CLOUD LEGION is an Argentine-owned company committed to its mission of providing comprehensive IT solutions, focusing its management on delivering high-quality services. To that end, it establishes, implements and maintains an Integrated Management System (IMS) for information security, privacy and artificial intelligence, supported by processes that ensure results focused on client satisfaction, continual improvement and compliance with all applicable regulations and legislation.
The IMS also focuses on protecting information, identifying and mitigating business risks, and adopting transparent, fair and ethical management practices.
All stakeholders responsible for information and documentation repositories must adopt the guidelines set out in the IMS, which is based on the requirements of the following international standards:
- ISO/IEC 27001:2022 – Information security
- ISO/IEC 27701:2019 – Privacy information management
- ISO/IEC 42001:2023 – Artificial intelligence
To preserve the quality, confidentiality, integrity, availability and privacy of information, as well as ethical and transparent conduct, CLOUD LEGION has developed a body of policies and standards available to all stakeholders, reinforced through ongoing training that builds awareness and explains the consequences of non-compliance.
General Management commits to providing the necessary resources, periodically reviewing the performance of the IMS, and ensuring its continual improvement and the company’s long-term sustainability.
General IMS objectives
In line with our vision, mission, values and strategic planning, CLOUD LEGION sets the following objectives:
- Position ourselves as one of the most recognized specialized IT services companies in Latin America, with organic and diversified growth.
- Provide products and services that meet the requirements and expectations of clients and stakeholders, and the applicable legal and regulatory requirements.
- Be recognized by clients and team members as one of the most professional companies in the industry, standing out for the value we deliver.
- Identify, assess and mitigate the risks associated with the business, artificial intelligence, and information security and privacy.
- Build valuable relationships that strengthen trust with clients, institutions, governments, partners and other stakeholders.
- Continuously train the relevant staff on the IMS guidelines.
- Comply with the legal and regulatory requirements that apply to artificial intelligence, information security and privacy, and personal data protection.
- Periodically audit the processes within the scope of the IMS to assess their level of compliance.
- Mitigate the impact of incidents related to artificial intelligence and to information security and privacy.
- Promote an organizational culture of awareness and responsibility in artificial intelligence and in information security and privacy.
Security and privacy objectives
1. Information protection
- Classify and protect information in accordance with current regulations and internal criteria of sensitivity and importance.
- Establish mechanisms that strengthen the confidentiality, integrity, availability, legality, reliability and non-repudiation of information.
2. Risk management
- Identify, value and manage information assets and their associated risks through assessment and treatment processes.
- Periodically review risk measurements to ensure they remain valid and effective.
3. Compliance
- Comply with the legal, regulatory, contractual and service requirements related to information security and privacy.
4. Awareness and organizational culture
- Provide ongoing security and privacy training to all staff.
- Encourage communication and awareness of security guidelines at every level of the organization.
- Review this policy annually, or when significant changes occur, to ensure it remains relevant and effective.
Commitments
- All CLOUD LEGION staff, whether permanent, temporary or external, protect information assets, systems and technology infrastructure, acting responsibly and professionally.
- Every information asset has a designated owner, responsible for its inventory, classification and periodic review, including access authorizations.
- Information assets are protected according to their classification and the corresponding risk assessment.
- Every project involving information assets builds in security requirements from the start and throughout its life cycle.
- All team members must report the security incidents and weaknesses they detect.
- The organization runs a quality, security and privacy awareness and training program for all staff.
- We continually improve our security processes and controls and maintain contingency plans that ensure the continuity of our operations and of our services to clients.
- We comply with current security and privacy regulations and legislation, and with the contractual requirements agreed with our clients.
- Each area that owns information assets is responsible for eliminating, mitigating, transferring or accepting their risks throughout the asset’s life cycle.
- The Quality and Security Management team manages quality and information security matters, with authority over their implementation, control and the approval of exceptions.
Non-compliance
Failure to comply with this policy may lead to disciplinary measures in proportion to the seriousness of the breach, in accordance with applicable labor law, contractual provisions and internal policies, without prejudice to any applicable legal action.