Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Personnel guidelines for safe usage of mobile devices

Critical
High
Normal
Low

There are separate instructions for staff to use mobile devices. The instructions cover:

  • restrictions on installing software and using various services on your organization's devices
  • procedures for the registration of new devices
  • requirements for physical protection of equipment and installation of updates
  • access control requirements
  • protecting your organization’s data with encryption, malware protection, and backup
  • the ability of the organization to remotely control the device
Connected other frameworks and requirements:
11.2.6: Security of equipment and assets off-premises
ISO 27001
6.2.1: Mobile device policy
ISO 27001
10.1.1: Policy on the use of cryptographic controls
ISO 27001
11.2.8: Unattended user equipment
ISO 27001
12.6.2: Restrictions on software installation
ISO 27001

Definition of data classifications and class-specific security procedures

Critical
High
Normal
Low

Data classification can be used to give data processors a quick view of how critical data is and how data should be processed and protected.

The data categories used and the corresponding security levels are defined. The category of information is defined by analyzing the confidentiality, integrity and availability of the information in question, as well as any other requirements. Each level is given a clear and descriptive name.

Data classifications can be, for example, the following:

  • disclosure of information does not cause harm (PUBLIC)
  • disclosure of information causes slight inconvenience or minor operational annoyance (CONFIDENTIAL)
  • disclosure of information has significant short-term effects on operations or tactical objectives (LIMITED)
  • disclosure of information has serious implications for long-term strategic objectives or jeopardizes the very existence of the organization (PROHIBITED)

CONFIDENTIAL paper information may require e.g. the following protections:

  • Locked cabinet
  • Trusted transfer partner
  • Sealed envelopes
  • Safe disposal process

CONFIDENTIAL electronic information may require e.g. the following protections:

  • Use the selected encryption level
  • Password protection
  • Safe disposal process
  • More limited access rights
Connected other frameworks and requirements:
T07: Tietojen luokittelu
8.2.1: Classification of information
ISO 27001
8.2.2: Labelling of information
ISO 27001
8.2: Information classification
ISO 27001
8.2.3: Handling of assets
ISO 27001

Arranging suitable equipment and storage equipment for teleworking

Critical
High
Normal
Low

Arranging suitable equipment and storage for teleworking if the use of personal equipment beyond the control of the organization is not permitted.

Connected other frameworks and requirements:
11.2.6: Security of equipment and assets off-premises
ISO 27001
6.2.2: Teleworking
ISO 27001
6.7: Remote working
ISO 27001
7.9: Security of assets off-premises
ISO 27001
No items found.