Content library
TiHL: Suositus tietoturvan vähimmäisvaatimuksista
2.4: Luokittelu ja turvallisuusluokittelu

How to fill the requirement

TiHL: Suositus tietoturvan vähimmäisvaatimuksista

2.4: Luokittelu ja turvallisuusluokittelu

Task name
Priority
Status
Theme
Policy
Other requirements
Documentation of data sets for data stores
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Management of data sets
Management of data sets
38
requirements

Task is fulfilling also these other security requirements

T07: Tietojen luokittelu
Katakri
13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
TiHL
15 §: Tietoaineistojen turvallisuuden varmistaminen
TiHL
6. Lawfulness of processing
GDPR
5. Principles relating to processing of personal data
GDPR
1. Task description

The organization shall maintain a list of data sets contained in the data stores it manages.

The documentation shall include at least the following information:

  • Data systems and other means used to process the data sets
  • Key categories of data in the data set (and whether it contains personal data)
  • Data retention period (discussed in more detail in a separate task)
  • Information on archiving / disposal of data (discussed in more detail in a separate task)
Definition of data classifications and class-specific security procedures
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Management of data sets
Data classification
27
requirements

Task is fulfilling also these other security requirements

T07: Tietojen luokittelu
Katakri
8.2.1: Classification of information
ISO27 Full
8.2.2: Labelling of information
ISO27 Full
8.2: Information classification
ISO27 Full
8.2.3: Handling of assets
ISO27 Full
1. Task description

Data classification can be used to give data processors a quick view of how critical data is and how data should be processed and protected.

The data categories used and the corresponding security levels are defined. The category of information is defined by analyzing the confidentiality, integrity and availability of the information in question, as well as any other requirements. Each level is given a clear and descriptive name.

Data classifications can be, for example, the following:

  • disclosure of information does not cause harm (PUBLIC)
  • disclosure of information causes slight inconvenience or minor operational annoyance (CONFIDENTIAL)
  • disclosure of information has significant short-term effects on operations or tactical objectives (LIMITED)
  • disclosure of information has serious implications for long-term strategic objectives or jeopardizes the very existence of the organization (PROHIBITED)

CONFIDENTIAL paper information may require e.g. the following protections:

  • Locked cabinet
  • Trusted transfer partner
  • Sealed envelopes
  • Safe disposal process

CONFIDENTIAL electronic information may require e.g. the following protections:

  • Use the selected encryption level
  • Password protection
  • Safe disposal process
  • More limited access rights
Documentation of data classes for data sets
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Management of data sets
Data classification
19
requirements

Task is fulfilling also these other security requirements

T07: Tietojen luokittelu
Katakri
8.2.1: Classification of information
ISO27 Full
18.1.3: Protection of records
ISO27 Full
ID.AM-5: Resource prioritization
NIST
HAL-04.2: Suojattavat kohteet - luokittelu
Julkri
1. Task description

The dataset owners (or the owners of the related information asset, such as a data store or data system) are responsible for the classifications of the datasets and the correspondence of the classification to the definitions of the classes.

The owner updates the data classification over the life cycle of the asset according to variations in its value, sensitivity, and criticality.

Kasautumisvaikutuksen huomiointi suojattavien kohteiden luokittelussa
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Cyber security management
2
requirements

Task is fulfilling also these other security requirements

HAL-04.3: Suojattavat kohteet - kasautumisvaikutus
Julkri
2.4: Luokittelu ja turvallisuusluokittelu
TiHL: Tietoturva
1. Task description

Tietojärjestelmän tai muun useita tietoaineistoja sisältävän kohteen luokitus määräytyy ensi sijassa korkeimman luokituksen aineiston mukaan. Tietojärjestelmien luokitusta arvioitaessa tulee huomioida myös kasautumisvaikutus riskilähtöisesti.

Suuresta määrästä tietyn luottamuksellisuuden tason tietoa koostuvissa tietojärjestelmissä asiakokonaisuus voi nousta luokitukseltaan yksittäistä tietoa korkeammalle tasolle. Määrä ei ole kuitenkaan ainoa tekijä, vaan joskus esimerkiksi kahden eri tietolähteen yhdistäminen voi johtaa tietovarannon luokituksen nousemiseen.

Tyypillisesti kasautumisessa on kysymys IV-luokan tiedosta (esimerkiksi suuri määrä turvallisuusluokan IV tietoa voi muodostaa yhdistettynä turvallisuusluokan III tietovarannon), mutta kasautumisvaikutus tulee huomioida myös turvallisuusluokittelemattoman salassa pidettävän tiedon suojaamisessa.



Designation of data set owners
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Management of data sets
Management of data sets
11
requirements

Task is fulfilling also these other security requirements

T07: Tietojen luokittelu
Katakri
13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
TiHL
15 §: Tietoaineistojen turvallisuuden varmistaminen
TiHL
32. Security of processing
GDPR
8.1.2: Ownership of assets
ISO27 Full
1. Task description

An owner is assigned to each data set. The owner is responsible for the life cycle of the information asset and is responsible for performing the management tasks related to that asset.

The owner's duties include e.g.:

  • ensuring the documentation of asset
  • ensuring appropriate protection of asset
  • regularly reviewing access rights
  • ensuring proper handling of information, also on disposal

The owner can delegate some of the tasks, but the responsibility remains with the owner.

Priority classification of an organization's information assets
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Cyber security management
6
requirements

Task is fulfilling also these other security requirements

ID.AM-5: Resource prioritization
NIST
HAL-04.2: Suojattavat kohteet - luokittelu
Julkri
CC3.2: Identification of risks related to objectives
SOC 2
2.4: Luokittelu ja turvallisuusluokittelu
TiHL: Tietoturva
ID.AM-5: Resources are prioritized based on their classification, criticality, and business value.
CyFun
1. Task description

An organization must classify its information assets, such as information systems, data, units, key personnel, and other assets to be protected (e.g., equipment), according to priorities. Prioritization can be done, for example, based on the requirements for confidentiality, integrity, and availability of the information being processed.

No items found.