# Information Security and Privacy Policy | MTechnology > MTechnology S.A.S. Information Security Management System policy: objectives, scope, principles and how to report a security incident. URL: https://mtechnology.co/en/information-security-and-privacy-policy Actualizada: 2026-09-29 --- [← Home](https://mtechnology.co/en) Legal document Version 2 Published May 30, 2025 # Information Security and Privacy Policy Statement by General Management on the Information Security Management System (ISMS, SGSI in Spanish) of MTechnology S.A.S., aligned with ISO/IEC 27001 and MinTIC Guide No. 2 (Colombia’s Ministry of Information and Communications Technologies). This is a courtesy translation. The binding version of this document is the Spanish one: [read it in Spanish](https://mtechnology.co/politica-de-seguridad-y-privacidad-de-la-informacion). ## 01 Introduction and commitment The Management of MTechnology S.A.S., understanding the strategic importance of information as a vital asset for achieving our vision and serving as catalysts of digital transformation, firmly commits to the implementation, operation and continual improvement of an Information Security Management System (ISMS). ## 02 Purpose This policy sets out the high-level statement that guides the position and commitment of MTechnology S.A.S. regarding the comprehensive protection of its information assets. Its purpose is to define the general framework for managing security and privacy, ensuring that the controls needed to maintain trust and achieve our objectives are implemented. ## 03 Security and privacy objectives MTechnology S.A.S. recognizes that information is one of its most valuable and strategic assets, and that safeguarding and properly managing it is essential to ensure operational continuity, the trust of its stakeholders and regulatory compliance. The objectives are structured as pillars of the ISMS, aligned with the ISO/IEC 27001 standard and MinTIC Guide No. 2: Reduce risk in critical processes Implement proactive and reactive measures that mitigate the likelihood and impact of threats that could compromise the operation, reputation or integrity of our platforms, processes or services. Confidentiality, integrity and availability Rigorously comply with the fundamental principles of information security: that only authorized persons have access, that information remains accurate and complete, and that it is available when required. Regulatory compliance Ensure that all information management is carried out in accordance with current Colombian legislation, including Ley 1581 (Colombia’s personal data protection law), Ley 1266 (the financial and credit data law) and the Digital Government ( Gobierno Digital ) regulations. Preserve trust Establish a solid security environment that reinforces trust in every commercial, contractual or institutional interaction with clients, partners, employees and oversight bodies. Secure and resilient innovation Encourage the development and implementation of disruptive technologies under adequate control frameworks, making it possible to scale digital solutions without sacrificing security or compliance. A robust and dynamic ISMS Develop, document, implement and continually refine the system, integrating it with risk management, business continuity and organizational quality. Protect our own and third-party assets Establish physical, logical and administrative controls that safeguard information in any format, at any stage of its life cycle and over any transmission channel, including information stored in the cloud, in internal databases or on mobile devices. Standardize documentation Ensure that formal, accessible and up-to-date documents exist to guide staff in the secure management of information, from its creation to its final disposal. Security culture Continuously raise awareness and train the team, promoting responsible, ethical and preventive behavior under a philosophy of “security by design and by default.” Business continuity Develop resilience capabilities that ensure the efficient recovery of operations in the event of disruptive events, cyberattacks or technical failures. ## 04 Scope and applicability This policy applies to all employees, contractors, suppliers and third parties who access the information assets of MTechnology S.A.S. ## 05 Level of compliance 100% compliance is required. Non-compliance will carry the consequences defined in section 8 of this policy. ## 06 Security principles and policies MTechnology S.A.S. adopts the following principles as the pillars of its ISMS: - **Clear responsibilities.** Information security responsibilities will be defined, shared, published and accepted by each team member and by the relevant third parties. - **Asset protection.** All information generated, processed or safeguarded by business processes, and the associated information assets, will be protected. - **Third-party management.** Information will be protected against risks arising from access granted to third parties: suppliers, clients and freelancers. - **Proper use and classification.** Information will be protected to minimize financial, operational or legal impacts from improper use, applying controls based on its classification. - **Personnel security.** Information will be protected from threats originating from personnel, through awareness, agreements and controls. - **Physical and environmental security.** Processing facilities, including remote ones, and the technology infrastructure that supports critical processes will be protected. - **Operational security.** The operation of business processes will be controlled, ensuring the security of technology resources and networks. - **Access control.** Strict access control to information, systems and network resources will be implemented, based on the principle of least privilege. - **Security across the life cycle.** Security will be ensured as an integral part of the life cycle of our systems and developments. - **Incident and vulnerability management.** Events and weaknesses will be properly managed for an effective improvement of the security model. - **Business continuity.** The availability of critical processes and the continuity of operations will be ensured. - **Legal and contractual compliance.** Compliance with legal, regulatory and contractual obligations will be ensured. ## 07 Development of specific policies To put these principles into practice, MTechnology S.A.S. will develop and implement specific policies, procedures and work instructions covering, at a minimum, the areas recommended by MinTIC Guide No. 2: organization of security, asset management, access control, cryptography, physical security, operations, communications, acquisition and development, supplier relationships, incident management, continuity and compliance. ## 08 Non-compliance Failure to comply with this general policy, or with the specific policies and procedures derived from it, will result in the appropriate contractual, disciplinary or legal actions, in accordance with the internal rules of MTechnology S.A.S. and applicable Colombian law. ## 09 Review and continual improvement This policy will be reviewed annually, or upon significant changes, by General Management. ## 10 Approval Approved by Camilo Bermúdez, General Manager Organization MTechnology S.A.S. · Tax ID (NIT) 901.777.774-5 ## 11 Contact for questions or security reports If you detect a vulnerability or a security incident related to our systems, please report it through the following channels: Area Information Security — MTechnology S.A.S. Email [info@mtechnology.co](mailto:info@mtechnology.co) Phone [+57 601 846 0845](tel:+576018460845) Address Carrera 11B # 99-25, Chapinero, Bogotá D.C., Colombia Contents [01 Introduction and commitment](#introduccion-y-compromiso)[02 Purpose](#proposito)[03 Security and privacy objectives](#objetivos-de-seguridad-y-privacidad)[04 Scope and applicability](#alcance-y-aplicabilidad)[05 Level of compliance](#nivel-de-cumplimiento)[06 Security principles and policies](#principios-y-politicas-de-seguridad)[07 Development of specific policies](#desarrollo-de-politicas-especificas)[08 Non-compliance](#incumplimiento)[09 Review and continual improvement](#revision-y-mejora-continua)[10 Approval](#aprobacion)[11 Contact for questions or security reports](#contacto-para-dudas-o-reportes-de-seguridad) Controller MTechnology S.A.S. Tax ID (NIT) 901.777.774-5 Version Version 2 · published May 30, 2025 Inquiries [info@mtechnology.co](mailto:info@mtechnology.co) [Write to MTechnology](https://mtechnology.co/en/contact) Other legal documents [Cookie policy →](https://mtechnology.co/en/cookie-policy)[Personal data processing →](https://mtechnology.co/en/personal-data-policy)[Website terms of use →](https://mtechnology.co/en/terms-of-use) Other documents [Cookie policy](https://mtechnology.co/en/cookie-policy)[Personal data processing](https://mtechnology.co/en/personal-data-policy)[Website terms of use](https://mtechnology.co/en/terms-of-use) Questions about these documents? Write to us at[info@mtechnology.co](mailto:info@mtechnology.co). [↑](#)