Definition of data classifications and class-specific security procedures

Critical
High
Normal
Low

Data classification can be used to give data processors a quick view of how critical data is and how data should be processed and protected.

The data categories used and the corresponding security levels are defined. The category of information is defined by analyzing the confidentiality, integrity and availability of the information in question, as well as any other requirements. Each level is given a clear and descriptive name.

Data classifications can be, for example, the following:

  • disclosure of information does not cause harm (PUBLIC)
  • disclosure of information causes slight inconvenience or minor operational annoyance (CONFIDENTIAL)
  • disclosure of information has significant short-term effects on operations or tactical objectives (LIMITED)
  • disclosure of information has serious implications for long-term strategic objectives or jeopardizes the very existence of the organization (PROHIBITED)

CONFIDENTIAL paper information may require e.g. the following protections:

  • Locked cabinet
  • Trusted transfer partner
  • Sealed envelopes
  • Safe disposal process

CONFIDENTIAL electronic information may require e.g. the following protections:

  • Use the selected encryption level
  • Password protection
  • Safe disposal process
  • More limited access rights
Connected other frameworks and requirements:
T07: Tietojen luokittelu
8.2.1: Classification of information
ISO 27001
8.2.2: Labelling of information
ISO 27001
8.2: Information classification
ISO 27001
8.2.3: Handling of assets
ISO 27001

Encryption of user password information

Critical
High
Normal
Low

We use strong encryption during password transmission and storage in all services we develop.

Connected other frameworks and requirements:
9.4.2: Secure log-on procedures
ISO 27001
10.1.1: Policy on the use of cryptographic controls
ISO 27001
14.1.3: Protecting application services transactions
ISO 27001
14.2.5: Secure system engineering principles
ISO 27001
8.5: Secure authentication
ISO 27001

Encryption of public network traffic for application services

Critical
High
Normal
Low

Information included in application services transmitted over public networks must be protected against fraudulent and non-contractual activity and against unauthorized disclosure and alteration.

We use strong encryption and security protocols (eg TLS, IPSEC, SSH) to protect confidential information when it is transmitted over public networks in connection with the IT services we develop.

Connected other frameworks and requirements:
13.2.3: Electronic messaging
ISO 27001
14.1.2: Securing application services on public networks
ISO 27001
14.1.3: Protecting application services transactions
ISO 27001
14.2.5: Secure system engineering principles
ISO 27001
PR.DS-2: Data-in-transit
NIST CSF
No items found.