This Information Security Policy is effective from the date of signing until it is replaced by a new Policy.
The mission of REVEAL GENOMICS is to revolutionize the use of biomarkers and the development of in-vitro diagnostic tests useful in clinical practice in the field of medical oncology. Specifically, the company seeks to decode the molecular information of the tumor before, during, and/or after treatments, using different biological samples to develop innovative tests that, although highly analytically complex, provide easy-to-interpret results. This allows for determining the best treatment option for cancer, contributing to patient well-being and resource optimization.
To achieve its objectives, it is vital to ensure an information security policy that generates trust among all actors, clients, and end-users involved in the company's solutions. In this regard, REVEAL GENOMICS commits to information security, ensuring its proper management to offer all its stakeholders the highest guarantees regarding the security of the information used.
These systems must be diligently managed, taking appropriate measures to protect them against accidental or deliberate damage that may affect the availability, integrity, or confidentiality of the processed information or the services provided.
The objective of information security is to ensure the quality of information and the continuous provision of services by acting preventively, monitoring daily activity, and responding promptly to incidents.
Information and Communication Technology (ICT) systems must be protected against rapidly evolving threats that can impact the confidentiality, integrity, availability, intended use, and value of the information and services. To defend against these threats, a strategy that adapts to changes in environmental conditions is required to ensure the continuous provision of services. This implies that departments must implement the minimum security measures required by the National Security Scheme, continuously monitor service levels, follow and analyze reported vulnerabilities, and prepare an effective response to incidents to ensure service continuity.
Different departments must ensure that ICT security is an integral part of each stage of the system's lifecycle, from conception to retirement, through development or acquisition decisions and operational activities. Security requirements and funding needs must be identified for both the developed products and their associated services, as well as for the base software acquired from third parties.
Departments must be prepared to prevent, detect, respond to, and recover from incidents, following Article 8 of the National Security Scheme (Article 8. Prevention, Detection, Response, and Conservation).
This policy applies to all ICT systems of the entity and all members of the organization involved in Services and projects aimed at the public sector that require the application of the National Security Scheme. Especially, to the "Information Systems for the Reception and Processing of Diagnostic Test Orders for Cancer Patients."
Based on the above, the Management establishes the following information security objectives:
One of the objectives is to comply with applicable legal requirements and any other requirements we subscribe to, as well as the commitments made with clients, ensuring their continuous updating. To this end, the legal and regulatory framework in which we conduct our activities includes:
To achieve these objectives, it is necessary to:
Our management system has the following structure:
The management of our system is entrusted to the Security Officer, and the system will be available in our information system in a repository, which can be accessed according to the access profiles granted as per our current access management procedure.
The essential responsibility lies with the organization's General Management, the CEO, who is responsible for organizing functions and responsibilities and providing the appropriate resources to achieve the ENS objectives. Other area managers are also responsible for setting a good example by following the established security rules.
The principles are assumed by the Management, which has the necessary means and provides its employees with sufficientresources for compliance, being embodied and made publicly known through thisSecurity Policy.
The defined security roles or functions are:
This definition of duties and responsibilities is completed in the job profiles and the system documents "Register of Responsibilities, Roles, and Duties."
CONFLICT RESOLUTION:
Differences in criteria that may result in a conflict will be addressed within the Security Committee, and in all cases, the CEO's criteria will prevail.
The procedure for the appointment and renewal will be the ratification by the Security Committee.
The committee for managing and coordinating security is the highest authority within the information security management system, making all major decisions related to security.
The members of the Information Security Committee are:
These members, except for the CEO, are appointed by the committee, which is the only body that can appoint, renew, and remove them.
The Security Committee is an autonomous, executive body with decision-making autonomy and does not need to subordinate its activities to any other element within our Company.
This policy is complemented by the rest of the policies, procedures, and documents in force to develop our management system.
All systems subject to this Policy must conduct a risk analysis, evaluating the threats and risks to which they are exposed. This analysis is reviewed regularly:
To harmonize risk analyses, the ICT Security Committee will establish a reference valuation for the different types of information handled and the different services provided. The ICT Security Committee will facilitate the availability of resources to meet the security needs of the various systems, promoting horizontal investments.
For conducting the risk analysis, the risk analysis methodology developed in the Risk Analysis procedure will be taken into account.
