{"id":40063,"date":"2026-06-10T14:53:30","date_gmt":"2026-06-10T12:53:30","guid":{"rendered":"https:\/\/kymos.com\/?page_id=40063"},"modified":"2026-06-10T15:08:53","modified_gmt":"2026-06-10T13:08:53","slug":"information-security-policy","status":"publish","type":"page","link":"https:\/\/kymos.com\/ko\/information-security-policy\/","title":{"rendered":"Information Security Policy"},"content":{"rendered":"

Information Security Policy<\/h1><\/div><\/div><\/div><\/div><\/div>
<\/div><\/div>

1. Explanatory Memorandum<\/h2>\n

<\/a><\/h1>\n

KYMOS depends on ICT (Information and Communications Technology) systems to achieve its objectives.<\/p>\n

These systems must be managed diligently, taking appropriate measures to protect them against accidental or deliberate damage that could affect the availability, integrity and confidentiality of the information processed or services provided.<\/p>\n

The objective of information security is to ensure the quality of information and the continued provision of services, acting preventively, monitoring daily activity and reacting promptly to incidents.<\/p>\n

To defend against these threats, a strategy that adapts to changing environmental conditions is required to ensure the continued provision of services.<\/p>\n

This implies that departments must implement the security measures required by ISO 27001 and the NIS 2 Directive (Annex I, point 5 \u201cHealth Sector\u201d, in conjunction with NACE Rev.2, Section C, point 21 \u201cManufacturing of medicine\u201d)<\/strong>, as well as continuously monitor service delivery levels, track, analyse and correct reported vulnerabilities, and prepare an effective incident response to ensure continuity of services provided.<\/p>\n

The different departments must ensure that ICT security is an integral part of every stage of the system’s lifecycle, from its conception to its decommissioning, through development or procurement decisions and operational activities.<\/p>\n

Security requirements and funding need to be identified and included in planning, request for tenders, and tender documents for ICT projects. Departments need to be prepared to prevent, detect, react and recover from incidents in accordance with NIS2 Directive in its article 29.a.<\/p>\n

2. Security Incident Management<\/h2>\n

<\/a><\/h1>\n

2.1 Prevention<\/h3>\n

<\/a><\/h2>\n

Departments must avoid, or at least prevent as far as possible, information or services from being compromised by security incidents. Both ISO 27001 and the NIS2 Directive state that systems must be designed and configured to ensure security by default, in line with the “Need to Know” least privilege policy.<\/p>\n

To this end, departments must implement the minimum-security measures determined by ISO 27001, in accordance with the requirements stated in NIS2 Directive, as well as any additional controls identified through a threat and risk assessment. These controls, together with the security roles and responsibilities of all personnel, must be clearly defined and documented.<\/p>\n

To ensure compliance with the policy, departments must:<\/p>\n