Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Learn more about the connected frameworks

11.2.7
ISO 27001

Laitteiden turvallinen käytöstä poistaminen ja kierrättäminen

12.1.1
ISO 27001

Dokumentoidut toimintaohjeet

29
GDPR

Processing under the authority of the controller or processor

4 §

Tiedonhallinnan järjestäminen tiedonhallintayksikössä

5.37
ISO 27001

Documented operating procedures

8.3.2
ISO 27001

Tietovälineiden hävittäminen

9.4.4
ISO 27001

Ylläpito- ja hallintasovellukset

T11

Turvallisuuskoulutus ja -tietoisuus

Other tasks from the same security theme

General security guidelines for staff

Critical
High
Normal
Low

Personnel must have security guidelines that deal with e.g. the following topics:

  • Using and updating mobile devices
  • Storing and backing up data
  • Privacy
  • Using email
  • Handling of printouts, papers and files
  • Reporting incidents
  • Scam prevention
T11: Turvallisuuskoulutus ja -tietoisuus
2 luku, 4 §: Tiedonhallinnan järjestäminen tiedonhallintayksikössä
29. Processing under the authority of the controller or processor
GDPR
9.4.4: Use of privileged utility programs
ISO 27001
11.2.7: Secure disposal or re-use of equipment
ISO 27001

Early orientation of security guidelines for personnel

Critical
High
Normal
Low

Tietoa käsitteleville henkilöille selvitetään tietojen suojaamista ja asiakirjojen käsittelyä koskevat tietoturvaohjeet ja -periaatteet ennen pääsyä tietoihin tai organisaation tarkasti määrittelemien aikamääreiden sisällä.

No items found.

Monitoring compliance with security guidelines

Critical
High
Normal
Low

Following security guidelines can be monitored either technically or directly by asking / testing employees.

T11: Turvallisuuskoulutus ja -tietoisuus
29. Processing under the authority of the controller or processor
GDPR
18.2.2: Compliance with security policies and standards
ISO 27001
5.36: Compliance with policies, rules and standards for information security
ISO 27001
5.37: Documented operating procedures
ISO 27001

Unit- or role-specific security guidelines

Critical
High
Normal
Low

The security guidelines are specified in connection with the employee's job role. The organization has identified units and roles that require separate guidance and develops its own detailed security guidelines for these.

Examples of units that may require their own guidelines are e.g. customer service, IT and HR. Examples of work roles that require their own instructions are the system administrators and the remote workers.

2 luku, 4 §: Tiedonhallinnan järjestäminen tiedonhallintayksikössä
7.2.2: Information security awareness, education and training
ISO 27001
PR.AT-1: Awareness
NIST CSF
6.3: Information security awareness, education and training
ISO 27001

Informing about threats and guidelines related to classified information and related to work tasks

Critical
High
Normal
Low

The management of the organization must ensure that the organization has up-to-date instructions on data processing, the use of information systems, data processing rights, the implementation of data management responsibilities, the implementation of access to information rights and information security measures.

In practice, the management defines how the up-to-dateness of the instructions is ensured and to which actors the instructions apply. taking care of up-to-dateness is part of it.

It is recommended to assign the responsibility for keeping the instructions up-to-date to those actors who have overall responsibility for information security, information systems, data reserves, record keeping, decision-making related to document requests, case management and archive work.

No items found.

Continuous development of guidelines

Critical
High
Normal
Low

If staff have conflicting goals with the security guidelines, they are unlikely to follow the guidelines.

The organization actively seeks to find poorly functioning guidelines and modify either the guidelines, tools or staff priorities to enable following the guidelines.

T11: Turvallisuuskoulutus ja -tietoisuus
12.1.1: Documented operating procedures
ISO 27001
5.37: Documented operating procedures
ISO 27001
6.3: Information security awareness, education and training
ISO 27001