1. POLICY AND MANAGEMENT COMMITMENT
1.1 Policy Statement
The Management of The Nest Company Srl (TNC), aware of the strategic importance of quality and information security in the context of SMEs working with significantly larger enterprise clients, has implemented an appropriate Integrated Management System (IMS) aligned with the principles of ISO 9001:2015 and ISO/IEC 27001:2022 standards, extended to ISO/IEC 27017.
The management of chain of custody, authenticated digital declarations, and the digital product passport involves handling sensitive and critical data for our clients. TNC recognizes that client trust is based on the continuous demonstration of technical competence, regulatory compliance, and management maturity comparable to the highest industry standards.
1.2 Strategic Objectives
Quality Objectives
- Deliver software and services that meet the specifications and contractual commitments agreed with clients.
- Ensure that development projects meet traceability, authenticity, and data integrity requirements.
- Enhance the professional skills of employees and collaborators.
- Develop innovation initiatives while respecting security and compliance constraints.
- Maintain a performance-based results evaluation system.
Information Security Objectives
- Ensure confidentiality, integrity, availability, and resilience of information.
- Ensure full awareness of managed information and evaluation of its criticality.
- Guarantee secure access by preventing unauthorized processing.
- Ensure secure collaboration with third parties.
- Promote awareness of security-related issues.
- Promptly detect anomalies and incidents.
- Ensure authorized access to operational facilities.
- Ensure compliance with legal and contractual requirements.
- Detect abnormal events and vulnerabilities.
- Ensure Business Continuity and Disaster Recovery.
1.3 Commitment of Top Management
- Provide adequate resources: Allocate human, technical, and financial resources for the IMS.
- Establish clear governance: Define roles, responsibilities, and reporting structures.
- Ensure competence: Guarantee continuous staff training.
- Promote a security culture: Integrate security into the company culture.
- Manage the supply chain: Ensure security standards are applied to suppliers as well.
- Monitor and review: Conduct annual reviews of performance and processes.
- Communicate the policy: Publish it on the website and communicate it internally.