AGORA INVEST GROUP (hereinafter, “the GROUP”) is firmly committed to the security of the information and data it processes and, in line with this commitment, has implemented an Information Security Management System based on TISAX (Trusted Information Security Assessment Exchange), the information security standard specifically designed for the automotive industry. This system aims to achieve the satisfaction expected by customers through established processes based on continuous improvement, ensuring the continuity of information systems, minimizing risks, and ensuring compliance with the objectives set, in order to guarantee at all times the confidentiality, integrity, and availability of information.
In furtherance of this commitment and in accordance with the TISAX reference standards, the GROUP establishes the following principles and guidelines for action:
▪ Competence and leadership on the part of management positions and governing bodies as a commitment to developing the Information Security system.
▪ Identify the internal and external stakeholders in the management system.
▪ Analyze the Group’s context, as well as its opportunities and risks, as a basis for planning the actions necessary to address them.
▪ Ensure the satisfaction of customers and other stakeholders with the Group’s activities and their possible impact on society.
▪ Evaluate the Group’s performance in security matters based on objectives and targets aimed at the continuous improvement of the activities regulated in the Information Security Management System.
▪ Comply with applicable legislation, the commitments made with customers and stakeholders, and the Group’s internal rules.
▪ Ensure the confidentiality, integrity, and availability of information and the systems that support it, both in the services provided to customers and in internal management.
▪ Ensure the capacity to respond to emergency situations, restoring the operation of critical services in the shortest possible time.
▪ Establish appropriate measures for the treatment of identified or detected risks.
▪ Train all Group personnel for the proper performance of their positions and compliance with internal rules, providing a suitable working environment.
▪ Maintain fluid communication, both internally and with customers.
▪ Ensure that the technical competence of Group personnel is adequate for the performance of their duties.
▪ Maintain a system of continuous evaluation of suppliers and subcontractors, especially those related to the Information Security Management System.
▪ Maintain facilities and equipment in appropriate conditions, aligned with the Group’s activity, objectives, and goals.
▪ Ensure continuous analysis of all relevant processes, establishing the pertinent improvements in each case, based on the results obtained and the objectives established.
These principles are embraced by the Group, which makes available to its employees the means and resources necessary for their fulfillment and makes them publicly known through this Information Security Policy
