Security Policy | Fichap Frontline Workforce Management

Information Security Policy

FICHAP Management, through the Information Security Committee (ISC), establishes, promotes, and disseminates the following Policy and objectives for Information Security management to all levels of the organization.

The information generated and managed by FICHAP is a key strategic asset for ensuring business continuity. In this context, the Information Security Policy is aimed at protecting information and the means used to manage it, including the people who access and/or handle that information. This is done to guarantee its integrity, availability, confidentiality, cybersecurity, and privacy protection.

Management Statement of Intent

FICHAP will protect information assets and the technology used to process them from internal or external threats, whether deliberate or accidental, to ensure the preservation of information integrity, availability, and confidentiality. Furthermore, it aims to guarantee the continuity of information systems, minimize the risk of damage, and ensure the efficient fulfillment of its strategic objectives.

This policy applies to all physical locations, virtual environments, internal collaborators, and Fichap vendors, including offices, cloud systems, SaaS tools, and code repositories.

Information Security Principles

- Promote an organizational culture focused on information security.

- Engage FICHAP's top management in the dissemination, consolidation, and compliance of the policy.

- Implement the committed security measures, identifying available resources and budget items.

- Keep policies, regulations, and procedures updated to ensure their relevance and effectiveness.

- Promote practices that ensure the continuity of FICHAP's functions.

- Comply with legal and regulatory requirements, the organization's own requirements, and continuous improvement.

- Promote security throughout the software development lifecycle.

- Ensure compliance with personal data protection laws (GDPR, Argentine Law 25.326, LFPDPPP).

Information Security Management Objectives

Achieve adequate levels of integrity, confidentiality, and availability for FICHAP's information, in order to ensure the operational continuity of the processes and services it develops, by safeguarding the assets of
information associated with critical business processes and their support.

To this end, specific objectives and indicators will be identified separately to monitor their level of compliance.

Information Security Policy Scope

FICHAP's Information Security Policy is established in compliance with current legal provisions to properly manage information security.

All FICHAP personnel (executives, employees, and contractors) must be familiar with and adhere to this policy, which will be communicated throughout the organization. It will also be available as documented information to interested parties, as appropriate.

- This Policy applies to the entire scope of FICHAP, its resources, and all internal and external processes linked to the entity through contracts or agreements with third parties.

- Accordingly, the information generated and managed by FICHAP constitutes a key strategic asset for ensuring business continuity; therefore, Information Security is a tool to guarantee its integrity, availability, and confidentiality.

Roles and Responsibilities

Fichap establishes the following key responsibilities within the ISMS:

- Information Security Committee (ISC): Directs, approves, and reviews ISMS policies and controls.

- ISMS Manager: Coordinates the implementation, control, and continuous improvement of the ISMS.

- Asset Owners: Ensure the protection of assigned information.

- All employees and third parties: Are responsible for complying with this policy and reporting security incidents or breaches.

Information Classification

All information handled at Fichap must be classified according to its sensitivity level:

- Public: May be disclosed without restrictions.

- Internal: For exclusive use by Fichap.

- Confidential: Requires authorization for access. Includes customer data and development documentation.

- Restricted: Highly critical. Access only by designated roles.

Documents and systems must be labeled according to their classification. Controls proportional to each level must be applied.

Risk Assessment and Treatment

Fichap maintains an active process for identifying, assessing, and treating security risks. A risk matrix based on impact and probability is used. High-level risks must be mitigated with technical, organizational, or contractual controls. Treatment will be recorded and monitored by the ISMS Manager.

General Aspects

The Information Security Policy has been developed in accordance with current national legislation.

Senior Management is committed to taking all necessary actions to enable operational continuity, address interruptions to institutional activities, protect critical processes from the effects of major system failures or disasters, and ensure their timely resumption.

Policy Approval

The information security policy will be approved by Senior Management, clearly reflecting their commitment, support, and interest in developing an information security culture at FICHAP.

Policy Dissemination

- It is the responsibility of the ISO to disseminate relevant security topics.

- Information security policies will be communicated to all FICHAP personnel, third parties providing services to the organization, and relevant external entities.

- To disseminate information security policy content within FICHAP, the organization's available communication channels must be used, along with awareness and training sessions held for this purpose.

- To this end, actions and initiatives contained in an Information Security Dissemination, Awareness, and Training Plan will be defined, implemented, and evaluated.

- Training and awareness activity records will be documented, and compliance will be evaluated annually.

Policy Review

- The Information Security Policy will be reviewed annually to ensure it remains up to date. Additionally, any necessary modifications will be made based on potential changes that may affect its definition, such as: technological changes; the impact of security incidents; structural changes at FICHAP; changes in legal conditions and/or requirements; or at the request of Management.

- Modifications to this document are the responsibility of the Information Security Committee and must be approved by Management.

Approval date

Version: 1.0
Approval Date: 08/06/2025
ISMS Manager: Gonzalo Soaje Pinto
Approved by: Fichap Management

POLICIES OF Security

Policies
of privacy

Start today to
‍transform the
experience of your
employees

Start today to transform the experience of your employees

Request your free demo