Katakri 2020

F-06.9: INSPECTIONS OF WORKING SPACES AND DEVICES (ONLY FOR NATIONAL CLASSIFICATION LEVEL II OR EU SECRET)

1. Organization has to inspect all electronic equipment, which are used in such an Administrative Area, where classification level II (SECRET) information is handled. This requirement is relevant in cases when the threat against disclosure of the information has been evaluated high.
2. In addition, the area needs to be regularly inspected, physically and technically. In addition, inspections have to be conducted following any unauthorized entry or suspicion of such entry.

Related tasks

Facility and equipment inspections in security areas (CL II)

Critical

High

Normal

Low

F-06.10: HANDLING AND STORAGE OF INFORMATION

1. Classified Information of all classification levels may be stored in the area, based on risk assessment and physical security measures.
2. Information belonging to the classification level III (CONFIDENTIAL) or higher has to be stored using an appropriate storage solution. In addition, terminal devices have to be stored equally, when possible. In case appropriate storage solution is not available in the area, the walls, the floor, the ceiling and the doors have to offer the security level sufficient for the storage of information.
3. Keys or access codes have to be kept under control of such personnel, who has the need-to-know to the information stored in the storage solution. Access codes have to be committed to memory by the authorized individuals. Combination settings to storage units containing Classified Information have to be changed:
• on receipt of a new container;
• whenever there is a change in personnel knowing the combination;
• whenever a compromise has occurred or is suspected;
• when a lock has undergone maintenance or repair;
4. It is allowed to handle information classified on all levels in the Secured Area when access to the information by unauthorized persons has been prevented.

Related tasks

Secure storage of classified information (CL IV)

Critical

High

Normal

Low

Secure storage of classified information (CL III)

Critical

High

Normal

Low

Security instructions specific to security areas (CL III)

Critical

High

Normal

Low

Keys and access codes for storage units in security areas (CL III)

Critical

High

Normal

Low

F-07: TECHNICALLY SECURED AREA

1. In addition to the minimum requirements set for Secured Areas (F-06), following requirements apply:
a) such areas have to be equipped with intrusion detection system, be locked when not occupied and be guarded when occupied. Any keys have to be controlled
b) all persons and material entering such areas have to be controlled
c) such areas have to be regularly physically and/or technically inspected as required by the Finnish Security and Intelligence Service or the Defence Command. In additions, such inspections have to be conducted following any unauthorized entry or suspicion of such entry.
d) area may only be equipped with data connections, phones and other communication or electronic devices approved to be used in the area.
2. All such communication devices, electric appliances or electronics have to be inspected before they can be used within areas where meetings handling EU SECRET / NATO SECRET information are organized or such information is worked with in cases when the threat against the Classified Information of EU or NATO is considered to be high. This procedure ensures that those devices cannot intentionally or unintentionally transfer information outside the perimeter of the Secured Area in an understandable form.
3. Threat analysis, risk management procedures and approval of security measures for the potential Technically Secured Area are done on case by case basis by the Finnish Security and Intelligence Service or by Defence Command.

Related tasks

Protection practices for technical security areas

Critical

High

Normal

Low

Property security

F-08.1: TRANSFER OF INFORMATION BY USING POSTAL OR COURIER SERVICES

1. Classified Information has to be transported or delivered according to the instructions given by the organisation, taking into account necessary protective measures.
2. Classified Information has to be packed in a manner, which prevents their unauthorized disclosure.
3. Classified Information may be transported outside Security Areas in electronic format by using encryption accredited my authorities (see I-12).
4. Information belonging to classification level IV (RESTRICTED) may be transferred in unencrypted form by using postal services.
5. Classified Information belonging to level II (SECRET) or III (CONFIDENTIAL) needs to be packed in a secure way and transported in unencrypted form to the recipient under constant control. Also other methods may be used for transportation in case the confidentiality and integrity of the information can be sufficiently ensured, bearing in mind the classification level.
6. Requirements for the transport of international Classified Information have to be asked case by case from the Finnish Security and Intelligence Service or from Defence Command.

