Doowebs Dev, S.L. · Spanish National Security Framework (Esquema Nacional de Seguridad, Royal Decree 311/2022)
Version 1.0, approved by Management on 5 November 2026. Document code: DW-ENS-POL-01. This is an English translation; in case of discrepancy, the Spanish version prevails.
1. Approval and entry into force
This policy enters into force on the date of its approval by the Sole Director of Doowebs Dev, S.L. (Tax ID B01929470) and replaces any previous rule on information security. It will remain in force until it is replaced by a new approved version.
Management undertakes to provide the resources needed to comply with it and to review it at least once a year.
2. Introduction and purpose
Doowebs relies on information systems to provide its services, and its clients, including public sector bodies, trust that those systems protect their websites, their data and their access credentials. This policy sets out the principles, organisation and responsibilities with which Doowebs protects the information and the services it provides.
Its aim is to protect the availability, integrity, confidentiality, authenticity and traceability of information and services with measures proportionate to the risks and to the category of the system; to prevent security incidents, detect them and respond to them quickly; and to restore the service when they occur (articles 8 and 9 of Royal Decree 311/2022).
Doowebs adopts as its objective conformity with the National Security Framework in category MEDIUM for the system described in section 4, attested by certification from an accredited body (article 38 of Royal Decree 311/2022).
3. Mission and services
Doowebs is an agency based in València that designs, develops, hosts and maintains websites and web applications, mainly on WordPress, for private companies and public sector bodies.
The services covered by this policy are:
- Development of websites, web applications and mobile applications, and of proprietary software installed on clients’ websites, including software involved in their invoicing or payments.
- Hosting on servers managed by Doowebs.
- Technical maintenance, updates, backups, monitoring and support of websites, whether hosted by Doowebs or by the client’s provider.
- Technology and artificial intelligence consultancy, provided under the AI València brand.
- Training and support for clients, including work at their premises.
- Client service and communication regarding these services.
AI València is a trade name of Doowebs Dev, S.L.; the services provided under it are the responsibility of Doowebs and are subject to this policy.
4. Scope
The policy applies to the information system «Web development, hosting and maintenance and technology consultancy services of Doowebs», to all staff, and to the suppliers and collaborators involved in it. The system comprises the following components:
| Component | Role in the service |
|---|---|
| Hosting infrastructure | Virtual servers and hosting control panel where clients’ websites and email are hosted; the physical infrastructure is provided by an external supplier |
| Network and protection services | DNS, proxy and web application firewall for the websites |
| Email and collaboration suite | Corporate email, documentation and communication with clients |
| Code repositories | Version control and deployment of source code |
| Website management platform | Centralised management, updates, backups and administrative access to clients’ websites |
| Internal management application | Projects, tickets, recurring services and client portal |
| Internal automation application | Automated agents and staging environments |
| Internal approval system | Approval and supervision of automated tasks |
| Invoicing system | Financial management and client invoicing |
| Generative AI tools | AI assistants and agents, including their connectors to other tools, for development, code review, writing, analysis and consultancy |
| Design tools | Interface design, prototypes and graphic material |
| Proprietary distributed software | Plugins developed by Doowebs and installed on clients’ websites |
| Platforms used on behalf of the client | Payment gateways, messaging services, app stores and similar services contracted by the client and operated by Doowebs on its behalf |
| Domains and licences | Management of domains and third-party software licences used on the websites |
| Digital certificates and electronic signature | Certificates of the company and its representative for procedures with public administrations and clients |
| Credential management and remote access | Corporate password manager and virtual private network |
| Workstations | Staff computers and mobile phones, including local development environments |
| Locations | Doowebs premises, coworking spaces, remote work and work at client premises |
Details of tools, suppliers, versions and locations are recorded in the asset inventory, which is for internal use and is not published (measure op.exp.1 of Royal Decree 311/2022).
The following are outside the scope:
- The infrastructure of clients hosted with their own provider. The maintenance service that Doowebs provides to them is within scope.
- Projects unrelated to the company’s activity.
4.1 Scope of commitments
This policy sets out the objectives, organisation and principles with which Doowebs manages security. The specific obligations towards each client (service levels, deadlines, specific measures, data processing) are those set out in the corresponding contract and data processing agreement. This policy does not extend those obligations or create rights for third parties.
Absolute security does not exist. Doowebs applies measures proportionate to the identified risks and to the category of the system, documents them in the Statement of Applicability and reviews them in accordance with section 13. Residual risks are recorded and accepted by Management.
4.2 Shared responsibility with the client
Doowebs is responsible for the security of the components it manages. The client is responsible for the components managed by itself or by third parties it has engaged: its own hosting, the user accounts it administers, the content it publishes, the plugins, code snippets or integrations it installs or maintains on its own, and the decisions it takes about its system.
