Purpose and Management commitment
ITEC S.r.l. provides SAP consulting and development services and software solutions to its customers. Protecting information (of customers, employees and the company) is an essential condition for business continuity and for the trust that customers place in ITEC.
Management is committed to protecting the confidentiality, integrity and availability of the information processed, to complying with the applicable legal, regulatory and contractual requirements (including the GDPR and customers' contractual security requirements), and to pursuing the continual improvement of the Information Security Management System (ISMS).
Scope
This policy applies to all information processed by ITEC, to all employees and collaborators, to all company devices and services and to the activities carried out at or on behalf of customers.
Principles
- Customers' information stays in the customers' systems: ITEC does not store customer data in its own systems unless expressly authorised and regulated.
- Every access is personal, protected by multi-factor authentication and limited to the minimum necessary (least privilege, need-to-know).
- All company devices are centrally managed, protected and encrypted.
- Company data resides exclusively on the company cloud services; saving it to unauthorised local or removable media is forbidden.
- Security incidents are handled according to a dedicated procedure, with notification to the affected customers within the contractual time limits.
- Security is everyone's responsibility: staff receive periodic training and formally acknowledge the Rules for the use of information systems.
Roles and responsibilities
- Management: approves the policy and the ISMS documents, allocates resources, reviews the system at least annually; it is the security contact for customers, reachable in the event of an incident.
- Internal technical lead: supervises the technical implementation of the security measures.
- External security consultant: supports the design, implementation and monitoring of the ISMS and the handling of security alerts.
- All staff: apply the policies and promptly report security events and anomalies.
Security objectives
- No loss or unauthorised disclosure of customer data.
- Compliance with customers' contractual security requirements.
- Annual review of this policy and of the security risks.
Normative references
UNI CEI EN ISO/IEC 27001:2024 (§5.2 Policy); ISO/IEC 27002:2023 control 5.1.
Document ITEC-POL-01, version 1.0 of 22/07/2026, approved by the Management of ITEC S.r.l. on 21/10/2026.