Quality and Information Security Policy

Revision 1.0 · 13 April 2026

Introduction

Diplome S.r.l. (hereinafter “Diplome” or the “Company”) designs, develops and delivers its proprietary platforms as Software as a Service (SaaS): CyberRisk Hub, for cyber risk and compliance management, and Secwallet, an electronic wallet also used to support payment and banking intermediation services, together with related maintenance and enhancement services. Diplome’s mission is to provide businesses, financial institutions and public administrations with reliable, secure software that helps customers manage digital risk and operate with confidence in financial services.

To pursue its mission, Diplome has adopted an Integrated Management System (hereinafter the “IMS” or the “System”) comprising a Quality Management System (QMS) compliant with UNI EN ISO 9001:2026 and an Information Security Management System (ISMS) compliant with ISO/IEC 27001:2022 as amended by Amd 1:2024, with the aim of pursuing continual improvement, security and resilience in the products and services provided.

This Quality and Information Security Policy (hereinafter the “Policy”) provides the framework for setting quality and information security objectives. It is supported by topic-specific policies, procedures and instructions that guide its operational implementation.

Issuing authority

The Policy is defined, approved, issued and communicated by the Sole Director, who constitutes Diplome’s top management. It has been established to ensure that it:

is appropriate to Diplome’s purpose and context and consistent with its strategic direction;
meets the needs of customers and interested parties, in compliance with mandatory legislation and relevant voluntary standards;
provides a framework for setting quality and information security objectives;
includes a commitment to satisfy applicable requirements and continually improve the IMS.

The Policy is communicated to all personnel, contractors and suppliers who access Diplome’s information, is available to interested parties and is used as a reference in all activities.

Purpose and scope

The Policy describes the principles guiding Diplome’s management of quality and information security in all forms. It applies to all activities within the IMS scope: the design, development, SaaS delivery, maintenance and enhancement of CyberRisk Hub and Secwallet, including cloud infrastructure hosted by the external hosting provider, development tools, workstations and the information of Diplome, its customers and end users.

Compliance

Compliance with the Policy is mandatory for everyone working for Diplome in any capacity, including employees, contractors, consultants and suppliers.

Any breach of the principles set out in this document is assessed by management, which takes the action needed to reduce the resulting risk and prevent similar situations from recurring, including disciplinary or contractual measures where applicable.

Change management and exceptions

The Policy is reviewed by the Sole Director, with the support of the Integrated Management System Manager (IMS Manager), at least annually during management review and whenever significant changes occur in the context, products, threats or legislation.

Every request for an exception must state its reasons, duration and associated risks. It is assessed by the IMS Manager and approved by the Sole Director. Approved exceptions are recorded and reviewed on expiry.

General principles

Management actively supports the IMS through clear direction, visible commitment, explicit assignment of responsibilities and direct accountability for results, in line with the requirements that sector legislation (the DORA Regulation and Italian Legislative Decree 138/2024) places on management bodies. Management’s commitment is reflected in:

setting quality and security objectives consistent with the business strategy and customer needs;
making adequate resources available to plan, implement, control and improve the System;
integrating quality and security requirements into all processes, from sales to development, service operations and supplier management;
promoting a culture of quality and security based on ethical conduct, transparency and reporting errors, anomalies and incidents without fear of retaliation;
making risk-based decisions, considering separately the risks to be contained and the opportunities to be pursued;
providing ongoing training and awareness for all personnel, including management;
periodically reviewing the System’s effectiveness, including in response to changes in the external context, threats, business and legislation.

Quality principles and objectives

Diplome considers the quality of its products and services a strategic factor in success and customer trust. This section sets out management’s commitment to defining, implementing, maintaining and continually improving the QMS in accordance with UNI EN ISO 9001:2026.

Guiding principles

The fundamental principle is customer satisfaction, achieved by consistently providing reliable, secure software that meets requirements, available SaaS services and prompt, competent support. To this end, Diplome undertakes to:

understand customers’ explicit and implicit requirements, including the regulatory requirements applicable to regulated customers, and translate them into product requirements;
apply a structured development lifecycle, including code review, automated testing and controlled releases, to reduce defects and regressions;
guarantee measured, transparent service levels for availability, support and problem resolution;
manage processes using performance indicators and make decisions based on data and evidence;
comply with applicable legislation and contractual commitments;
select and control suppliers, starting with the hosting provider, based on their ability to contribute to service quality and security;
develop people’s skills through training, continuous learning and knowledge sharing, reducing dependence on individuals;
consider the environmental impact of digital services, including the effects of climate change on suppliers’ infrastructure;
maintain the System’s certification and continually improve it through audits, analysis of nonconformities and reviews.

