VÍS Information security policy
Professional practices are the key to success, and this information security policy has been established as a testament to that. Implementing and carrying out the policy is an important part of achieving consensus among employees and stakeholders on data security.
The scope covers all premises, employees, processes, data and information technology equipment used to provide insurance services. This is in accordance with the Statement of Applicability.
The company follows the information security policy below, which is described in further detail in the information security management document:
VÍS is committed to maximising the security of the information of the company, its employees and its customers with regard to confidentiality, integrity and availability.
VÍS complies with laws, regulations and guidelines in managing information security, which form the basis for the organisation and maintenance of measures that safeguard the confidentiality, integrity and availability of data and information systems.
The information security policy is binding on all employees of the company, and the operations and work practices of VÍS employees shall be exemplary with regard to information security.
All VÍS employees are obliged to protect data and information systems against unauthorised access, use, modification, disclosure, destruction, loss or transfer.
VÍS promotes active security awareness among employees, partners, contractors, service providers and visitors.
VÍS regularly conducts risk assessments and internal audits to determine whether further action is needed and to identify opportunities for continual improvement.
VÍS is committed to the continual improvement of its information security management system.
The Information Security Officer issues a quarterly report on VÍS’s implementation of and performance against this policy. At the beginning of each year, a report is prepared on the results of operating the management system.
Current and former employees and service providers are prohibited from disclosing information about the internal affairs of VÍS, its customers, external parties or other employees without the consent of the responsible party.
Audits are conducted of the information security policy, individual standards and work processes. They cover not only specific incidents but all aspects of security. Audits shall be defined and approved by the Information Security and Data Protection Committee.
The Executive Board owns the information security policy and is responsible for ensuring that it is enforced. This policy is reviewed annually, and the Information Security Officer is responsible for carrying out the review.
VÍS will comply with ÍST ISO/IEC 27001:2022 – Information security management systems, which is the basis for the organisation and maintenance measures aimed at ensuring the confidentiality, integrity and availability of data and information systems.
Published: 02.11.2026
ISO 27001:2022 Certificate
VÍS has received certification confirming that its information security management system meets the requirements of ISO 27001:2022.
Information security manual for contractors
It is important that contractors working in collaboration with VÍS are aware of their role in the information security management system.