Related tasks

Transfer of material by mail or courier (CL IV)

Critical

High

Normal

Low

Transfer of material by mail or courier (CL III)

Critical

High

Normal

Low

Transfer of material by mail or courier (CL II)

Critical

High

Normal

Low

Non-electronic data and copies

F-08.2: COPYING OF CLASSIFIED INFORMATION

1. The security measures applicable to the original document shall apply to copies and translations thereof.

Classification level II (SECRET): in addition to point 1 above
2. Copies produced of the material belonging to classification level II (SECRET) have to be listed. Same applies to people handling these copies.
3. Before copying material belonging to classification level II (SECRET), an approval for copies has to be provided by the originating authority.
4. International Classified Information may be copied and translated, unless these procedures have been prohibited by the deliverer of the information.

Related tasks

Applying original security measures to copies and translations

Critical

High

Normal

Low

Application of original security measures to copies and translations of information (CL II)

Critical

High

Normal

Low

Non-electronic data and copies

F-08.3: REGISTERING OF CLASSIFIED INFORMATION

1. A registration point or a diary has to be dedicated for organizations, which handle international Classified Information. Registration points or diaries have to be defined as Secured Areas.
2. Reception and sending of information belonging to national classification levels II and III and international classification level CONFIDENTIAL or above has to be registered.
3. Handling of information belonging to classification level III (CONFIDENTIAL) or higher is marked either into an electronic log, information system, case processing system, case register or case information (e. g. as a part of the document).
4. Registration of international Classified Information belonging to classification level CONFIDENTIAL or above has to be done in a registration point dedicated for the purpose.

Related tasks

Registry for classified information

Critical

High

Normal

Low

Recording the transfer of classified information

Critical

High

Normal

Low

Removable media

Non-electronic data and copies

F-08.4: DISPOSAL OF INFORMATION IN NON-ELECTRONIC FORMAT

Classification level IV (RESTRICTED)
1. Disposal of Classified Information in non-electronic format has to be organized in a reliable manner. When disposing, such procedures are used which prevent reconstruction of the pieces of information in whole or in part. For the information in electronic format see I-21.

Classification level III (CONFIDENTIAL): in addition to point 1 above
2. When international information belonging to the classification level CONFIDENTIAL is concerned, a disposal certificate has to be signed by the person disposing the information. This certificate will be saved at the registry. Registered information has to be updated correspondingly. The registry has to save certificates of disposal for at least five years (compare to F-08.3).

Classification level II (SECRET): in addition to points 1 and 2 above
3. In case the originator of the information is another authority, it has to be informed about the disposal of the now unnecessary information, unless the information was returned to the originating authority.
4. Only a person nominated for the task by an authority may dispose information. The drafter may dispose draft versions.
5. International information belonging to the classification level SECRET has to be disposed in the presence of a witness. The person witnessing the disposal has to be security cleared at least to the classification level of the information being disposed.

Related tasks

Destruction of non-digital information (CL IV–CL II)

Critical

High

Normal

Low

Management of data sets

Physical destruction of non-digital information

Critical

High

Normal

Low

I-01: SECURE INTERCONNECTION OF CIS – SECURITY OF THE NETWORK ARCHITECTURE

Classification level IV (RESTRICTED)
1. The information processing environment has been separated from other respective environments.
2. The connection of the information processing environment to the one(s) of another classification level requires the use of a firewall in minimum.
3. Data traffic exceeding the perimeter of a controlled physical Security Area has been encrypted using an encryption solution approved by the Crypto Approval Authority (CAA) for the respective level (see I-12 and I-15).

Classification levels III (CONFIDENTIAL) and II (SECRET): in addition to points 1 and 3 above
4. The connection of the information processing environment to the one(s) of another classification level requires the use of a boundary protection service approved by the competent authority for the respective level.

Related tasks

Structural security of networks (CL IV)

Critical

High

Normal

Low

Structural security of networks (CL III–CL II)

Critical

High

Normal

Low

Structural security of networks in classification level II environments (CL II)

Critical

High

Normal

Low

Structural security of networks in classification level I environments (CL I)

Critical

High

Normal

Low

I-02: PRINCIPLE OF LEAST PRIVILEGE - SEGMENTING OF THE COMMUNICATION NETWORK AND FILTERING RULES WITHIN THE CLASSIFICATION LEVEL

The segmenting of the communication network and the filtering rules has to be done following the principles of least privilege and defence-in-depth.