Additionally, the Security Committee will meet annually to review and update, if necessary, the Business Impact Analysis (BIA).
All members of REVEAL GENOMICS are required to be aware of and comply with this Security Policy and the Security Regulations. It is the responsibility of the ICT Security Committee to provide the necessary means to ensure that the information reaches those affected.
All members of REVEAL GENOMICS will attend an ICT security awareness session at least once a year. A continuous awareness program will be established to support all members of REVEAL GENOMICS, particularly new hires.
Individuals responsible for the use, operation, or administration of ICT systems will receive training for the secure handling of systems as needed to perform their work. This training will be mandatory before assuming a responsibility, whether it is their first assignment or a change in job position or responsibilities.
This Policy applies to all REVEAL GENOMICS staff and external personnel performing tasks within the Company.
HR, or the person designated by the CEO for this task, will include information security functions in the job descriptions of employees, inform all newly hired personnel of their obligations regarding compliance with the Security Policy, manage Confidentiality Agreements with personnel, and coordinate user training tasks concerning this Policy.
The Security Officer is responsible for monitoring, documenting, and analyzing reported security incidents, as well as communicating with the Information Security Committee and information owners.
The Information Security Committee will be responsible for implementing the necessary means and channels for the SecurityManagement Officer to handle reports of incidents and system anomalies. The Committee will also monitor investigations, oversee the evolution of information, and promote the resolution of information security incidents.
The Security Officer will participate in the preparation of the Confidentiality Agreement to be signed by employees and third parties performing functions at REVEAL GENOMICS, in advising on sanctions to be applied for non-compliance with this Policy, and in handling information security incidents.
All REVEAL GENOMICS personnel are responsible for promptly reporting detected information security weaknesses and incidents.
Professionalism ofHuman Resources:
The objectives of controlling personnel security are:
The objective of access control to information systems is:
The various departments must ensure that ICT security is an integral part of every stage of the system life cycle, from its conception to its decommissioning, including development or acquisition decisions and operational activities. Security requirements and funding needs must be identified and included in planning, request for proposals, and bidding documents for ICT projects.
Furthermore, information security will be considered in the acquisition and maintenance of information systems, limiting and managing change.
The policy for the development and acquisition of information systems is detailed in the Policy documents: Acquisition, Development, and Maintenance of Systems.
REVEAL GENOMICS considers it strategic for the organization that processes integrate information security as part of their life cycle. Information systems and services must include security by default from their creation to their decommissioning, incorporating security into development and/or acquisition decisions and all operational activities, establishing security as an integral and cross-cutting process.
REVEAL GENOMICS is committed to ensuring system integrity through a change management process that allows for the control of updates to physical or logical components with prior authorization before installation in the system.
The systems management team will assess the impact on system security before making changes and will document and control those changes evaluated as significant or with security implications.
Periodic security reviews will assess the security state of the systems concerning manufacturer specifications, vulnerabilities, and updates affecting them, reacting promptly to manage risk based on the security status of these systems.
REVEAL GENOMICS establishes protective measures for the security of information stored or in transit through insecure environments. Insecure environments are considered to include portable devices, information media, and communications over open networks or with weak encryption.
REVEAL GENOMICS, establishes protective measures for information security, particularly to protect the perimeter, especially when connecting to public networks, particularly if they are used wholly or primarily for providing electronic communication services available to the public.
In any case, risks arising from the interconnection of the system, via networks, with other systems will be analyzed, and the connection points will be controlled.
REVEAL GENOMICS, will log user activities,retaining the necessary information to monitor, analyze, investigate, and document inappropriate or unauthorized activities, allowing the identification of the individual involved at all times.
REVEAL GENOMICS, to ensure continuity of operations, establishes measures to guarantee that systems have backup copies and sets up necessary mechanisms to maintain operational continuity in the event of a loss of regular work resources.
REVEAL GENOMICS establishes a continuous improvement process for information security by applying the criteria and methodologies outlined in various standards such as ISO 9001 and ISO 27001.
The processing of personal data involves a series of risks that can affect the rights and freedoms of individuals. These risks can vary, including:
All personnel at REVEAL GENOMICS are required to comply with the provisions of REGULATION(EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016concerning personal data.
Barcelona, May 14, 2024
PatriciaVillagrasa-González
CEO & co-founder