Information Security Policy

This policy applies to LOGEX Group entities, activities, personnel, contractors, information, technologies and relevant third parties included within the formally approved scope of the LOGEX Group ISMS.

The specific organizational, geographical, product, service and certification boundaries are defined in the applicable ISMS scope statements and certification documentation.

LOGEX Group commits to:

• protecting information against unauthorized access, disclosure, alteration, loss and unavailability;
  
  
• managing information security risks through appropriate and proportionate controls;
  
  
• establishing and monitoring information security objectives that support the confidentiality, integrity and availability of information, security awareness and reliable service delivery;
  
  
• meeting applicable legal, regulatory, contractual, customer and certification requirements;
  
  
• considering information security throughout the design, development, acquisition, operation, change and decommissioning of products, services, systems and processes;
  
  
• assigning appropriate information security responsibilities and providing the resources necessary to operate the ISMS effectively;
  
  
• promoting information security awareness and requiring personnel and relevant external parties to comply with applicable security requirements;
  
  
• maintaining appropriate arrangements for reporting and managing information security incidents; and ---
  
  
• continually improving the suitability, adequacy and effectiveness of the ISMS through risk management, monitoring, audits, management reviews and corrective actions.

Depending on the relevant entity, jurisdiction, product, service and certification scope, LOGEX Group’s information security and compliance programme takes account of applicable requirements arising from:

• ISO/IEC 27001;
• NEN 7510-1;
• NIS2
• DigiD and Toegangsverleningsservice requirements;
• the MedMij Afsprakenstelsel;
• ISAE 3402;
• C5;
• Cyber Essentials and Cyber Essentials Plus;
• the NHS Data Security and Protection Toolkit; and
• applicable data protection legislation and regulatory guidance, including requirements overseen by the UK Information Commissioner’s Office.

The authoritative applicability of these and other obligations is determined through LOGEX Group’s legal and regulatory compliance process. Where multiple requirements apply, LOGEX follows applicable local law and adopts the stricter applicable requirement where appropriate.

LOGEX Group executive committee is accountable for supporting the ISMS and ensuring that this policy is compatible with LOGEX Group’s strategic direction. The designated ISMS Owner is responsible for maintaining the policy and overseeing the effectiveness of the ISMS, supported by the Information Security Office function and relevant business representatives.

This policy is communicated within LOGEX Group, made available to relevant interested parties and reviewed at least annually and following significant changes affecting the organization, its risks or its applicable obligations.

Approved by: LOGEX Group Top Management
Policy owner: ISMS Owner
Review frequency: At least annually and upon significant change