Information security guideline for external use

Preamble

This guideline for external parties is an extract from the realcore internal guideline on information security.

Business processes, information technology, threat scenarios and security technology are subject to continuous change, as is the external environment in which an organization operates, for example as a result of new laws and regulations. Information security is therefore an important process for realcore, and its suitability and effectiveness play a key role in the success of our organization. This guideline for information security manifests the assumption of overall responsibility by the steering committee formed for the realcore information security management system (ISMS). This commitment to information security ensures the future work on the information security management and makes it binding.

    Importance of information security at RealCore

    Data and information are processed, stored and transmitted electronically in almost all areas of our organization. This data reflects the values of RealCore that need to be protected. Information technology plays a key role in all departments, both in communication with customers and with business partners and other organizations. The importance of information security can be seen in the following examples:

    • Personal data is processed in our HR department and in many areas of work. This information must be protected in the interests of the data subjects as for legal reasons.
    • Due to business relationships with partners and customers, confidential information is held and processed in many areas of our organization. Misuse of this information not only damages the reputation and business success of our organization but can also result in legal consequences and claims for damages. This misuse must therefore be prevented.
    • The success of our organization is based on our innovative ideas and technologies and the processes we use. This information is therefore subject to confidentiality and must be protected from both internal and external unauthorized access.
    • The protection of future development and investment projects is also an important success factor and helps to maintain and improve our competitiveness. This information about future projects is therefore subject to confidentiality and must be protected against industrial espionage, among other things.
    • This makes it clear that functional information technology and a security-conscious approach to it are essential prerequisites for business success. The availability, integrity and confidentiality of information must be guaranteed. Through this guideline for information security, the top management assumes overall responsibility within realcore. Based on this responsibility for information security, we have introduced an information security management process. This includes the development and implementation of this guideline and a further security concept. This security concept also includes compliance with the guideline and the regular review of the security concept for its effectiveness and appropriateness.

    Scope

    This guideline on information security is binding for RealCore and, where applicable, for external employees and service providers. This guideline is the basis for further, more specific information security policies.

      Obligation of each individual employee

      Every employee is required to respect the principles of information security. The individual managing directors of RealCore are responsible for obliging their employees to comply with the guideline.

        Key principles of information security

        The following key principles of information security apply to RealCore:

        • “Confidentiality”: Confidentiality is the protection against unauthorized disclosure of information. Confidential data and information may only be accessed by authorized persons in the permitted manner.
        • “Availability”: The availability of services, functions of an IT system, IT applications or IT networks or of information is ensured if these can always be used by users as intended.
        • “Integrity”: Integrity refers to ensuring the correctness of data and the correct functioning of systems. When the term integrity is applied to “data”, it means that the data is complete and unchanged. In information technology, however, it is usually defined more broadly and thus also applied to “information”. The term “information” is used for “data” which, depending on the context, can be assigned certain attributes such as author or time of creation. The loss of integrity of information can therefore mean that it has been altered without authorization, information about the author has been falsified or the time of creation has been manipulated.

        Security objectives

        Information technology at realcore is a necessary prerequisite for all our organizational areas and operational activities. Our data and the data of our customers are secured with regard to the defined protection goals in such a way that a failure of important IT systems is tolerable and our organization, employees and customers do not suffer any damage as a result.

          Core objectives of the security strategy

          The following aspects of information security are particularly important to us when assessing the risks, the value of the assets to be protected and the justifiable expenditure of personnel and financial resources:

          • The confidentiality and integrity of information important to the organization must be protected. Confidentiality instructions must be strictly followed when handling electronic documents and information.
          • The laws and regulations relevant to the organization as well as contractual and regulatory obligations must be complied with.
          • Business processes, applications and information technology must be carefully thought through and easy to manage. Complex structures that lead to unnecessary risks must be avoided.
          • All employees must be aware of potential threats and behave in a safety-conscious manner.
          • Claims for compensation, claims for damages and reputational damage caused by security deficiencies in the handling of IT must be prevented.
          • Buildings and premises of our organization are protected by adequate access controls. Access to IT systems is also protected by appropriate access controls and access to information is protected by a restrictive authorization concept.
          • It is to be ensured that information security concerns are adequately taken into account when making investments.
          • Communication with external networks must be particularly protected. This applies both to external access to our network (e.g. home workstations or partner network access) and to access from our network to external systems. Access and actions carried out must be logged by the system.
          • When developing concepts and introducing measures for information security, we always aim to assure compliance with the generally recognized standards of the ISO 27000 series.

          Information security management system

          RealCore implements an information security management system that is based on the phases of a Plan-Do-Check-Act (PDCA) control process.

          • The information security process is initiated by the steering committee through the adoption of a guideline on information security.
          • A standardized reporting system is in place.
          • Comprehensible documentation of procedures and information classification.
          • Regular effectiveness checks are conducted to ensure the effectiveness of the applied measures.

          Information security policies

          Information security policies serve to regulate and control information security. These policies are adjusted, amended or withdrawn as part of the information security process. The information security policies are to be made freely accessible and available to all employees. Documents relevant for external parties are determined on a case-by-case basis and made available accordingly.

            Organization of information security

            Sustainable implementation of information security is only possible through teamwork with the active cooperation of each individual employee.

            To this end, it is necessary to define and implement the objectives of information security and the resulting measures.

            The top management is responsible for ensuring that the internal organizational units and any affiliated companies comply with information security and adopts this information security guideline.

            A central information security officer has been appointed by top management as the central information security body and thus reports to the top management accordingly.

            (If you have any questions about information security contact infosec@realcore.de.)

              Key statements on enforcement and performance monitoring

              The enforcement of this guideline for RealCore is regulated by the top management. Part of this regulation is the guideline on information security and the associated policies. Every employee is obliged to handle the information available to them with the appropriate care. Grossly negligent breaches of information security can lead to disciplinary consequences, including termination of employment and possible consequences under criminal and civil law. Liability claims may be asserted in the event of financial losses.

                Updating the guideline for information security

                The security concept is reviewed annually by the information security officer to ensure that it is up to date, effective and adapted as necessary. Top management supports the continuous improvement of the security process. Employees and external parties are encouraged to report possible improvements or weaknesses to the Information Security Officer (ISO). Continuous monitoring of the regulations and compliance with them ensures the desired level of security. Deviations are analyzed with the aim of improving the information security and keeping it up to date with the latest security technology.