165
information, maintaining customer trust, and ensuring the integrity, confidentiality, and availability of its
services. The key objectives are based on the following pillars:
o Confidentiality: Ensuring customer data is accessible exclusively by authorized personnel.
o Integrity: Preventing unauthorized modifications, corruption, or destruction of data.
o Availability: Guaranteeing uninterrupted access to systems and services.
These pillars serve as the foundation for managing potential risks and delivering enhanced value to
customers. The Information Security Policy proactively addresses risks such as cyber threats by
implementing advanced preventive measures, including state-of-the-art security protocols, regular system
updates, and rigorous stress testing. Furthermore, it ensures strict adherence to GDPR (General Data
Protection Regulation) and other privacy regulations while safeguarding customer experiences from
operational disruptions. The implementation of the Information Security Policy is monitored through regular
internal audits, quarterly security assessments and periodic reporting to the Executive Committee. The
scope of Information Security Policy, along with its supplementary policies, implementation guidelines, and
procedures apply to all employees, operational units, and affiliated entities such as subsidiaries, regional
offices, controlled or associated companies, external suppliers, and partners. It covers the creation,
processing, communication, distribution, storage, and availability of information related to the organization,
including both its internal operations and external interactions. This encompasses customer data, personal
data, and other sensitive information shared with or processed by third parties, collaborators, suppliers, or
contractors. The Information Security Policy applies to all systems, applications, and network infrastructure
used by the organization, regardless of format (digital, physical, or otherwise), as well as any locations or
facilities where information is stored. It encompasses the entire value chain, both upstream and
downstream, to ensure compliance and the implementation of security measures across all affected
stakeholder groups. The Executive Committee and the CISO are entrusted with the implementation and
oversight of the Information Security Policy, ensuring consistent compliance across all departments,
employees, and external partners. This policy aligns with European standards, as outlined by EU directives
and regulations, including GDPR, PSD2, and the Basel II guidelines established by the Basel Committee. At
the same time, it follows internationally recognized standards, such as ISO/IEC 27001:2013 and PCI DSS,
which support compliance with EU requirements and ensure high levels of security. Stakeholders’ interests,
including feedback from customers and employees, are taken into consideration throughout the
development of the Information Security Policy, ensuring it aligns with their expectations and concerns.
The Information Security Policy is delivered to employees automatically through a dedicated platform upon
their employment contract signing, requiring mandatory electronic acknowledgment and acceptance,
ensuring comprehensive understanding and compliance from day one. Implementation support is provided
through regular training sessions and dedicated help desk services. It is readily available on the intranet
and key provisions are shared with external stakeholders through secure portals and documented
procedures
•
Information Security Incident Management Policy:
The Information Security Incident
Management Policy encompasses various aspects related to managing material sustainability matters.
Firstly, this policy outlines its main objectives, which include the effective and efficient recording and
management of security incidents, in accordance with the relevant contractual, social, and legal obligations.
The Information Security Incident Management Policy covers all the activities, employees, and partners,
while excluding systems that do not belong to the Group. Additionally, the Group has established a Security
Incident Response Procedure, enabling timely communication with affected customers and efficient incident
management. The highest level in the organization accountable for the implementation of the Information
Security Incident Management Policy is the Executive Committee of the Bank, while the Chief Information
Security Officer is responsible for ensuring the Information Security Incident Management Policy's
implementation. This policy also references third-party standards such as ISO 27001:2013, which the Group
commits to adhere to through its implementation. The Information Security Incident Management Policy
takes into consideration the interests of key stakeholders in its formulation, ensuring that their needs and
concerns are integrated into the incident management processes. Finally, the Information Security Incident
Management Policy is made available to potentially affected stakeholders and those who need to help
implement it through internal communications and training programs.