Information Security Policy – Public Version

MILLER-INGRAM ASSOCIATES S.L. is committed to protecting its information assets and complying with applicable legal and regulatory requirements through the implementation of an Information Security Management System (ISMS) in accordance with the ISO/IEC 27001 standard.

1. Main Objectives

• Ensure the business continuity of MILLER-INGRAM ASSOCIATES S.L. and minimize the risk of harm by preventing security incidents and thereby reducing their potential impact on the company.
• Confidentiality: Ensure that information is accessible only to authorized individuals.
• Integrity: Ensure that information is not altered in an unauthorized manner.
• Availability: Ensure that information is accessible when needed to support business continuity.
•  

2. Scope

• Protection of the company’s information assets.
• Applies to employees and related third parties who access the company’s information.

3. Policy Development

• Based on leadership and management commitment.
• Defines the roles and/or responsibilities related to Information Security.
• Regulates the processing of personal data and the use of information systems and communications, including the rights of data subjects.
• Establishes measures for managing both automated and non-automated media.
• Establishes the obligation of confidentiality and professional secrecy for those responsible for and in charge of data processing, as well as all involved parties.
• Regulates the protection of personal passwords and responsibilities regarding suppliers and third parties.

4. General Principles

• Classification of information according to its criticality.
• Access control and segregation of duties.
• Risk management and business continuity.
• Regulatory compliance and personal data protection.
• Staff training and awareness.
• Management's commitment to the continuous improvement of the ISMS.

5. Third-Party Relations

Suppliers, partners, and other external parties who access information from MILLER-INGRAM ASSOCIATES S.L. must comply with the principles of this policy, including confidentiality, appropriate use of systems, and adherence to applicable regulations.