Information Security Policy

Purpose

This policy sets out the framework for information security management at HEURISTIC DATA O.E., in accordance with the requirements of ISO 27001:2022, covering information security policies, roles and responsibilities, segregation of duties and management responsibilities. At the same time, it integrates information security into all phases of project management, as well as the management of the associated risks affecting IT projects and business processes.

Scope of Application

This policy applies to all employees, contractors and third parties who have access to the organization’s corporate information, systems and IT infrastructure. It also applies to all projects performed by the organization, regardless of size or nature, and covers all project teams, including internal and external partners.

Information Security Policies (5.1)

  • The organization is committed to developing, implementing and maintaining an information security policy framework that is consistent with business needs and legal requirements.
  • Policies are reviewed at least annually or in the event of significant changes in the regulatory, organizational or technological environment.
  • Policies are communicated to all stakeholders and made available at a central access point for staff.

Information Security Roles and Responsibilities (5.2)

Clear roles and responsibilities are defined regarding information security management, such as:

  • Chief Information Security Officer (CISO): The CISO Mr. Tsapelas Ioannis ensures the organization’s compliance with ISO 27001:2022 and oversees the implementation of security policies.
  • Management: Provides strategic guidance, resources and support for the effective implementation of the ISMS.
  • Employees: Are responsible for the proper implementation of security policies in their daily activities.
  • Systems & Infrastructure Administrators: Implement technical and procedural measures to protect information and information resources.

Segregation of Duties (5.3)

  • Segregation of duties is implemented to reduce the risk of fraud, errors or unauthorized access.
  • Critical security functions and procedures are assigned to different individuals or groups to avoid the concentration of critical controls on a single person.
  • Where complete segregation of duties is not feasible, alternative controls are implemented, such as recording, monitoring and reviewing activities.

Management Responsibilities (5.4)

  • Management actively supports the information security program, ensuring the required resources and the operational implementation of policies and procedures.
  • Committed to the continuous improvement of the ISMS through assessments, inspections, reviews and monitoring of relevant indicators.
  • Ensures the training and awareness of staff on information security issues.

Information Security in Project Management (5.8)

Information security is integrated throughout the project life cycle, from the design phase to completion. The following minimum requirements are applied during project management:

  • Information Security Risk Assessment: All projects are subject to a risk analysis to identify and mitigate potential threats.
  • Definition of Roles and Responsibilities: Project managers ensure that information security is maintained throughout all phases of the project.
  • Compliance with Security Policies: All project-related activities comply with the organization’s information security policies.
  • Access Management: Strict access rights are defined to the data and systems involved in the project to prevent unauthorized access.
  • File and Document Retention: Project documents containing sensitive information are stored securely, in accordance with the organization’s policies.

Monitoring and Compliance

  • Compliance with this policy is monitored through internal audits and inspections.
  • Violations of the policy are subject to incident management procedures and, where necessary, disciplinary action in accordance with the organization’s relevant regulations.

Review and Improvement

This policy is reviewed annually or whenever necessary due to changes in the requirements of ISO 27001:2022, the regulatory framework, technological infrastructure or the operational needs of the organization.

Management of records maintained under this Policy

  • Registration: F.Α.05.02 – Organizational chart