Where a client decides not to apply a measure recommended by Doowebs (for example, not updating unsupported software, not enabling a protection, keeping its own components or delaying a migration), Doowebs will document the recommendation and the client’s decision, and the resulting risk will be the client’s responsibility. The specific allocation of responsibilities is set out in each contract.
5. Regulatory framework
Doowebs complies with the regulations applicable to its activity and, in particular:
- Royal Decree 311/2022, of 3 May, regulating the National Security Framework, and its technical security instructions.
- Regulation (EU) 2016/679, General Data Protection Regulation.
- Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights.
- Law 34/2002 on Information Society Services and Electronic Commerce.
- Law 9/2017 on Public Sector Contracts, in contracts with public bodies.
- Royal Legislative Decree 1/1996, consolidated text of the Intellectual Property Law.
The CCN-STIC 800 series guides of the National Cryptologic Centre are used as a technical reference. The up-to-date list of regulations is kept in the system’s register of legal requirements.
6. Security principles and requirements
Doowebs applies the basic principles of article 5 of Royal Decree 311/2022:
- Security as an integral process: technical, organisational and human at the same time, not an isolated task.
- Risk-based management: measures are chosen and sized according to the risk analysis.
- Prevention, detection, response and preservation: incidents are prevented, detected early, handled through a procedure and the service is restored.
- Lines of defence: several layers of protection, so that the failure of one does not compromise the system.
- Continuous monitoring and periodic reassessment of the measures.
- Differentiation of responsibilities: whoever supervises security is different from whoever operates the system.
To put them into practice, Doowebs commits to the minimum requirements of article 12.6, including:
- Access to information only with authorisation, named accounts and two-factor authentication for administrative access.
- Least privilege: each person has the permissions their role requires, reviewed periodically.
- Backups of websites and systems, with restore tests.
- Logging of administrative activity on the systems and on clients’ websites.
- Keeping servers, WordPress, themes and plugins up to date, and vulnerability management.
- Secure development of websites, applications and proprietary software: review of the code and its dependencies, testing before going into production, and separation between development, testing and production environments (measures mp.sw.1 and mp.sw.2).
- Service continuity: no critical access or knowledge depends on a single person; there is a documented emergency access held in safekeeping (article 12.6 and op.cont measures).
- Artificial intelligence agents under supervision: any action by an agent that modifies production systems or clients’ websites requires approval by an authorised person and is logged in their name.
- Working outside the office with safeguards: encrypted, locked devices and connection through a virtual private network on networks not controlled by Doowebs (measure mp.eq.3).
- Management of security incidents and communication with affected clients, with a public channel for receiving vulnerability reports at seguridad@doowebs.com (measure op.exp.7).
- Staff training and awareness.
- Security in the contracting and supervision of suppliers and collaborators.
- Continuous improvement of the management system.
7. Security organisation
Security is organised into roles with defined functions (articles 11 and 13 of Royal Decree 311/2022 and guide CCN-STIC 801). This policy defines the roles; the people who hold them are designated in a separate appointment record, so that they can be reassigned without amending the policy.
7.1 Roles and functions
| Role | Main functions |
|---|---|
| Management | Approves the policy, allocates resources, appoints the roles and accepts residual risks |
| Information and Service Owner | Determines the security requirements of the information processed and the services provided and assesses their levels in each dimension |
| Security Officer | Determines the decisions to meet those requirements, maintains the risk analysis and the Statement of Applicability, supervises compliance, coordinates incident management and training, and reports to Management |
| System Manager | Develops, operates and maintains the system; applies the technical measures; may suspend a service or an access in the event of a serious risk, informing the Security Officer |
| System Security Administrator | Carries out the technical security tasks: accounts and permissions, backups, updates, logs and monitoring |
| Point of contact (POC) | Security contact for clients; receives and communicates incidents and the security requirements of contracts (article 13.5) |
7.2 Appointment rules
- One person may hold several roles, except for the Security Officer and the System Manager, who will always be different people (article 11).
- Management may reassign the roles at any time according to workload, through a new appointment record. Each change is communicated to staff and, if it affects the POC, to public sector clients.
- People with broad administrative access, including Management, exercise it with a named account, two-factor authentication and activity logging, and their actions are reviewed by the Security Committee.
7.3 Security Committee
The Security Committee is made up of all the people holding the roles above. It meets at least every three months and whenever there is a serious incident or a relevant change, and keeps brief minutes.
Its functions are to review the state of security, incidents and risks; to approve the rules and procedures that implement this policy; to coordinate the persons responsible; and to propose to Management the necessary improvements and resources.
7.4 Conflict resolution
Disagreements between persons responsible are resolved in the Security Committee. If there is no agreement, Management decides, giving priority to the requirements arising from the protection of personal data and from contracts with clients.
8. Personal data
Doowebs processes personal data as controller (its clients, contacts and staff) and as processor (the data of its clients’ websites and applications). In both cases it applies the GDPR and Organic Law 3/2018, and the security measures of the National Security Framework also apply to that processing (article 3 of Royal Decree 311/2022).
