IMS Statement Policy

ISO 9001:2015 Quality Management · ISO/IEC 27001:2022 Information Security Management

Scope

This policy applies to HOSTING B2B LTD and to the provision of hosting and managed IT services and cybersecurity solutions, as defined in the Statement of Applicability and certified by Cyprus Certification Company under ISO/IEC 27001:2022 (registration CY.ISMS.22.002) and ISO 9001:2015.

Προσφορά υπηρεσιών φιλοξενίας, λύσεων Τεχνολογίας Πληροφορικής και κυβερνοασφάλειας.

Our commitment

HostingB2B operates an Integrated Management System that combines quality management and information security management into a single framework, so that the services we deliver are reliable, secure, resilient and continually improved. The Director is accountable for the system; every employee is responsible for applying it. We commit to the following:

1. Quality and customer satisfaction. We deliver ICT services that meet agreed requirements and customer expectations, measured through defined objectives, service performance indicators and customer feedback, in accordance with ISO 9001:2015.
2. Information security. We protect the confidentiality, integrity and availability of the information entrusted to us and of our own information, through a risk-based Information Security Management System certified to ISO/IEC 27001:2022. Controls are selected from the Statement of Applicability, applied proportionately to the risks identified, and reviewed at least annually.
3. Operational resilience. We maintain, test and improve business continuity and disaster recovery arrangements with defined recovery objectives, so that critical services can be restored within agreed timeframes following disruption.
4. Incident management. We detect, classify, contain and resolve information security and service incidents through a documented process, learn from them, and notify affected customers within the timeframes set out in their contractual arrangements.
5. Supplier and subcontractor management. We select, contract with and monitor the data-centre operators, carriers and technology providers that support our services on the basis of security, resilience and performance, and we disclose to customers the subcontractors that support their services.
6. Legal, regulatory and contractual compliance. We comply with the laws and regulations applicable to us, including the General Data Protection Regulation, and we design, contract and operate our services so that customers in regulated sectors — including financial entities subject to Regulation (EU) 2022/2554 (DORA) and licensed gaming operators — can meet their own regulatory obligations when using them. We represent our certifications and regulatory position accurately and claim only what we can evidence.
7. Security awareness and competence. We provide information security awareness training to all personnel on joining and at least annually, and role-based training where duties require it, so that security is applied in daily work and not only in documents.
8. People and workplace. We invest in the professional development of our people, uphold equal opportunity and a respectful working environment, and protect the health and safety of employees, contractors and visitors.
9. Environmental responsibility. We seek to reduce the environmental impact and energy consumption of our operations and infrastructure choices, and to work with data-centre partners that do the same.
10. Ethics and transparency. We conduct our business honestly and transparently, protect the interests of our customers, and engage openly with regulators, certification bodies, customers and partners.
11. Continual improvement. We set measurable objectives, monitor them through key performance indicators, audit the system internally at least annually, review it at management level, and act on nonconformities, incidents, audit findings and stakeholder feedback.

Governance

This policy is approved by the Director, communicated to all personnel and interested parties, and made available on the HostingB2B website. It is reviewed at least annually at the management review and whenever the organisation’s context, certifications, services or legal obligations change materially. Objectives supporting this policy are set and tracked in the KPI register.