Information Security Policy

1. CONTEXT

Information is, for virtually all business processes carried out by the entities that make up PONS, the essential backbone for their efficient and high-quality execution, thereby enabling the achievement of the strategic objectives formally established by Management.
The main dimensions of information security that must be guaranteed in the execution of any business process are:

• Confidentiality: Ensures that information is accessible only to authorised persons, entities or processes.
• Integrity: Ensures that information is generated, modified and deleted only by authorised persons, entities or processes.
• Availability: Ensures that information is accessible whenever authorised persons, entities or processes require it.
• Traceability: Ensures that information relating to access and activities carried out by persons, entities or processes is available for any analysis of anomalous behaviour patterns that may need to be performed.

Furthermore, there are other security dimensions, such as authentication of the parties and non-repudiation, which must likewise be guaranteed whenever required by the security value of the information within the context of the business process in which it is stored, processed or transmitted.

The Information Security Policy is based on the adoption of clear and well-defined principles that ensure compliance with strategic guidelines, legal requirements, as well as contractual requirements formally agreed with third parties or stakeholders. It therefore constitutes the main instrument on which PONS relies for the secure use of information and communications technologies.

The rules and regulations (standards, procedures and security instructions) arising from or derived from the PONS Information Security Policy shall become part of it once they have been communicated and shall be mandatory for all employees and third parties making use of such information.

Employees shall be responsible for ensuring the security of the information they process, store or transmit in the performance of their duties and must know, understand and comply with the guidelines and rules relating to information security, ensuring the proper application of the protection measures in place.

Employees’ access to information shall be limited to that which is strictly necessary for the proper performance of the duties formally assigned to them, thereby ensuring compliance with the principle of least privilege. Accordingly, the persons responsible for information within the various entities that make up PONS shall take into account all technical and organisational security measures when defining and maintaining appropriate information access privileges, according to the activities associated with each job position.
Failure to comply with the guidelines of the Information Security Policy may result in the application of internal administrative sanctions.
Management shall ensure that this Information Security Policy is understood and implemented throughout all entities belonging to PONS, providing the resources necessary to achieve the objectives defined within this framework.

2. OBJECTIVE

The Information Security Policy is established as the high-level document that formalises the various security guidelines adopted by PONS, which shall be developed in greater detail in the corresponding security rules and regulations drawn up for this purpose.
Under this premise, the Information Security Policy therefore sets out the following main objectives:

• To comply with the applicable legal regulations in the field of information security that affect the context of the organisation’s main activities.

• To contribute to fulfilling the formally established mission and strategic objectives.
• To ensure the appropriate protection of the various information assets according to their degree of sensitivity and criticality (security value of information assets according to the various dimensions considered and formalised in the corresponding Information Value Model).
• To align information security with business requirements by formalising and carrying out the process of analysing and assessing the risks to which the various information assets are exposed, leading to the definition of a strategy for mitigating risks related to the information security environment.
• To ensure an effective response capability in the event of information security incidents, minimising their operational, financial and reputational impact.
• To facilitate the sizing of the resources required for the proper implementation of the technical and organisational security measures set out in the security rules and regulations documented for this purpose.
• To promote the use of good information security practices and foster a security culture within the organisational structure.
• To promote the definition, implementation and maintenance of a Business Continuity Plan for critical processes identified following the Business Impact Analysis (BIA).
• To establish review, monitoring, audit and continuous improvement mechanisms in order to maintain the appropriate levels of security required by the business model.

Likewise, the Information Security Policy establishes the general framework for defining specific security objectives, which shall be developed in the derived security rules and regulations and reviewed periodically in light of the business strategy, changes in the technical environment, regulatory and contractual changes, the risk context, the threat landscape and lessons learned from security events and incidents.

3. SCOPE

The scope of the Information Security Policy encompasses all information assets existing within the various entities that make up PONS and which act as supporting infrastructure for the execution of their business processes.

4. REGULATORY FRAMEWORK

The formalisation of the Information Security Policy, as well as the security rules and regulations derived from it, shall take into consideration and incorporate the following applicable legal and reference framework:
• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, GDPR – General Data Protection Regulation), on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
• Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights.
• Law 34/2002 of 11 July on Information Society Services and Electronic Commerce.
• Regulation (EU) 2026/1744 on artificial intelligence, insofar as it is applicable to the use, development, acquisition or supervision of technologies that may affect information security, data protection or individuals’ rights.

Likewise, any other legal, regulatory, contractual or sector-specific provisions that may be applicable depending on the nature of the services provided, the business processes carried out and the information security requirements associated with them shall also be taken into consideration.

5. GENERAL PRINCIPLES

In order to ensure compliance with the security objectives identified above, the Information Security Policy formalises the application of certain security principles.

5.1 SECURITY AS A COMPREHENSIVE PROCESS
Security is understood as a comprehensive process comprising all human, material, technical, legal and organisational elements related to the information systems used to support the execution of business processes. Accordingly, all security activities shall be carried out from this perspective, avoiding isolated actions or ad hoc approaches.