Quality objectives

Within these principles, Diplome sets the following measurable objectives, which are checked during management review. Target values are set annually in the objectives plan.

Area	Objective	Indicator
Customer satisfaction	Maintain a high level of satisfaction	Average satisfaction score; contract renewal rate; number of substantiated complaints
Service levels	Meet agreed SLAs	Monthly service availability; request acknowledgement and resolution times
Software quality	Reduce defects released into production	High-severity defects per release; cancelled or withdrawn releases
Compliance	No nonconformities arising from failure to meet mandatory or contractual requirements	Number of regulatory or contractual nonconformities
Processes and improvement	Improve process effectiveness	Trends in process indicators; corrective actions closed on time; audit results
People	Ensure up-to-date skills	Training plan completion; coverage of critical skills by a substitute

Information security principles and objectives

Diplome considers information security an essential requirement of its products: customers entrust the platforms with sensitive information about their cyber risk and, in the case of Secwallet, their users’ financial data and transactions. Security is therefore an integral part of the value offered and a source of competitive advantage.

Diplome undertakes to ensure, for itself and the third parties involved, a level of security appropriate to the risk, consistently providing:

Confidentiality: information is accessible only to authorised people and processes;
Integrity: information, code and transactions are protected against unauthorised changes;
Availability and resilience: services and information are available when needed and can be restored within agreed times following an incident;
Authenticity and traceability: the origin of information and the actions performed can be verified and attributed;
Personal data protection: personal data is processed in accordance with the GDPR, applying data protection by design and by default.

Guiding principles and objectives

Everyone working for Diplome is responsible for observing the following principles. Everyone must promptly report any anomalies, weaknesses, breaches and incidents of which they become aware. The principles are organised according to the control themes of ISO/IEC 27002:2022: organisational, people, physical and technological controls.

Security policies and governance

Objective: define, approve, communicate and periodically review the Policy and topic-specific information security policies.

This Policy is supported by topic-specific policies approved by management (including acceptable use of assets, access control, secure development, cryptography, backup, supplier and cloud service management, incident management and remote working) and operational procedures. Policies are reviewed at least annually, considering changes in the organisation, products and legislation, evolving threats and the results of audits, incidents and monitoring. Security management is based on risk assessment, using management-approved criteria and reviewed at least annually or following significant changes.

Organisation of information security

Objective: clearly assign security roles and responsibilities and manage the risks arising from the concentration of roles in a small organisation.

The Sole Director has ultimate responsibility for information security and ICT risk and acts as IMS Manager with the support of an external consultant. The Technical Director is responsible for the technical security of products and services, coordinates incident response and is the designated System Administrator. The external Data Protection Officer (DPO) monitors GDPR compliance. Roles and responsibilities are defined in the organisation chart and role descriptions.

Where full segregation of duties is impracticable, compensating controls are adopted: dual authorisation for production releases and privileged accounts, recording and review of administrative activities, and internal audits carried out by people independent of the activities being audited.

Security is integrated into project management and product development. Diplome maintains contacts with the competent authorities (the Italian Data Protection Authority, the Italian National Cybersecurity Agency and CSIRT Italia, and public security authorities) and specialist groups, and collects and analyses threat intelligence relevant to its products and technologies.

Human resources security

Objective: ensure that personnel and contractors are trustworthy, competent and aware of their security responsibilities before, during and after their engagement.

Personnel selection includes checks on professional backgrounds proportionate to the role and access to critical information, in compliance with employment and data protection legislation. Contracts and confidentiality undertakings define security responsibilities, including after the relationship ends.

Before obtaining access to systems, new recruits receive training on the Policy, acceptable use rules and data protection. All personnel participate in an ongoing, role-based training and awareness programme: secure development for the technical team, and ICT risks and governance responsibilities for management. Personnel are informed of the disciplinary consequences of breaching the rules.

Remote working is permitted under rules setting security requirements for remote workstations, the networks used and information protection. When an engagement ends or a role changes, access is promptly revoked or amended and company assets are returned.

Asset management and information classification

Objective: identify and protect information assets in proportion to their value and classification.

Diplome maintains an up-to-date inventory of assets, including cloud environments and resources, code repositories, SaaS services used, workstations and data, identifying the owner of each asset. Information is classified into four levels—Public, Internal, Confidential and Strictly Confidential—and is labelled and handled accordingly. Customer and end-user data, source code and security documentation are classified at least Confidential; cryptographic keys, application secrets and privileged credentials are Strictly Confidential.

