Information security policy

Elanta Redes de Acceso, S.L.U. understands the importance that the security of its information and services has for the Company. The protection of these assets is essential, as any damage or loss could have a significant impact on the performance of daily operations. This could not only disrupt the normal flow of activities, but could also compromise the continuity of the Company. It is therefore crucial to adopt preventive and mitigating measures to ensure that information and services are always protected and available.

This is why the Company is committed to work to ensure:

• The confidentiality and protection of valuable or sensitive information.
• The integrity and accuracy of information.
• The availability of information to meet business needs.
• Compliance with legal and regulatory requirements.
• Adequate updating and maintenance of security documentation and more specifically continuity plans.
• Information security training and awareness for all employees.
• That all high-impact information security incidents are reported to the Information Security Manager, who will refer them to the Information Security Committee for investigation.
• Technology risks are mitigated to an acceptable level through a risk management framework.

In order to fulfil this commitment, the Company has developed this Information Security Policy and the corresponding Information Security Policies and Procedures that address specific, mandatory aspects of information security.

These address specific aspects, further enforcing the implementation of information security controls and addressing the needs within the Company.

The Company has defined the most appropriate security objectives for the Company to undertake a process of improvement of the Information Security Management System, with the conviction that this will result in the improvement of processes and services offered to customers, while scrupulously respecting their legally established rights.

In order for all this to be possible, the Company declares its formal commitment to allocate the necessary and sufficient resources for the proper development of what is established herein, both at the beginning of the project and in its future maintenance.

All Security Policies in force shall remain available internally within the Company and shall be regularly updated, adapting to new organisational, environmental and market requirements that may arise.

The Information Security Policy approved by the CEO of the Company shall be applicable as of the day following its publication.