Information Security Policy

As a company, we strive to be prepared and protected for potential information security risks and resulting issues. Following a continuous improvement approach, we will safeguard our system integrity, our information assets, our client’s information assets, secure products and manufacturing processes.

Information security is an ongoing process to ensure confidentiality, integrity and availability of information assets. These information assets can be in both technical and non-technical form. Failure to secure information assets in today’s highly networked environment can damage or shut down systems that operate our company, lead to financial loss, compromise data and products as well as result in legal and regulatory non-compliance.

Therefore, information security is an important and active part of our company and every employee.
In order to maintain a high standard of information security, every employee is obliged to comply with related internal rules and with applicable laws and regulations (e.g the EU General Data Protection Regulation)

The company will maintain and continuously improve its information security through the following aspects:

1. We are committed to maintaining and continually improving our Information Security Management System (ISMS) in accordance with ISO 27001.
2. We strive to protect and maintain the confidentiality, integrity and availability of company & client information and related infrastructure assets.
3. We assure a secure and stable information technology environment with technical, organizational and processional measures. We establish the required technical and organizational measures to protect data, both at the time of determining means and purpose for processing and at the time of processing itself.
4. We actively manage the risk of security exposure or compromise.
5. We monitor our system and information assets for anomalies that might indicate compromise.
6. We identify and respond to events involving information asset misuse, loss or unauthorized disclosure. We ensure that (potential) data breaches are reported to management and thoroughly investigated to resolve them and avoid recurrence.
7. We promote and increase the awareness of information security. The emerging culture of information security stimulates responsibility and ownership concerning data protection and privacy.
8. Every congatec employee, contractor, consultant, temporary, and other workers, including all personnel affiliated with third parties ensures their work is compliant with all released congatec IT directives and regulations. This also includes employees that are leaving the company.
9. We actively work on achieving our information security goals each review period. The objectives are aligned with our ISO 27001 Information Security Management System and reflect the commitments identified above.