> For the complete documentation index, see [llms.txt](https://docs.glesys.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.glesys.com/security/annex-information-security.md).

# Annex – Information Security

This Information Security Annex describes Glesys’ technical and organizational measures for managing cybersecurity risks and supporting compliance with applicable cybersecurity legislation, in particular the NIS2 Directive and applicable national and sector-specific requirements.

Glesys’ Integrated Management System (IMS) integrates ISO 9001, ISO 14001 and ISO/IEC 27001:2022 across its operations. The IMS provides the framework for managing information security, risk, operational resilience and continuous improvement.

**Important scope note – Customer Data:** Glesys’ IMS scope excludes Customer Data hosted on Glesys infrastructure. Customers retain ownership of and responsibility for the security and management of Customer Data in accordance with the Agreement.

### Security measures covered

The annex describes Glesys’ approach to information system security, cybersecurity risk management, incident management, operational continuity and crisis management, supply chain security, secure development and maintenance, vulnerability management, security training, cryptography, personnel security, access control, asset management, physical security and audit.

### Annex governance and updates

The Information Security Annex forms an integral part of the Agreement and is subject to its terms. Glesys maintains the underlying internal policies and supporting evidence within its IMS and reviews and updates this documentation in accordance with its established management and improvement practices and applicable cybersecurity requirements.

Glesys may update the Information Security Annex in accordance with the applicable General Terms and Conditions and will inform customers of relevant changes in accordance with the Agreement.

The last section is based directly on the annex’s change provisions.