Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
Katakri is used when evaluating organisation's ability to secure confidential information from Finnish national authorities.
Katakri is used when evaluating organisation's ability to secure confidential information from Finnish national authorities. It can be used to guide security work in an organisation, that wants to be ready for an audit performed by authorities.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
1. National Classified Information has to be handled both in Security Areas and outside
of their perimeter in a way that the access to Classified Information is protected from
unauthorized people.
2. International Classified Information has to be handled both in Security Areas and outside of their perimeter in such a way that the access to Classified Information is protected from unauthorized people.
The area must have a clearly defined and visible boundary. There are no specific requirements for the structure setting the boundary.
Only authorized personnel have individual access to the area. It is necessary for the organisation to define the roles and procedures concerning access rights and (physical) key management.
People who do not belong to the authorized personnel (i.e. visitors) have to be escorted at all times or be subject to equivalent controls.
Soundproofing of the area has to be good enough to prevent unauthorized people to hear on an understandable level the discussions dealing with Classified Information. Sound- proofing has to be taken into account also inside the area in cases Classified Information is discussed and people without the need-to-know may be around.
No specific requirements. Intrusion detections systems may be used as a risk management method, complementing the defence-in-depth, or as means to achieve the requirement F-05.8 2a.
In case a risk to disclose Classified Information through unauthorized observation or unintended overlooking exists, appropriate countermeasures shall be taken to counter this risk.
1. Organization has to inspect all electronic equipment, which are used in such an Administrative Area, where classification level II (SECRET) information is handled. This requirement is relevant in cases when the threat against disclosure of the information has been
evaluated high.
2. In addition, the area needs to be regularly inspected, physically and technically. Such inspections shall also be conducted following any unauthorized entry or suspicion of such entry.
1. Classification level IV (RESTRICTED) information may be stored in the area. Information has
to be stored in locked furniture. Terminal device containing above mentioned information
has to be stored in appropriate locked furniture, when possible.
2. In Administrative Area it is possible to store information belonging to national classification level III in terminal devices which have been approved for the level and when the terminal device is stored in: a) monitored space or b) in sealed security envelope inside locked furniture (or in equivalent secure way). Potential monitoring of the storage space has to be done according to the requirement F-05.5. As an exception to this rule for storing national classification level III information, it is not allowed to store international CONFIDENTIAL information in Administrative Areas.
3. Keys or combination settings to the appropriate locked furniture have to be kept under control of such personnel, which has the need-to-know to the information stored in the above-mentioned manner. Combination settings have to be committed to memory by the authorized individuals. Combination settings to storage units containing Classified Information have to be changed:
• on receipt of a new container;
• whenever there is a change in personnel knowing the combination;
• whenever a compromise has occurred or is suspected;
• when a lock has undergone maintenance or repair.
4. It is allowed to handle information classified on national levels IV-II in the Administrative Area when access to the information by unauthorized persons has been prevented. When the Classified Information is used by means of terminal devices it is necessary to take care
that both the terminal device, as well as the data communication arrangement fulfill the
requirements set for them.
1. The area must have a clearly defined and visible boundary.
2. In case the area does not have an appropriate solution for information storage, the walls, the floor, the ceiling, windows and doors of the area must provide the required level of security for the storage.
A visibly defined and protected perimeter has to be established, through which all entry and exit are controlled by means of a pass or personal recognition system.
1. Individual access right for the area may only be given to a person duly authorized by the
organization after ensuring about the trustworthiness of the individual and after providing
with a specific permission to enter the area (need to access the area).
2. Organization has to define the procedures and roles concerning management of access rights, combination settings and keys.
3. In cases when international Classified Information is handled and stored in the Secured Area, the individual access right to the area can be issued by the organisation only for
a person duly authorized, who carries a valid personal security clearance (PSC) and has
been provided with a specific permission to enter the area based on the need-to-know.
1. People without an individual access right to the area (i. e. visitors) need to be escorted.
2. Where entry into a Secured Area constitutes direct access to the classified information contained in it, the following additional requirements will apply:
• the highest classification level for the information normally stored in the area has to be clearly indicated
• all visitors must have a specific permission to enter the area, they have to be escorted at all times and their trustworthiness has to have appropriately verified in advance, unless it has been
ensured that visitors cannot have access to Classified Information.
1. Security instructions have to be drafted to each Secured Area. Instructions include
procedures concerning:
a) Handling and storage of information in the area (F-06.10): classification of the information which may be handled and stored in the area.
b) Protection and surveillance measures to be implemented (including F-06.7 – F-06.9).
c) Approval of access rights to the area (F-06.3): persons who have access to the area without
escorting, based on specific permission and verification of trustworthiness
d) Visitors (F-06.4): procedure to use escorting when needed or to protect Classified Information
in cases when exceptional people are approved access to the area
e) Other relevant procedures.
Soundproofing of the area has to be good enough to prevent unauthorized people to hear on an understandable level the discussions dealing with Classified Information. Sound- proofing has to be taken into account also inside the area in cases Classified Information is discussed and people without the need-to-know may be around.
Area without 24/7 staffing has to be inspected after working hours, when relevant, and in irregular intervals outside working hours, unless an intrusion detection system covers the area.
Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.