The governance of information security has been consolidated by means of a complex document management system consisting of the "Information Security Policy Guideline" and a "Policy for the protection of personal data" and a set of information security policies that establish the guiding principles for all information security activities, including the attribution of responsibilities, both general and specific, to clearly defined organisational roles.