Related tasks

Network segmentation and filtering practices within the classification level

Critical

High

Normal

Low

Principle of the least privilege in network zoning

Critical

High

Normal

Low

I-03: SECURITY OF INFORMATION PROCESSING ENVIRONMENT THROUGHOUT THE LIFE CYCLE – MANAGEMENT OF FILTERING AND MONITORING SYSTEMS

The appropriate operation of filtering and monitoring systems will be taken care of through- out the life cycle of the information-processing environment.
a) Amendments, changes or removals in the setup of filtering and monitoring systems has been organized and tasked.
b) The documentation of the network and the respective filtering and monitoring systems is maintained through its life cycle as an integral part of the process of change and configuration management.
c) The setup and the desirable operation of the systems filtering and monitoring the traffic will be performed periodically during the operation and maintenance of the information-processing environment and when exceptional circumstances arise.

Related tasks

Management of filtering and monitoring systems

Critical

High

Normal

Low

I-04: SECURE INTERCONNECTION OF CIS – MANAGEMENT CONNECTIONS

1. Management connections have been separated on the basis of the classification level, unless a boundary protection service approved by the competent authority for the particular classification level is used.
2. In case Classified Information is embedded to the management traffic and if the traffic has been routed through a lower classification level environment, the Classified Information has been encrypted using a crypto solution approved by the competent authority.
3. In case the management traffic flow will stay inside the same classification level, the unencrypted transmission or encryption at a lower level may be used based on the results of the risk management process and subject to the approval by competent authority.
4. Management connections have been limited according to the least privilege principle.

Related tasks

Security of administrative connections

Critical

High

Normal

Low

Restriction of administrative connections

Critical

High

Normal

Low

Restriction of administrative connections by classification level

Critical

High

Normal

Low

Security of administrative connections involving classified information (CL IV)

Critical

High

Normal

Low

Security of administrative connections involving classified information (CL IV)

Critical

High

Normal

Low

Security of administrative connections involving classified information (CL III)

Critical

High

Normal

Low

I-05: EXCHANGE OF CLASSIFIED INFORMATION OUTSIDE THE PHYSICALLY PROTECTED AREAS - WIRELESS TRANSMISSION

Wireless transmission is encrypted using a crypto solution approved by the competent authority to the respective classification level (see I-12).

Related tasks

Encryption of information in wireless transmission (CL IV)

Critical

High

Normal

Low

I-06: THE PRINCIPLE OF LEAST PRIVILEGE – MANAGEMENT OF ACCESS RIGHTS

1. User rights to information systems have been defined.
2. User rights to information systems may be issued only after verifying that people involved have the right to handle this information (see T-13).
3. Users and the automated processes of the information-processing environment shall be given only the access, privileges or authorizations they require to perform their tasks.
4. User rights to have to be maintained updated.

Related tasks

Regular reviewing of data system access rights

Critical

High

Normal

Low

List of work tasks requiring the handling of confidential information

Critical

High

Normal

Low

Risk management

Descriptions of different access rights management processes

Critical

High

Normal

Low

Access rights are managed by the principle of the least privilege

Critical

High

Normal

Low

I-07: DEFENCE-IN-DEPTH - IDENTIFICATION OF ACTORS OF THE INFORMATION PROCESSING ENVIRONMENT WITHIN A PHYSICALLY PROTECTED SECURITY AREA

People, devices and information systems using the information-processing environment are identified reliably enough.

Related tasks

Use of multi-factor authentication for important data systems

Critical

High

Normal

Low

Avoiding and documenting shared user accounts

Critical

High

Normal

Low

Defining and documenting accepted authentication methods

Critical

High

Normal

Low

Identification of actors in the information processing environment (CL IV)

Critical

High

Normal

Low

Management of data sets

Identification of actors in the information processing environment (CL III, PL III–II)

Critical

High

Normal

Low

I-08: PRINCIPLE OF MINIMALITY AND OF LEAST PRIVILEGE - SYSTEMS HARDENING

1. Only the essential functionalities, devices and services to meet operational requirements shall be implemented in order to avoid unnecessary risks.
2. Organization uses a procedure through which systems are installed and configured systematically, resulting on a hardened installation.
3. Configuration contains only such components, services, user and process rights which are mandatory in order to fulfill the operational as well as the security requirements.
4. Configurations are maintained throughout the life cycle of the information system, including the effectiveness.

Related tasks

System hardening through minimization of active services

Critical

High

Normal

Low

System hardening in classified environments (CL III)

Critical

High

Normal

Low

Technical vulnerability management

Maintaining system hardening

Critical

High

Normal

Low