.
This Information Security Policy follows the guidance provided in CCN-STIC-805 issued by the Spanish National Cryptologic Centre (CCN), attached to the National Intelligence Centre (CNI). It has been developed in compliance with Royal Decree 951/2015 of 23 October, amending Royal Decree 3/2010 of 8 January, which regulates the National Security Framework (ENS) in the field of eGovernment. Article 11 establishes the obligation for Public Administrations and their service providers to implement an Information Security Policy and defines the minimum requirements it must meet. In addition, this policy supports compliance with clause 5.2 of UNE-EN ISO/IEC 27001:2022.
SAES Information Security Policy
At SAES, we are committed to protecting information and ensuring the continuity and security of the services we provide. This Information Security Policy defines the principles and guidelines governing the secure management of the organisation’s systems, data and technological services.
Commitment to Security
SAES adopts a comprehensive security model based on international best practices and current Spanish regulations. Our policy is aligned with:
– The National Security Framework (ENS)
– UNE-EN ISO/IEC 27001:2022 standard
– CCN-STIC guidelines issued by the National Cryptologic Centre
– The General Data Protection Regulation (GDPR) and applicable national legislation
These frameworks ensure that security is embedded throughout every stage of the lifecycle of our systems and services.
Information Security Objectives
– To protect the confidentiality, integrity and availability of information
– To ensure the continuity of critical services
– To manage risks arising from the use of information technologies effectively
– To promote awareness and continuous training among staff in information security matters
– To comply with applicable legislation and with commitments made to clients, suppliers and public authorities
Guiding Principles
– Accountability and governance: clear roles and responsibilities are defined for security management (e.g. Security Officer, Information Owners, System Owner)
– Holistic security: technical, organisational and procedural measures are implemented across the entire system lifecycle
– Risk management: periodic assessment and review of threats, vulnerabilities and exposure levels
– Continuous improvement: regular policy review, internal/external audits, and ongoing updating of measures and controls
– Personal data protection: compliance with GDPR principles and implementation of specific measures to safeguard privacy
Incident Management
SAES has established mechanisms to prevent, detect, respond to and recover from security incidents.
Incidents with significant impact are reported to the National Cryptologic Centre (CCN- CERT) in accordance with the National Security Framework.
Third Parties
Where SAES shares information with or provides services to third parties, it requires compliance with applicable security measures and ensures that such entities operate in line with our security standards.
Review and Update
This Policy is reviewed at least annually or whenever significant changes occur in systems, services or regulatory requirements. The review process is overseen by the Information Security Committee.
Last revision date: 13 June 2023
This Information Security Policy follows the guidance provided in CCN-STIC-805 issued by the Spanish National Cryptologic Centre (CCN), attached to the National Intelligence Centre (CNI). It has been developed in compliance with Royal Decree 951/2015 of 23 October, amending Royal Decree 3/2010 of 8 January, which regulates the National Security Framework (ENS) in the field of eGovernment. Article 11 establishes the obligation for Public Administrations and their service providers to implement an Information Security Policy and defines the minimum requirements it must meet. In addition, this policy supports compliance with clause 5.2 of UNE-EN ISO/IEC 27001:2022.
SAES Information Security Policy
At SAES, we are committed to protecting information and ensuring the continuity and security of the services we provide. This Information Security Policy defines the principles and guidelines governing the secure management of the organisation’s systems, data and technological services.
Commitment to Security
SAES adopts a comprehensive security model based on international best practices and current Spanish regulations. Our policy is aligned with:
– The National Security Framework (ENS)
– UNE-EN ISO/IEC 27001:2022 standard
– CCN-STIC guidelines issued by the National Cryptologic Centre
– The General Data Protection Regulation (GDPR) and applicable national legislation
These frameworks ensure that security is embedded throughout every stage of the lifecycle of our systems and services.
Information Security Objectives
– To protect the confidentiality, integrity and availability of information
– To ensure the continuity of critical services
– To manage risks arising from the use of information technologies effectively
– To promote awareness and continuous training among staff in information security matters
– To comply with applicable legislation and with commitments made to clients, suppliers and public authorities
Guiding Principles
– Accountability and governance: clear roles and responsibilities are defined for security management (e.g. Security Officer, Information Owners, System Owner)
– Holistic security: technical, organisational and procedural measures are implemented across the entire system lifecycle
– Risk management: periodic assessment and review of threats, vulnerabilities and exposure levels
– Continuous improvement: regular policy review, internal/external audits, and ongoing updating of measures and controls
– Personal data protection: compliance with GDPR principles and implementation of specific measures to safeguard privacy
Incident Management
SAES has established mechanisms to prevent, detect, respond to and recover from security incidents.
Incidents with significant impact are reported to the National Cryptologic Centre (CCN- CERT) in accordance with the National Security Framework.
Third Parties
Where SAES shares information with or provides services to third parties, it requires compliance with applicable security measures and ensures that such entities operate in line with our security standards.
Review and Update
This Policy is reviewed at least annually or whenever significant changes occur in systems, services or regulatory requirements. The review process is overseen by the Information Security Committee.
Last revision date: 13 June 2023



