Company assets are used only for work purposes and in accordance with acceptable use rules acknowledged by personnel. Storage media are securely managed, transported and disposed of; information no longer required is deleted according to defined retention periods and, for customer data, contractual instructions.

Access control and identity management

Objective: restrict access to information and systems to authorised people and processes, following the principles of least privilege, need-to-know and need-to-use.

Each person has individual accounts; shared accounts are prohibited and technical accounts have an identified owner.
Multi-factor authentication is mandatory for access to cloud environments, code repositories, email, administration tools and all remote access.
Access to production environments is limited to authorised personnel, preferably using temporary privileges granted on request (just-in-time), and every action is logged.
Privileged accounts are assigned through formal System Administrator appointments, in accordance with the Italian Data Protection Authority’s measure of 27 November 2008, as amended, and the relevant access logs are recorded and retained for at least six months.
Access rights are reviewed at least every six months for privileged access and annually for other access, and whenever organisational changes occur.
Credentials and secrets are managed using dedicated tools and are never included in source code.
The platforms provide customers with role-based access management, strong authentication and user activity logging.

Diplome operators accessing customer systems follow the customer’s rules while maintaining Diplome’s good practices.

Cryptography

Objective: ensure the correct and effective use of cryptography to protect information confidentiality, authenticity and integrity.

Communications are protected using up-to-date secure protocols (e.g. TLS 1.2 or higher, with robust configurations). Customer data, backups and workstation disks are encrypted at rest using standard algorithms. Cryptographic keys are generated, stored, rotated and revoked using dedicated key management services, with restricted, logged access. Secwallet is also subject to the requirements for protecting personalised security credentials and secure communication set out in the regulatory technical standards on strong customer authentication (Commission Delegated Regulation (EU) 2018/389). Cryptography is used in compliance with Italian and European legislation and any export restrictions.

Physical and environmental security

Objective: protect the places where information is processed and prevent loss, damage, theft or compromise of assets.

Production infrastructure is hosted in the hosting provider’s data centres, whose physical and environmental security is checked through the provider’s certifications and independent audit reports. Company premises apply access controls, equipment protection, clear desk and clear screen rules, and secure visitor management. Workstations used off-site are encrypted, protected and safeguarded under remote working rules. People’s health and safety are protected in accordance with Italian Legislative Decree 81/2008.

Operational and cloud service security

Objective: manage service delivery environments securely, in a controlled and monitored manner, in accordance with service levels.

Cloud environments are configured against security baselines and managed as code; configurations are continuously checked against good practices and deviations are corrected.
Development, testing and production environments are separated; real customer data is not used in non-production environments unless anonymised or masked.
Shared responsibility with the hosting provider is documented, and Diplome oversees the areas within its responsibility: identities, configurations, data and applications.
Vulnerabilities in systems, components and dependencies are monitored and remediated within timeframes based on severity.
Systems and workstations are protected against malware; software installation is controlled.
Application, system and security logs are collected centrally, protected against alteration, synchronised and analysed to identify anomalous behaviour.
Backups are automated, encrypted, stored at a separate location in an immutable form, and restoration is periodically tested.
System capacity is monitored to ensure agreed performance.

Communications and interface security

Objective: protect information in transit over networks and through application programming interfaces (APIs).

Cloud networks are segmented by environment and function, with access restricted to necessary communications. Internet-facing services are protected through application traffic filtering, denial-of-service protection, rate limiting and API authentication. Information is exchanged with customers, suppliers and partners through encrypted channels and under agreements defining responsibilities and security measures. Email and messaging tools are governed by company rules.

Secure development and the software supply chain

Objective: ensure that security is integral to the entire product lifecycle, from requirements definition to retirement: security by design and by default, and privacy by design and by default.

Security and data protection requirements are defined at the start of every development activity, including through threat analysis.
Code is developed according to secure coding rules and recognised standards (e.g. OWASP ASVS) and undergoes peer review before integration.
Integration and release pipelines run automated tests, static code analysis, dependency and licence analysis and secret scanning, and produce a software bill of materials (SBOM).
Production releases are authorised by someone other than the author, traceable and reversible.
Open-source and third-party components are selected, updated and monitored for vulnerabilities and licences.
Product security is checked through dynamic security testing and independent penetration testing at least annually and before significant releases.
Diplome manages responsible vulnerability reports from third parties and informs customers of vulnerabilities affecting them.
Source code and release artefacts are protected against unauthorised access and changes.