Particular attention shall be paid to raising awareness among the people involved in carrying out business processes and their line managers, in order to prevent lack of knowledge, insufficient organisation and coordination, or inadequate instructions from becoming sources of information security risk.

5.2 RISK-BASED SECURITY MANAGEMENT
Risk analysis and management are an essential part of the security process and must constitute an ongoing and continuously updated activity. They shall enable the maintenance of a controlled information environment, minimising risks to acceptable levels formally established by Management.
Risk reduction to such levels shall be achieved through the application of security measures in a balanced manner proportionate to the nature of the information processed, the services provided and the risks to which the various information assets used are exposed.

5.3 PREVENTION, DETECTION AND RESPONSE
Information security must encompass actions relating to prevention, detection and response in order to minimise existing vulnerabilities and ensure that threats do not materialise or, should they do so, do not seriously affect the information or services provided.

Preventive measures, which may include components aimed at deterrence or reducing the attack surface, must reduce the likelihood of threats materialising.
Detection measures shall be aimed at providing early warning of any scenario involving the materialisation of threats.

Response measures, which shall be managed in a timely manner, shall be aimed at restoring information and services that may have been affected by a security incident.

5.4 DEFENCE LINES
The protection strategy must comprise multiple layers of security arranged in such a way that, when one layer is compromised, an appropriate response can be made to incidents that could not be prevented, thereby reducing the likelihood of their propagation.
The lines of defence must consist of organisational, physical and logical measures.

5.5 CONTINUOUS MONITORING AND PERIODIC REASSESSMENT
Continuous monitoring shall enable anomalous activities or behaviour to be detected and addressed in a timely manner. Ongoing assessment of the security status of information assets shall make it possible to measure their evolution, detect vulnerabilities and identify configuration deficiencies.
Security measures shall be periodically reassessed and updated, adapting their effectiveness to the evolution of risks and protection systems and, if necessary, leading to a reassessment of the overall security approach.

5.6 SEGREGATION OF RESPONSIBILITIES
Responsibility for information security shall be separate from responsibility for the operation of information systems.

5.7 SECURITY AS AN INTEGRATED AND EXTENDED MODEL
Information security shall be managed in an integrated manner across all areas necessary for the protection of information assets, including, among others, human resources, supplier relationships, the use of cloud services, the protection of information in transit and at rest, business continuity, regulatory compliance and security arising from the use of new technologies.
In this regard, information security shall not be limited to the organisation’s internal environment, but shall also encompass scenarios involving third parties, outsourced environments, supply chains or technology platforms whose use may affect the confidentiality, integrity, availability and traceability of information.

5.8 SECURE USE OF EMERGING TECHNOLOGIES
The use, acquisition, development or integration of emerging technologies, including those incorporating artificial intelligence capabilities, shall be carried out in a controlled manner and in alignment with the applicable principles of information security, data protection and regulatory compliance.
In this regard, it shall be ensured that such technologies are assessed from the perspective of risks that may affect the confidentiality, integrity, availability and traceability of information, as well as individuals’ rights, while maintaining an appropriate level of organisational oversight and control at all times.

6. THIRD PARTIES
Where any of the entities that make up PONS requires the involvement of third parties for the provision of a service, those third parties shall be made aware of the security rules and regulations applicable within the context of such collaboration and shall be subject to the obligations established therein.

In relationships with third parties, particular attention shall be paid to risks arising from the supply chain, the outsourcing of services and the use of external or shared technological environments. It must be ensured that the required security measures are proportionate to the risk associated with the service provided and the type of information affected.
Specific procedures shall be established for reporting and resolving security incidents that may arise during the provision of the service.

Where any aspect of the security rules and regulations cannot be met by a third party, authorisation from the person responsible for the ISMS shall be required, following identification of the risks involved and the manner in which they shall be addressed. The relevant contract may not be formalised until such authorisation has been obtained. In all cases, depending on their classification, such authorisations shall be reported to the Security Committee so that the appropriate decisions may be taken.

Approved exceptions shall be duly recorded in the Exceptions Register.

7. REVIEW

The Information Security Policy shall be reviewed annually by the Security Committee or whenever a significant change makes such a review necessary.
The review shall take into consideration, at a minimum, changes in the organisation’s business strategy, the technical environment, regulations, articles of association, legislation, applicable contracts, information security risks, the current and anticipated threat landscape and lessons learned from information security events and incidents.

If a new version of the Information Security Policy is issued, formal approval by Management shall be required before it is communicated.

8. APPLICABLE SANCTIONS

Any duly substantiated failure to comply with or violation of the guidelines set out in the Information Security Policy, or of the operating practices and security measures identified in the rules and regulations derived from it, may result in the application of internal administrative sanctions.
Exceptions to this Information Security Policy must be justified in advance through the application of a formal risk acceptance process. Such exceptions must be entered in the Exceptions Register and shall be monitored by the Security Committee.

9. ENTRY INTO FORCE

Text approved by Management on 5 October 2026.
Its entry into force entails the repeal of any other policy previously in place for such purposes, as well as its publication on the corporate Intranet.

Management.