In particular, where copies of clients’ websites are used in staging, testing or local development environments, they will be protected with the same measures as production or the personal data will be anonymised, and they will be deleted when no longer needed. The record of processing activities and the data processing agreements are kept separately.
Before accepting a project involving special categories of data (health, minors or others under article 9 of the GDPR) or high-risk processing, the Security Officer will assess whether the system must be recategorised and what additional measures it requires, and Management will decide whether to accept it.
9. Risk management
All systems within scope are subject to a risk analysis (article 14 and measure op.pl.1 of Royal Decree 311/2022), using a recognised methodology (MAGERIT, supported by the CCN’s PILAR or µPILAR tool).
The analysis is reviewed at least once a year and whenever the services or infrastructure change or relevant threats or incidents arise. The Security Officer maintains it; Management approves the treatment of risks and formally accepts residual risks.
10. Development of the policy
The policy is developed in a three-level document structure, accessible to staff according to their needs:
- Security policy (this document): approved by Management.
- Security rules: acceptable use rules for devices, accounts, email, messaging, AI tools and cloud services. Approved by the Security Committee.
- Procedures and technical instructions: how specific tasks are carried out (granting and revoking access, backup and restore, updates, incident management, change management). Approved by the Security Officer.
The asset inventory, the categorisation of the system, the risk analysis, the Statement of Applicability and the records that evidence compliance also form part of the system.
11. Staff obligations
All Doowebs staff know and comply with this policy and the rules that implement it. On joining they sign it, receive initial security training, and then training and awareness at least once a year (measures mp.per.3 and mp.per.4).
Anyone who detects a possible security incident or weakness reports it immediately to the Security Officer. Credentials are personal and non-transferable and are not shared by chat, email or unencrypted documents. Breach of this policy may give rise to disciplinary measures in accordance with employment law.
Access is managed throughout each person’s life cycle: it is granted on joining according to their role, adjusted when their role changes and revoked without delay when they leave, including any shared credentials they knew, which are changed (measure op.acc.4).
Communication with clients and work approvals take place through the corporate channels defined in the security rules. No channel, including messaging apps, is used to send credentials or clients’ personal data.
12. Third parties
When Doowebs uses third-party services (infrastructure, cloud, management tools), it will make them aware of this policy and will require, by contract or by verifying their certifications, a level of security appropriate to that of the system (op.ext and op.nub.1 measures of Royal Decree 311/2022). Preference will be given to suppliers with National Security Framework conformity or equivalent certifications.
When Doowebs provides services to public sector bodies, it will comply with the client’s security policy and the requirements of the contract, and will designate a point of contact for the security of information and of the service, reachable at seguridad@doowebs.com.
Risks arising from a supplier that does not reach the required level are recorded in the risk analysis and are treated or formally accepted.
The same requirements apply to external collaborators (partner agencies, independent professionals) and to tools on trial that are given access to client information: they only receive the essential, named and temporary access, after signing a confidentiality undertaking.
When the relationship with a client ends, or when the client moves a service to another provider, Doowebs returns or hands over the information and code that belong to the client, removes its own access to the client’s systems and deletes copies and data within the periods agreed in the contract or, failing that, those set by the security rules, keeping a record of it (measure mp.si.5).
Generative artificial intelligence tools are treated as third-party services. They are only used with corporate accounts and plans whose terms exclude the use of data to train models. Credentials, keys or clients’ personal data are not entered into them unless the contract with the client and the data processing agreement allow it. Details are set out in the acceptable use rules.
13. Review, exceptions and continuous improvement
The Security Committee reviews this policy at least once a year, and also after relevant changes in the services, the organisation or the regulations, or after a serious incident. Proposed changes are submitted to Management for approval. The current version is published on the Doowebs website and communicated to staff.
Security is managed as a continuous improvement process. Measures are implemented and verified progressively according to the adequacy plan approved by Management, and measures already in place may coexist with others in progress. When a review, an audit or an incident detects a deviation from this policy or its procedures, it is recorded as a nonconformity, its cause is analysed and its correction is planned with a person responsible and a deadline. That record, together with the Committee minutes and the risk acceptances, constitutes the evidence of Doowebs’ diligence in managing security.
Approval
The Management of Doowebs Dev, S.L. approved this Information Security Policy in València on 5 November 2026. The original, electronically signed by the Sole Director, is kept in Doowebs’ information security management system and is available to clients and contracting authorities on request.
Security contact
To report an incident, a vulnerability or any information security matter: seguridad@doowebs.com.
Vulnerability disclosure. If you discover a vulnerability in our systems or in the websites we maintain, please write to seguridad@doowebs.com with a description and the steps to reproduce it. We will acknowledge receipt within 3 working days, analyse it and keep you informed of its resolution. We ask you not to disclose it publicly until it has been fixed and not to access third-party data beyond what is strictly necessary to demonstrate it.