Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Data system listing and owner assignment

Critical
High
Normal
Low

Organisation must maintain a listing of used data systems and their owners. Owner is responsible for completing the related documentation and possible other security actions directly related to the data system.

Data system documentation must include at least:

  • System purpose and linked responsibilities
  • System's data location (covered in a separate task)
  • System's maintenance and development responsibilities and linked partners (covered in a separate task)
  • When necessary system's access roles and authentication methods (covered in a separate task)
  • When necessary systems interfaces to other systems (covered in a separate task)
Connected other frameworks and requirements:
I06: Pääsyoikeuksien hallinnointi
4 luku, 13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
24. Responsibility of the controller
GDPR
5. Principles relating to processing of personal data
GDPR
32. Security of processing
GDPR

Documentation of data sets for data stores

Critical
High
Normal
Low

The organization shall maintain a list of data sets contained in the data stores it manages.

The documentation shall include at least the following information:

  • Data systems and other means used to process the data sets
  • Key categories of data in the data set (and whether it contains personal data)
  • Data retention period (discussed in more detail in a separate task)
  • Information on archiving / disposal of data (discussed in more detail in a separate task)
Connected other frameworks and requirements:
T07: Tietojen luokittelu
4 luku, 13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
4 luku, 15 §: Tietoaineistojen turvallisuuden varmistaminen
6. Lawfulness of processing
GDPR
5. Principles relating to processing of personal data
GDPR

Identification and documentation of cyber security risks

Critical
High
Normal
Low

The organization proactively seeks to list and assess the likelihood and severity of various cyber security risks. The documentation shall include the following:

  • Description of the risk
  • Evaluated impact and likelihood of the risk
  • Tasks for managing the risk or other treatment options
  • Acceptability of the risk
Connected other frameworks and requirements:
T04: Turvallisuusriskien hallinta
4 luku, 13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
24. Responsibility of the controller
GDPR
5. Principles relating to processing of personal data
GDPR
ID.GV-4: Processes
NIST CSF

Data store listing and owner assignment

Critical
High
Normal
Low

Organisation must maintain a listing of controlled data stores and their owners. Owner is responsible for completing the documentation and other possible security actions directly related to the data store.

Data store documentation must include at least:

  • Connected responsibilities
  • Data processing purposes (covered in a separate task)
  • Data sets included in the data store (covered in a separate task)
  • Data disclosures (covered in a separate task)
  • When necessary, data stores connections to action processes
Connected other frameworks and requirements:
2 luku, 5 §: Tiedonhallintamalli ja muutosvaikutuksen arviointi
6. Lawfulness of processing
GDPR
5. Principles relating to processing of personal data
GDPR
8.1.1: Inventory of assets
ISO 27001
ID.GV-4: Processes
NIST CSF

Regular reviewing of data system access rights

Critical
High
Normal
Low

Data system owner determines the access roles to the system in relation to the tasks of users. The compliance of the actual access rights with the planned ones must be monitored and the rights reassessed at regular intervals.

When reviewing access rights, care must also be taken to minimize admin rights and eliminate unnecessary accounts.

Connected other frameworks and requirements:
I06: Pääsyoikeuksien hallinnointi
4 luku, 16 §: Tietojärjestelmien käyttöoikeuksien hallinta
24. Responsibility of the controller
GDPR
32. Security of processing
GDPR
5. Principles relating to processing of personal data
GDPR

Defining and documenting retention times for data sets

Critical
High
Normal
Low

Limiting the retention time is one of the principles of the processing of personal data. If the retention period of the data is not provided by law, when determining the retention periods, the following must be taken into account, for example:

  • the necessity of the data for its original processing purpose
  • implementation and verification of the interests, rights, obligations and legal protection of a natural or legal person
  • the legal effect of the contract or other legal action in civil matters
  • statutory limitation periods
  • criminal limitation periods

Describe your own process for evaluating retention periods.

Connected other frameworks and requirements:
5 luku, 21 §: Tietoaineistojen säilytystarpeen määrittäminen
5. Principles relating to processing of personal data
GDPR
18.1.3: Protection of records
ISO 27001
PR.IP-6: Data destruction
NIST CSF
A.7.4.2: Limit processing
ISO 27701

Defining and documenting access roles

Critical
High
Normal
Low

The organization implements role-based access control with predefined access roles for the various protected assets that entitle access to the associated asset. Strictness of the access roles should reflect the security risks associated with the asset.

The following should be considered to support access management:

  • how much information each user needs access to
  • how widely the user should be able to edit data (read, write, delete, print, execute)
  • whether other applications have access to the data
  • whether the data can be segregated within the property so that sensitive data is less exposed
Connected other frameworks and requirements:
I06: Pääsyoikeuksien hallinnointi
25. Data protection by design and by default
GDPR
5. Principles relating to processing of personal data
GDPR
9.1.1: Access control policy
ISO 27001
9.2.2: User access provisioning
ISO 27001

Documentation of linked risks for identified security incidents

Critical
High
Normal
Low

Organization assesses cyber security risks by responding to situations where security has been mildly or severely compromised. The documentation shall include at least the following:

  • Description of the incident
  • Risks associated with the incident
  • New tasks introduced as a result of the incident
  • Other measures taken due to the incident
Connected other frameworks and requirements:
5. Principles relating to processing of personal data
GDPR
24. Responsibility of the controller
GDPR
T05: Jatkuvuuden hallinta

Documentation of personal data outside data systems

Critical
High
Normal
Low

Registrants have the same rights to their personal data, no matter in what form we store them. We need to be able to communicate processing and provide data subjects with access to personal data, whether on paper, in local files or in data systems.

We separately document personal data that is stored outside of data systems.

Connected other frameworks and requirements:
5. Principles relating to processing of personal data
GDPR
8.1.1: Inventory of assets
ISO 27001
5.9: Inventory of information and other associated assets
ISO 27001
No items found.