Confidentiality Policy

• To establish FVR's confidentiality policy: what information it protects, towards whom it is committed, and how far that obligation reaches. The policy itself is stated in §3.

• Applies to all information obtained during the certification cycle in both service lines (17021 and 17024), including:
• - Personal data of candidates, clients, client employees
• - Audit records (line 17021) and evaluation files (line 17024)
• - Unpublished findings (major NCs, minor NCs, OFIs)
• - Client financial and operational information
• - Interview guides, sealed session packages, transcripts, readings and verdicts of the defence AI, their verifications, and the acknowledgements of the notice on the use of AI (line 17024)
• - Question bank
• - Cryptographic keys
• - Internal and subcontracted personnel records
• - Confidential commercial information (quotes, contracts, rates)

• FVR protects confidential information obtained or generated during all certification activities. Confidentiality is an ethical and contractual commitment to candidates, clients, stakeholders and regulators.

• 1. Least privilege: each role accesses only what is necessary for its function (FVR_IM-MZ-01).
• 2. Informed consent: candidate/client accepts use of their information via contract.
• 3. No external disclosure without written consent, except where required by law or, for the 17021 line, authorised by an applicable contractual arrangement.
• 4. Encryption at rest and in transit for level 3 (CONFIDENTIAL) and 4 (RESTRICTED) information.
• 5. Limited retention per FVR_CD-MZ-01.

• - Signing confidentiality agreement upon entry (FVR_IM-FO-02)
• - Renewal of the declaration every 3 years (together with contract renewal and policy updates; the declaration required upon each audit assignment addresses assignment-specific risks)
• - Post-employment continuation of obligation: 5 years
• - No discussion of cases outside controlled work environment
• - Immediate notification of real or suspected incident (FVR_IM-WI-01)
• - Return of information at employment end
• — How the general confidentiality commitment is evidenced, and not only required. Signing at entry is the obligation; being able to show it is the control. FVR keeps, for every person who acts on its behalf, the record of the signed commitment with its date and the version of the text signed, and that record is a condition for being authorised to act: no authorisation of a certification role is approved without it. The commitment reaches own staff, assessors, examiners, item developers, AI personnel, committee members and contractors, and covers information obtained or created in the certification activity whatever its source — including what a person learns by acting for FVR and would not otherwise know. Breach is a disciplinary matter and grounds for withdrawing the authorisation to act.

• When disclosure is required by law or, for the 17021 line, authorised by an applicable contractual arrangement:
• - GD is notified first
• - Legal Advisor validates the legal or contractual basis
• - If applicable, FVR informs affected client before disclosure, except where legally prohibited
• - Delivery is documented with log
• — Where the disclosure record is kept and how the affected party is notified. A disclosure required by law or, for the 17021 line, authorised by an applicable contractual arrangement is an exceptional manual act and must leave a record. It is recorded in the file for the affected party, with the date, the applicable legal or contractual basis, the information disclosed and the person who authorised it; the Directorate authorises the disclosure. FVR notifies the affected party — client, applicant, candidate or certified person — of the information it will provide, unless prohibited by law. The same duty applies before making information about that party public: FVR gives prior notice of which data will be public so that the service or scheme is accepted with that knowledge.

• Per FVR_IM-MZ-01: PUBLIC, INTERNAL, CONFIDENTIAL, RESTRICTED.

• Any unauthorized access, leak, loss or suspicion is handled per FVR_IM-WI-01. Maximum internal reporting time: 2 hours. In Mexico, security breaches that significantly affect data subjects' property or moral rights are reported to them immediately, in accordance with the applicable law.

• Negligence — Mandatory training + warning
• Unauthorized access — Disciplinary action + Safeguard Committee report
• Deliberate leak — Termination + legal action
• Commercialization of confidential info — Legal action + report to Accreditation Body

