INFORMATION SECURITY ISO 27001 AND ENS
Fraternidad-Muprespa, Mutual Collaborator with Social Security, no. 275 has implemented a Information Security Management System (ISMS) according to therule UNE-ISO/IEC 27001:2022. The SGSI was audited and certified for the first time by the Spanish Association for Standardization and Certification,AENOR, in December 2010 and since then this entity has carried out the corresponding periodic audits, all of which have been successfully passed. The scope of the SGSI is the set of all computer applications and services developed by the General Subdirectorate of Information Systems, including, among others, healthcare medicine applications, electronic medical records and other developments resulting from the digitalization process undertaken by the Mutual Fund.
This certificate takes on special importance in an environment in which personal data is handled that is part of the special categories of data such as the health data of workers treated in the Mutua's healthcare centers. All of this is materialized in the Information Systems Security Policy, which guarantees the commitment and diligence of the Management.
In addition, in 2024 the certification of the Digital Office has been received according to theNational Security Scheme, regulated in the Royal Decree 311/2023 of January 8. The certification has been issued by AENOR and its scope extends to the digital services provided by the Mutual Fund to the users of its Digital Office, that is: associated companies, collaborating consultancies, affiliated self-employed workers, suppliers and insured employees. The National Security Scheme is applicable to the entire public sector, and therefore to Fraternidad-Muprespa as a Mutual Collaborator with Social Security.
In addition, Fraternidad-Muprespa periodically performs audits of thedata processingpersonal data for which it is responsible, preserving the standard established in the previous legislation regardingdata protection, which although currently not mandatory, the entity considers it essential for their adequate protection. Thecompanyresponsible for this audit, which is contracted in accordance with the Public Sector Contracts Law through an open procedure with advertising, issues a certificate of completion of the audit that is available to our companies, self-employed workers and protected workers, as well as the rest of the agents of interest, including theSpanish Data Protection Agency.
In short, the objective that Fraternidad-Muprespa pursues with this management system is to offer a set of information systems that support the service provided to all its mutual members, guaranteeing compliance with regulations and security in each of its dimensions, that is; integrity, availability, confidentiality, traceability and authenticity, which is reflected in a quality service aligned with its principles ofSocial ResponsibilityCorporate.
Fraternidad-Muprespa was the first Mutual to certify all its computer systems under the standard ISO 27001, including healthcare medicine applications.
