{"id":40059,"date":"2026-06-10T14:53:30","date_gmt":"2026-06-10T12:53:30","guid":{"rendered":"https:\/\/kymos.com\/?page_id=40059"},"modified":"2026-06-10T15:35:04","modified_gmt":"2026-06-10T13:35:04","slug":"information-security-policy","status":"publish","type":"page","link":"https:\/\/kymos.com\/es\/information-security-policy\/","title":{"rendered":"Pol\u00edtica de Seguridad de la Informaci\u00f3n"},"content":{"rendered":"

Pol\u00edtica de Seguridad de la Informaci\u00f3n<\/h1><\/div><\/div><\/div><\/div><\/div>
<\/div><\/div>

<\/a><\/a>1.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Memoria Explicativa<\/h1>\n

KYMOS depends on ICT (Information and Communications Technology) systems to achieve its objectives.<\/p>\n

Estos sistemas deben gestionarse con diligencia, adoptando las medidas adecuadas para protegerlos frente a da\u00f1os accidentales o deliberados que pudieran afectar a la disponibilidad, integridad y confidencialidad de la informaci\u00f3n tratada o de los servicios prestados.<\/p>\n

El objetivo de la seguridad de la informaci\u00f3n es garantizar la calidad de la informaci\u00f3n y la prestaci\u00f3n continuada de los servicios, actuando de forma preventiva, supervisando la actividad diaria y reaccionando con prontitud ante los incidentes.<\/p>\n

To defend against these threats, a strategy that adapts to changing environmental conditions is required to ensure the continued provision of services.<\/p>\n

This implies that departments must implement the security measures required by ISO 27001 and the NIS 2 Directive (Annex I, point 5 \u201cHealth Sector\u201d, in conjunction with NACE Rev.2, Section C, point 21 \u201cManufacturing of medicine\u201d)<\/strong>, as well as continuously monitor service delivery levels, track, analyse and correct reported vulnerabilities, and prepare an effective incident response to ensure continuity of services provided.<\/p>\n

The different departments must ensure that ICT security is an integral part of every stage of the system’s lifecycle, from its conception to its decommissioning, through development or procurement decisions and operational activities.<\/p>\n

Security requirements and funding need to be identified and included in planning, request for tenders, and tender documents for ICT projects. Departments need to be prepared to prevent, detect, react and recover from incidents in accordance with NIS2 Directive in its article 29.a.<\/p>\n

<\/a><\/a>2.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Gesti\u00f3n de Incidentes de Seguridad<\/h1>\n

<\/a><\/a>2.1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Prevenci\u00f3n<\/h2>\n

Departments must avoid, or at least prevent as far as possible, information or services from being compromised by security incidents. Both ISO 27001 and the NIS2 Directive state that systems must be designed and configured to ensure security by default, in line with the \u00abNeed to Know\u00bb least privilege policy.<\/p>\n

A tal efecto, los departamentos deben implementar las medidas de seguridad m\u00ednimas determinadas por ISO 27001, de acuerdo con los requisitos establecidos en la Directiva NIS2, as\u00ed como cualquier control adicional identificado mediante una evaluaci\u00f3n de amenazas y riesgos. Estos controles, junto con los roles y responsabilidades de seguridad de todo el personal, deben estar claramente definidos y documentados.<\/p>\n

Para garantizar el cumplimiento de la pol\u00edtica, los departamentos deben:<\/p>\n