Learn more about the connected frameworks

18.1.3
ISO 27001

Tallenteiden suojaaminen

5.12
ISO 27001

Classification of information

5.33
ISO 27001

Protection of records

8.2.1
ISO 27001

Tiedon luokittelu

ID.AM-5
NIST CSF

Resource prioritization

T07

Tietojen luokittelu

Other tasks from the same security theme

Definition of data classifications and class-specific security procedures

Critical
High
Normal
Low

Data classification can be used to give data processors a quick view of how critical data is and how data should be processed and protected.

The data categories used and the corresponding security levels are defined. The category of information is defined by analyzing the confidentiality, integrity and availability of the information in question, as well as any other requirements. Each level is given a clear and descriptive name.

Data classifications can be, for example, the following:

  • disclosure of information does not cause harm (PUBLIC)
  • disclosure of information causes slight inconvenience or minor operational annoyance (CONFIDENTIAL)
  • disclosure of information has significant short-term effects on operations or tactical objectives (LIMITED)
  • disclosure of information has serious implications for long-term strategic objectives or jeopardizes the very existence of the organization (PROHIBITED)

CONFIDENTIAL paper information may require e.g. the following protections:

  • Locked cabinet
  • Trusted transfer partner
  • Sealed envelopes
  • Safe disposal process

CONFIDENTIAL electronic information may require e.g. the following protections:

  • Use the selected encryption level
  • Password protection
  • Safe disposal process
  • More limited access rights
T07: Tietojen luokittelu
8.2.1: Classification of information
ISO 27001
8.2.2: Labelling of information
ISO 27001
8.2: Information classification
ISO 27001
8.2.3: Handling of assets
ISO 27001

Documentation of data classes for data sets

Critical
High
Normal
Low

The dataset owners (or the owners of the related information asset, such as a data store or data system) are responsible for the classifications of the datasets and the correspondence of the classification to the definitions of the classes.

The owner updates the data classification over the life cycle of the asset according to variations in its value, sensitivity, and criticality.

T07: Tietojen luokittelu
8.2.1: Classification of information
ISO 27001
18.1.3: Protection of records
ISO 27001
ID.AM-5: Resource prioritization
NIST CSF
5.12: Classification of information
ISO 27001

Defining and implementing masking for confidential data

Critical
High
Normal
Low

Organization must determine the situations in which the protection of personal data or other confidential data is particularly important, and if necessary implement the hiding of such data using suitably strong methods, for example using masking, pseudonymization or anonymization.

In addition to anonymization and pseudonymization, possible techniques that can be used include:

  • encryption
  • resetting or deleting characters
  • changing values
  • replacing values with hashes
8.11: Data masking
ISO 27001

Lakisääteisten vaatimusten huomiointi tietoluokitteluun liittyvissä merkinnöissä

Critical
High
Normal
Low

Tiedon merkitsemistapojen pitää kattaa sekä fyysisessä että sähköisessä muodossa olevat tiedot ja niihin liittyvä suojattava omaisuus kuten tietovälineet.

Merkintöjen olisi oltava organisaation määrittelemien luokitteluperiaatteiden mukaisia ja helposti tunnistettavia. Organisaation olisi ohjeistettava, mihin ja miten merkinnät kiinnitetään. Ohjeistuksessa tulee ottaa huomioon myös tulosteet. Lisäksi tarpeettoman työn säästämiseksi kannattaa ohjeistaa, milloin merkintöjä ei tarvita.

Tietyissä tapauksissa, kuten esimerkiksi julkisuuslain mukaisista salassa pitoa koskevista merkinnöistä tulee myös käydä ilmi, miltä osin asiakirja on salassa pidettävä sekä mihin salassapito perustuu.



No items found.

Data classification for offices and physical data assets

Critical
High
Normal
Low

In addition to the records, the organization has also classified the sites and physical assets based on the criticality of the information they process.

No items found.

Definitions and instructions on information classifications

Critical
High
Normal
Low

The ways in which information is classified and classifications marked are defined, markings are easily identifiable and they cover both physical and electronic information and assets. The marking must indicate to what extent the document is to be kept secret and on what basis the secrecy is based. Personnel are instructed on how to make markings.

8.2.1: Classification of information
ISO 27001
8.2.2: Labelling of information
ISO 27001
12.1.1: Documented operating procedures
ISO 27001
5.13: Labelling of information
ISO 27001

Identification of confidential information

Critical
High
Normal
Low

The organization must have a procedure for identifying new datasets containing confidential information during their reception or creation phase.

A retention period must be set for datasets containing confidential information, after which the data is deleted or archived.

No items found.

Review of data classification procedures

Critical
High
Normal
Low

The functionality and consistency of the data classification is regularly reviewed in the organization as a whole.

The principles of data classification should be consistent throughout the organization so that everyone has a common understanding of security requirements and equally critical protection is applied to equally critical information.

8.2.3: Handling of assets
ISO 27001

Marking of equipment that needs safe disposal

Critical
High
Normal
Low

There are agreed procedures for identifying and marking media that require safe disposal.

8.2.2: Labelling of information
ISO 27001
8.3.2: Disposal of media
ISO 27001
5.13: Labelling of information
ISO 27001