NormNest

Our organization maintains a comprehensive inventory of all information and information processing assets through our internal platform, my.cloudcom. This platform enables us to document, review, and update asset records efficiently, including fixed and portable computers, mobile devices,  network infrastructure, and other connected or standalone components.

The inventory is continuously maintained and updated when changes occur, supported by appropriate approval flows to ensure traceability and accountability. my.cloudcom supports the management of both networked and non-networked assets and functions as a centralized IT asset management tool aligned with best practices and compliance requirements.

Our organization maintains an up-to-date inventory of all software platforms and applications in use, including internally hosted solutions and outsourced services (e.g., SaaS), through our platform my.cloudcom. This platform ensures that every entry—whether software program, platform, or database—is properly documented with key attributes such as name, description, version, number of users, and the type of data processed.

Changes to the software inventory are managed through an appropriate approval flow within my.cloudcom, ensuring updates are authorized and traceable.

Our organization identifies and categorizes all types of information it stores and uses, and this information is documented and maintained within our Information Security Management System (ISMS), which supports our ISO/IEC 27001:2022 implementation.

The ISMS contains a structured list of information types relevant to our business operations, including but not limited to:

• Customer and supplier data (e.g., names, email addresses, contracts)

• Financial information (e.g., invoices, banking details)

• Internal documentation (e.g., procedures, reports)

• Technical data (e.g., source code, configuration files, system logs)

• Regulatory and compliance records

• Proprietary business information and intellectual property

This inventory of information is regularly reviewed and updated as part of our ISMS processes. Furthermore, we map each type of information to associated physical assets, systems, software platforms, and applications—as outlined in our hardware and software inventories (referencing ID.AM-1 and ID.AM-2)—to ensure a clear understanding of where information resides and how it is processed, transmitted, or stored.

Our organization has conducted a comprehensive risk assessment as part of our ISMS aligned with ISO/IEC 27001:2022, which includes an evaluation of the criticality, classification, and business value of all organizational resources—such as hardware, devices, data, time, personnel, information, and software.

Through this process, we analyze potential impacts on confidentiality, integrity, and availability for each resource by asking:

• What would happen if the resource were made public, damaged, or lost?

• What would be the consequences if the resource’s integrity were compromised?

• What would the impact be if the resource became unavailable to us or our customers?

Based on this analysis, all resources are prioritized and classified according to their business impact, and appropriate controls and safeguards are implemented in line with their level of criticality. This classification supports our decision-making regarding access control, backup strategy, incident response, and continuity planning.

Our organization has a comprehensive set of documented policies and procedures in place for information security and cybersecurity, developed in accordance with the ISO/IEC 27001:2022 standard.

These documents clearly define acceptable practices, responsibilities, and expectations regarding the protection of our information assets and systems. They are used to guide daily operations, support investigations in case of security incidents, and ensure a shared understanding across the organization.

As part of our onboarding process for new employees and consultants, we include a dedicated information security onboarding procedure, ensuring all individuals are aware of their responsibilities and our security policies from day one.

All policies and procedures are:

• Reviewed and approved by management,

• Updated promptly following organizational or technological changes, and

• Formally reviewed at least annually as part of our ISMS lifecycle.

Policy updates are communicated clearly to all staff to ensure continued awareness and compliance.

Our organization identifies, understands, and implements all relevant legal and regulatory requirements related to information security, cybersecurity, and privacy, in particular those arising from the General Data Protection Regulation (GDPR).

As part of our ISO/IEC 27001:2022-aligned ISMS, we maintain a register of applicable legal and regulatory requirements, which is reviewed regularly to ensure continued compliance. This includes data protection obligations, incident reporting duties, data subject rights, and requirements related to the processing, storage, and transfer of personal data.

Our internal policies, procedures, and technical controls are designed to ensure that privacy and data protection principles—such as data minimization, purpose limitation, integrity, confidentiality, and accountability—are consistently applied across all business operations.

All employees and relevant contractors are made aware of these obligations during onboarding and through ongoing training initiatives.

As part of our ISO/IEC 27001:2022 implementation, our organization has developed a comprehensive strategy for managing information security and cybersecurity risks as an integral component of our overall risk management framework.

This strategy includes:

• The identification of information security objectives aligned with our business goals,

• The assessment and treatment of risks to business-critical assets,

• The allocation of appropriate resources (personnel, technology, budget) to implement and maintain security controls, and

• A continuous improvement cycle that ensures the strategy is updated when changes occur in our organization or threat landscape.

Our approach ensures that information and cybersecurity risks are managed proactively and in a structured manner, with clear responsibilities and measurable targets.

Our organization identifies threats and vulnerabilities as part of the security objectives and risk assessment process defined in our ISO/IEC 27001:2022-compliant ISMS.

During regular risk assessments, we evaluate:

• Vulnerabilities in hardware, software, procedures, and human factors that could expose our assets,

• Threats that could exploit these vulnerabilities, including both internal and external sources, and

• The associated risks, based on the likelihood and potential impact of such threats materializing.

This structured process enables us to maintain a clear understanding of our threat landscape and prioritize the implementation of appropriate risk treatment measures to reduce or mitigate risks to acceptable levels.

Identified threats and vulnerabilities are documented, reviewed periodically, and updated in response to changes in technology, operations, or the external environment.

Our organization conducts formal risk assessments in accordance with our ISO/IEC 27001:2022-aligned ISMS, where risk is determined based on the relationship between threats, vulnerabilities, and their potential impact on business processes and assets.

We systematically:

• Identify threats that could exploit known or potential vulnerabilities,

• Assess the potential impact of these risks on the confidentiality, integrity, and availability (CIA) of our information assets,

• Evaluate how these risks could affect critical business processes, and

• Document, review, and update risk scenarios as part of our regular risk management cycle or when significant changes occur.

The results of these assessments guide our risk treatment planning and ensure that appropriate safeguards are in place to protect our organization’s operations and assets