• Single reusable clause. Applies to all 17021 audit procedures: CA-E1, CA-E2, FSA, SA, RA, TA, Special, Multi-Site, Remote.
• The confidentiality requirements applicable to the 17021 audit procedures (FVR_EC-PR-01, FVR_RD-PR-05, FVR_TP-PR-03, FVR_TP-PR-04) are consolidated in this clause. Applicable rules:
• 1. Active NDA between FVR and client before any audit starts
• 2. Non-conflict declarations of audit team (FVR_IM-FO-03) signed by each team member before assignment
• 3. Audit-specific confidentiality declaration (FVR_IM-FO-02) signed by each auditor and technical expert before start
• 4. Information obtained during audit is treated as level 3 CONFIDENTIAL per FVR_IM-MZ-01
• 5. Screenshots and shared documents are audit evidence: they are retained in the project file, and the auditor deletes only local copies at file closure
• 6. Observers (auditor in training or Accreditation Body representative) require written client authorization
• 7. Remote audit sessions are not recorded
• 8. Findings communication strictly to client contract signatory — not to third parties without written authorization
• 9. Post-audit: confidentiality obligation persists for 5 years (§5)
• Reference: each audit procedure shall state: *"Confidentiality: cross-cutting clause of FVR_GD-POL-03 §10 applies"*.
• — Related bodies, and the one FVR has. FVR ensures that the activities of related bodies do not compromise the confidentiality of the information of its applicants, candidates and certified persons. FVR identifies its training unit for the 17024 line as its only current related body. It operates on the same platform used to administer examinations and serves the same candidates. The barrier is concrete, not a declaration of intent: the training activity has no access to items, answer keys, results of a live attempt, or the identity of who is being examined at that moment; whoever holds a training role cannot hold a role of the question bank or of assessment for the same scheme; and the segregation of who trains from who decides is enforced by the system at the moment of deciding a certification. Any new related body shall be identified in this policy, together with its specific confidentiality safeguards, before it begins operating.

• Remote audit sessions are video calls and are not recorded, so there is no recording to delete. What the auditor captures during a session (screenshots, documents the client shares) is audit evidence: it is uploaded to the project file and retained under FVR_CD-MZ-01; at file closure the auditor deletes any local copy from their own devices, as a personal obligation under this policy, not as an act of the ERP. What the ERP does record: the confidentiality commitment of every person who acts on behalf of FVR, signed within the impartiality declaration with text hash, IP and date; and the access log — every login and every failed or blocked attempt, with IP and location. The lead auditor obtains the written authorisation of external observers (trainee auditor, accreditation-body witness or third party) and uploads it through the ERP to the project file. Providers of digital services are bound by the terms of their subscription (FVR_CM-PR-03 §5.3) and sign no agreement in the ERP.

• FVR undertakes to:
• 1. Grant access under least privilege: each role reaches only what its function requires, and access is granted by role and not by person.
• 2. Obtain the informed consent of the candidate or client before using their information for anything beyond the certification activity itself.
• 3. Bind every person with access — employees, contracted auditors, examiners, evaluators, committee members and suppliers — through legally enforceable confidentiality agreements *(17021-1 §8.4; 17024 §8.4)*.
• 4. Inform the client in advance when the law compels disclosure or, for the 17021 line, an applicable contractual arrangement authorises it, unless the law prohibits the notice.
• 5. Keep information for the retention period declared in the records control, and dispose of it securely once it ends, provided that no suspension of disposal under FVR_CD-MZ-01 §6 applies.
• 6. Treat a confidentiality breach as an incident: it is recorded, investigated and it opens a corrective action.

• It is forbidden at FVR to:
• 1. Disclose client or candidate information to a third party without written authorisation, except where the law compels it.
• 2. Use information obtained during certification for a commercial purpose, one's own or another's, including approaching the client for a different service.
• 3. Access records that one's function does not require, even where the system technically permits it.
• 4. Take evidence out of the controlled environment — copies on personal devices, personal accounts or unauthorised storage.
• 5. Disclose the content of the question bank or of an examination in progress, in any form.
• 6. Discuss the identity or the outcome of a candidate or client outside the people the process requires.

• Stated by role, never by name.
• Executive Management — approves this policy and answers for the resources that make confidentiality possible.
• Technical Management — answers for confidentiality being upheld throughout the certification cycle in both lines.
• Quality Officer — holds the signed confidentiality agreements and verifies they are complete before each assignment.
• Operations · IT · Administration — implements role-based access and maintains the access log; while the position is vacant, the Technical Director performs these duties. The process owner carries out secure disposal at the end of the retention period and records it in accordance with FVR_CD-MZ-01. This role does not access evidence for its own purposes.
• Audit team, examiners and evaluators — handle only the information their assignment requires, and within the controlled environment.
• All personnel, internal and external — sign the agreement before their first assignment and report any breach they become aware of, including their own.

• Confidentiality is governed through the management system risk register, which covers information security threats for both service lines *(9001 §6.1)*.
• · Each threat — unauthorised access, leakage of the question bank, loss of the documented repository, disclosure by a supplier — carries its safeguard and its owner in the register.
• · A breach is treated as a materialised risk: it opens a corrective action and the safeguard that failed is reviewed.
• · The opportunity is to strengthen client confidence so that the information necessary for an audit or examination is available.
• The review frequency is established in the procedure responsible for each threat.

Approvals / Aprobaciones