Any artificial intelligence features are designed and used in compliance with Regulation (EU) 2024/1689 and Italian Law 132/2025, with risk assessment, human oversight and transparency towards customers.

Supplier relationships and cloud services

Objective: protect information and service continuity in supplier relationships, with particular attention to the hosting provider on which the entire infrastructure depends.

Diplome uses only suppliers providing adequate security and reliability assurances, assessed before engagement and periodically according to criticality. Contracts include requirements for security, confidentiality, incident notification, audit rights, data location, subcontractor management, continuity and exit assistance; suppliers processing personal data are appointed as sub-processors under Article 28 of the GDPR.

For the hosting provider and other critical ICT suppliers, Diplome checks certifications and independent audit reports; monitors availability, security advisories and service changes; favours data location within the European Union; assesses concentration and dependency risks; and maintains a documented, tested exit strategy. Diplome provides its financial-sector customers with information on its ICT supply chain as needed for their obligations under the DORA Regulation.

Incident management

Objective: promptly detect, manage and communicate security incidents and personal data breaches, limiting their effects and learning from experience.

Diplome has an incident management procedure defining reporting channels for personnel, customers and suppliers, classification criteria, roles and responsibilities of the response team (CSIRT) coordinated by the Technical Director, containment, eradication and recovery methods, evidence collection following forensic good practices, and an incident register.

Because customers have notification obligations towards authorities—personal data breaches within 72 hours under the GDPR, major ICT-related incidents within DORA timeframes, and significant incidents under Italian Legislative Decree 138/2024—Diplome informs affected customers without undue delay and within the contractually agreed timeframes, and assists with their communications. Significant incidents are analysed to identify causes and improve controls.

Business continuity and ICT resilience

Objective: ensure continuity of critical services and their restoration within times and in ways that limit consequences for customers and Diplome.

Diplome has defined continuity requirements and recovery time and recovery point objectives (RTO and RPO) for each platform, consistent with contractual commitments. The service architecture includes redundancy across multiple availability zones of the hosting provider, immutable backups stored in a separate region and documented recovery procedures. Continuity and recovery plans are tested at least annually, and results are communicated to customers on request. Continuity planning also considers the unavailability of key people, premises and the hosting provider.

Compliance and personal data protection

Objective: ensure compliance with legislation, regulations and contractual obligations, reducing the risk of penalties, losses and reputational harm.

Diplome identifies, documents and keeps applicable mandatory and contractual requirements and the arrangements for meeting them up to date. Principal references include:

Regulation (EU) 2016/679 (GDPR), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and measures of the Italian Data Protection Authority;
Regulation (EU) 2022/2554 (DORA) and its delegated acts, for services supplied to financial entities;
Directive (EU) 2015/2366 (PSD2) and national implementing legislation, together with the technical standards on strong customer authentication and developments in the PSD3/PSR framework;
Directive (EU) 2022/2555 (NIS2), Italian Legislative Decree 138/2024 and Law 90/2024, for customers’ supply chain requirements and national security;
Regulation (EU) 2023/2854 (Data Act), Regulation (EU) 2024/1689 (AI Act) and Regulation (EU) 2024/2847 (Cyber Resilience Act), where applicable;
Italian Legislative Decrees 231/2001 and 81/2008, and copyright and software licensing legislation.

For personal data processed on behalf of customers, Diplome acts as Data Processor following customers’ documented instructions. For data for which it is the Controller (personnel, business contacts and suppliers), it applies GDPR principles, maintains records of processing activities, carries out impact assessments when necessary and ensures data subjects can exercise their rights. Data is preferably stored within the European Union; any transfers to third countries take place only with the safeguards required by Chapter V of the GDPR.

Diplome uses properly licensed software and complies with open-source component licences; protects records according to defined retention periods; and subjects the System to at least annual internal audits and independent technical checks.

Specific requirements for financial services

Objective: ensure that Secwallet and related services meet the security, resilience and transparency requirements that financial-sector customers must demonstrate to supervisory authorities.

Diplome acts as a technology supplier to its regulated customers: it does not itself provide payment services or hold customer funds. In this role, Diplome undertakes to include the clauses required by Article 30 of the DORA Regulation in contracts; allow customers, their auditors and competent authorities access, inspection and audit; participate in customers’ digital operational resilience testing on request; ensure transaction traceability and integrity, support customers’ anti-fraud and anti-money laundering controls and strong authentication under payment services legislation; and support customers’ exit strategies and data portability.

Information security objectives