Acquisition and instructions for a VPN-service

Critical
High
Normal
Low

Organisation's data can only be processed on a predefined, trusted network, or by using a VPN service defined by the organisation.

For example, a coffee shop's Wi-Fi network is often either completely unencrypted or the password is easily accessible to everyone. In this case, the information sent online is vulnerable to spyware. A VPN connection encrypts information regardless of network settings.

Connected other frameworks and requirements:
6.2.2: Teleworking
ISO 27001
9.1.2: Access to networks and network services
ISO 27001
14.1.2: Securing application services on public networks
ISO 27001
6.7: Remote working
ISO 27001

Definition of data classifications and class-specific security procedures

Critical
High
Normal
Low

Data classification can be used to give data processors a quick view of how critical data is and how data should be processed and protected.

The data categories used and the corresponding security levels are defined. The category of information is defined by analyzing the confidentiality, integrity and availability of the information in question, as well as any other requirements. Each level is given a clear and descriptive name.

Data classifications can be, for example, the following:

  • disclosure of information does not cause harm (PUBLIC)
  • disclosure of information causes slight inconvenience or minor operational annoyance (CONFIDENTIAL)
  • disclosure of information has significant short-term effects on operations or tactical objectives (LIMITED)
  • disclosure of information has serious implications for long-term strategic objectives or jeopardizes the very existence of the organization (PROHIBITED)

CONFIDENTIAL paper information may require e.g. the following protections:

  • Locked cabinet
  • Trusted transfer partner
  • Sealed envelopes
  • Safe disposal process

CONFIDENTIAL electronic information may require e.g. the following protections:

  • Use the selected encryption level
  • Password protection
  • Safe disposal process
  • More limited access rights
Connected other frameworks and requirements:
T07: Tietojen luokittelu
8.2.1: Classification of information
ISO 27001
8.2.2: Labelling of information
ISO 27001
8.2: Information classification
ISO 27001
8.2.3: Handling of assets
ISO 27001

Encryption of public network traffic for application services

Critical
High
Normal
Low

Information included in application services transmitted over public networks must be protected against fraudulent and non-contractual activity and against unauthorized disclosure and alteration.

We use strong encryption and security protocols (eg TLS, IPSEC, SSH) to protect confidential information when it is transmitted over public networks in connection with the IT services we develop.

Connected other frameworks and requirements:
13.2.3: Electronic messaging
ISO 27001
14.1.2: Securing application services on public networks
ISO 27001
14.1.3: Protecting application services transactions
ISO 27001
14.2.5: Secure system engineering principles
ISO 27001
PR.DS-2: Data-in-transit
NIST CSF

Security rules for the development and acquisition of data systems

Critical
High
Normal
Low

Whenever new data systems are acquired or developed, pre-defined security rules are followed, taking into account the priority of the system. The rules ensure that adequate measures are taken to ensure the security of the data and data processing in the system.

Connected other frameworks and requirements:
I13: Ohjelmistoilla toteutettavat pääsynhallintatoteutukset
4 luku, 13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
14.1.1: Information security requirements analysis and specification
ISO 27001
14.1.2: Securing application services on public networks
ISO 27001
14.2.5: Secure system engineering principles
ISO 27001
No items found.