General Information Security Policy
Purpose
Information Security is of utmost importance for LEM and its customers. We are committed to the availability of information, its integrity, while guaranteeing confidentiality.
Our objective is to give confidence to all interested parties that Information Security risks are continuously anticipated and managed in LEM.
The LEM Information Security Policy seals our commitment towards preserving confidentiality, integrity, and availability of information. The Policy is set in motion by the LEM Information Security Management System (ISMS). As part of an integrated with LEM’s processes and overall management structure and performance, it is designed to provide agile and comprehensive digital protection.
SCOPE OF APPLICATION
The Policy applies to LEM Holding SA and all its subsidiaries, offices, and sites worldwide (“LEM”). It includes all members of the Board of Directors, executives, officers, and employees, irrespective of their location (“Employee(s)”).
VALUE PROPOSITION
- Sustainable information security culture: LEM adopts human-centric design practices. By effectively allocating budget to both technology and education, employees are supported to play an active role in protecting information assets. Regular employee training at every level mitigates the role of human error in security incidents or data breaches.
- Risk management: Sound Information Security risk assessment, detection, prevention, and risk treatment process is used throughout the information assets’ lifecycle. The necessary security controls are justified and implemented accordingly, as formalized in the Statement of Applicability (SoA). By proactively addressing security risks, LEM reduces the monetary impact of security incidents, including costs associated with data breaches, system downtime, and regulatory fines. Operational Technology (OT) is an increasing point of attention in our risk portfolio.
- Threat and attack preparedness: LEM continuously adds capabilities based on greater levels of automation to enable early detection and response to cyberthreats. We integrate predictive approaches to better prepare for potential attacks in the future by minimizing the risk of exposure. This is done by using real-time monitoring of vulnerabilities. We are vigilant to threats related to the internal use of Artificial Intelligence (AI), that can be vulnerable to data manipulation.
- Compliance: It is essential for LEM to avoid information security risk related to legal, contractual and regulatory compliance, including privacy and protection of personally identifiable data. Provisions are known and observed, regulatory surveillance is ensured with specialized support. We address customer requirements concerning our Information Security posture by obtaining the TISAX label in 2024, valid for three years, as a preamble to pursuing ISO 27001 certification.
- Suppliers and partners: An appropriate level of Information Security is maintained while collaborating with cooperation partners and contractors. Non-disclosure agreements provide legal protection particularly where information is exchanged beyond the LEM boundaries.
- Continuous improvement: It is all about continuous monitoring and improvement. By managing the lifecycle of vulnerability, LEM strengthens its immune system from cyber threats.