Data system listing and owner assignment

Critical
High
Normal
Low

Organisation must maintain a listing of used data systems and their owners. Owner is responsible for completing the related documentation and possible other security actions directly related to the data system.

Data system documentation must include at least:

  • System purpose and linked responsibilities
  • System's data location (covered in a separate task)
  • System's maintenance and development responsibilities and linked partners (covered in a separate task)
  • When necessary system's access roles and authentication methods (covered in a separate task)
  • When necessary systems interfaces to other systems (covered in a separate task)
Connected other frameworks and requirements:
I06: Pääsyoikeuksien hallinnointi
4 luku, 13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
24. Responsibility of the controller
GDPR
5. Principles relating to processing of personal data
GDPR
32. Security of processing
GDPR

Documentation of data sets for data stores

Critical
High
Normal
Low

The organization shall maintain a list of data sets contained in the data stores it manages.

The documentation shall include at least the following information:

  • Data systems and other means used to process the data sets
  • Key categories of data in the data set (and whether it contains personal data)
  • Data retention period (discussed in more detail in a separate task)
  • Information on archiving / disposal of data (discussed in more detail in a separate task)
Connected other frameworks and requirements:
T07: Tietojen luokittelu
4 luku, 13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
4 luku, 15 §: Tietoaineistojen turvallisuuden varmistaminen
6. Lawfulness of processing
GDPR
5. Principles relating to processing of personal data
GDPR

Data store listing and owner assignment

Critical
High
Normal
Low

Organisation must maintain a listing of controlled data stores and their owners. Owner is responsible for completing the documentation and other possible security actions directly related to the data store.

Data store documentation must include at least:

  • Connected responsibilities
  • Data processing purposes (covered in a separate task)
  • Data sets included in the data store (covered in a separate task)
  • Data disclosures (covered in a separate task)
  • When necessary, data stores connections to action processes
Connected other frameworks and requirements:
2 luku, 5 §: Tiedonhallintamalli ja muutosvaikutuksen arviointi
6. Lawfulness of processing
GDPR
5. Principles relating to processing of personal data
GDPR
8.1.1: Inventory of assets
ISO 27001
ID.GV-4: Processes
NIST CSF

Listing offered digital services and naming owners

Critical
High
Normal
Low

The organization must maintain a list of digital services provided and the owners designated for them. The owner is responsible for completing the information in the service and for any other security measures that are closely related to the service.

The documentation related to the digital service includes e.g. the following information:

  • The type of digital service offered, the service category and the purpose of use
  • Data controller and related processing agreements
  • Key partners in the service supply chain and the distribution of security responsibilities (discussed in more detail in a separate task)
Connected other frameworks and requirements:
A.2.1: Obligation to co-operate regarding PII principals’ rights
ISO 27018
A.2: Consent and choice
ISO 27018
6: Organization of information security
ISO 27017
CLD 6.3: Relationship between cloud service customer and cloud service provider
ISO 27017
CLD 6.3.1: Shared roles and responsibilities within a cloud computing environment
ISO 27017

Documentation of other protected assets

Critical
High
Normal
Low

The organization shall list all relevant protected assets to determine ownership and to ensure that security measures cover all necessary items.

A large portion of the protected assets (including data sets, data systems, personnel / units, and partners) are treated through other tasks. In addition, the organization must list other important assets, which may be, depending on the nature of its operations, e.g. hardware (servers, network equipment, workstations, printers) or infrastructure (real estate, power generation, air conditioning).

Connected other frameworks and requirements:
8.1.1: Inventory of assets
ISO 27001
8.1.2: Ownership of assets
ISO 27001
ID.AM-1: Physical device inventory
NIST CSF
ID.AM-2: Software and app inventory
NIST CSF
5.9: Inventory of information and other associated assets
ISO 27001

Documentation of assets inventories outside the ISMS

Critical
High
Normal
Low

Assets to be protected related to information and data processing services should be inventoried. The purpose is to ensure that the cyber security is focused on the necessary information assets.

Inventory can be done directly in the management system, but an organization may have other, well-functioning inventory locations for certain assets (including code repositories, databases, network devices, mobile devices, workstations, servers, or other physical assets).

Describe in this task, which lists outside the management system are related to protection of information assets.

Connected other frameworks and requirements:
8.1.1: Inventory of assets
ISO 27001
ID.AM-1: Physical device inventory
NIST CSF
ID.AM-2: Software and app inventory
NIST CSF
5.9: Inventory of information and other associated assets
ISO 27001

Documentation of personal data outside data systems

Critical
High
Normal
Low

Registrants have the same rights to their personal data, no matter in what form we store them. We need to be able to communicate processing and provide data subjects with access to personal data, whether on paper, in local files or in data systems.

We separately document personal data that is stored outside of data systems.

Connected other frameworks and requirements:
5. Principles relating to processing of personal data
GDPR
8.1.1: Inventory of assets
ISO 27001
5.9: Inventory of information and other associated assets
ISO 27001
No items found.