Katakri 2020

The management of the organisation is responsible for:
a) approved by the senior management, the organisation has introduced security principles, which describe how information security measures are linked to the organisation’s activities,
b) security principles are comprehensive and appropriate for the protection of Classified Information,
c) security principles provide guidance for security measures, and
d) sufficient monitoring has been put in place to ensure that the organisation follows the requirements and guidance on the handling of Classified Information.

Related tasks

Adequate security principles of the organisation in terms of classified information

Critical

High

Normal

Low

Cyber security management

Information security policy -report publishing, informing and maintenance

Critical

High

Normal

Low

Cyber security management

Management commitment to cyber security management and management system

Critical

High

Normal

Low

Cyber security management

Requirement details

1. In Security Areas and in premises around, preventive and limiting measures have to be taken into use to ensure the security of the Security Area. Actions to detect and track the intensives have to be included. Procedure to recover normal functions immediately has to be in force.
2. The principle of defence-in-depth has to be used to evaluate and accredit an appropriate and - based on risk assessment - sufficient combination of security measures, consisting of administrative, functional and physical means, like:
a) structural barriers: physical obstacle(s) which sets the boundary for Security Areas and the premises around it, causing complications and delays for the intrusion;
b) Access control: access to Security Areas and premises around them is limited with access control mechanisms. The goal is to detect unauthorized attempts, to prevent the access of unauthorized people and to monitor the individuals moving around and inside the area. Access control may be targeted on an area, on one or more facilities on the area, on areas within facilities or on rooms. The monitoring may be based on mechanical or electronic systems or on the combination of these or on some other physical means. Security personnel, receptionist and own personnel may be used as part of the monitoring procedure.
c) Intrusion detection system: in order to improve the security level given by a perimeter barrier, an intrusion detection system (burglar alarm) may be used. The system may also be used in place of, or to assist, security staff.
d) Security personnel: trained, supervised and, where necessary, appropriately security-cleared security personnel may be employed, inter alia, in order to deter individuals planning covert intrusion.
e) CCTV: closed circuit camera surveillance may be used on Security Areas or around it especially for preventing illegal intelligence actions and other unwanted actions, as well as for verification of alarms and unexpected findings. The security personnel may use CCTV as a real time tool for monitoring or as a passive means to analyze the footage.
f) Measures which maintain the level of security: Definition of responsibilities and tasks. Various processes and working models, like the management of access rights and keys, introduction of new personnel and instructing them, and the service and maintenance processes of different systems.
g) Lighting: the possible intruder may be detected with the help of proper lighting. It also makes the monitoring of the area more efficient for the guarding personnel either visually or by using the CCTV.
h) Other relevant physical measures aiming at preventing or detecting unauthorized access or to prevent the loss or damage of Classified Information.
3) The devices have to be inspected and serviced on a regular basis.

Related tasks

Principle of layered protection

Critical

High

Normal

Low

Property security

Requirement details

The ISMS component hierachy

Framework

Requirements

Tasks

Policies

Never duplicate effort. Do it once - improve compliance across frameworks.

Start your compliance journey

How it works?

Use cases

Resources

Contact us

Katakri 2020

The ISMS component hierachy

Framework

Requirements

Tasks

Policies

Never duplicate effort. Do it once - improve compliance across frameworks.

Stay up-to-date on cyber security

Subscribe for our free, weekly newsletter

* Your email won't be sold nor disclosed forward. Confirmation has more info. Learn more

Start your compliance journey

Pysy kärryillä digiturvasta

Tilaa Digiturvauutiset sähköpostiisi

* Osoitetta ei myydä tai luovuteta eteenpäin. Vahvistusviestissä lisätietoja. Lue lisää

How it works?

Use cases

Resources

Contact us