Legal

Our information security policy

CGC's commitments to the confidentiality, integrity and availability of information, in accordance with ISO 27001:2022.

Last updated: October 2026

CGC SOLUTIONS, S.L., a company specialising in innovation (Business Analytics, Business Intelligence, Intelligent Automation and Generative AI), data services (Data Strategy, Data Science, Data Engineering), Cyberanalytics services and IT Infrastructure Control and Management, has implemented an Information Security Management System based on the requirements of ISO 27001:2022. Its aim is to ensure that all information technology assets and resources are used and managed in a way that protects their confidentiality, integrity and availability, in order to ensure the continuity of the business lines, minimise damage, maximise the return on investments and business opportunities, and drive continuous improvement.

Management commitments

By developing and implementing this Information Security Management System, the Management of CGC SOLUTIONS, S.L. makes the following commitments:

To develop solutions and services that comply with legal requirements, identifying the legislation applicable to the business lines carried out by the organisation and included in the scope of the ISMS.
To establish and comply with contractual requirements with interested parties.
To build and maintain the trust of clients, employees and regulators.
To guarantee the confidentiality of users' data.
To provide information security training and awareness programmes for all employees and other interested parties.
To prevent and detect any virus and other malicious software by developing specific policies and establishing contractual agreements with specialised organisations.
To carry out information security risk assessments in order to identify and implement controls that mitigate the impact of the risks identified.
To develop and maintain business continuity and disaster recovery plans.
To establish the consequences of breaches of the security policy, which will be reflected in the contracts signed with interested parties, suppliers and subcontractors.
To promote a culture of continuous improvement in information security management and implement improvements based on the analysis of incidents, audits and periodic reviews.
To act at all times in accordance with the strictest professional ethics.
To ensure that information systems are accessed and used securely and in accordance with established policies.
To maintain the brand's reputation with regard to data security.
To properly manage the information lifecycle, so that incorrect use can be prevented at any stage.
The organisation's staff will take part in managing incidents related to services and information security management, in order to restore normal service operation levels as quickly as possible and minimise the adverse impact of such incidents on the organisation.
To ensure the protection of intellectual property rights.
To periodically set a series of objectives and indicators that allow management to properly monitor the service levels provided and management activities.

Management undertakes to provide the resources needed to maintain and improve the Information Security Management System (ISMS).