Content library
Tietoturvasuunnitelma (THL 3/2024)
6.1: Yleiset tietoturvakäytännöt

How to fill the requirement

Tietoturvasuunnitelma (THL 3/2024)

6.1: Yleiset tietoturvakäytännöt

Task name
Priority
Status
Theme
Policy
Other requirements
Staff guidance and training procedure in cyber security
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Cyber security training
39
requirements

Task is fulfilling also these other security requirements

T11: Turvallisuuskoulutus ja -tietoisuus
Katakri
4 §: Tiedonhallinnan järjestäminen tiedonhallintayksikössä
TiHL
29. Processing under the authority of the controller or processor
GDPR
32. Security of processing
GDPR
7.2.1: Management responsibilities
ISO27 Full
1. Task description

Our organization has defined procedures for maintaining staff's cyber security awareness.These may include e.g. the following things:

  • staff receive instructions describing the general guidelines of digital security related to their job role
  • staff receive training to maintain the appropriate digital and cyber security skills and knowledge required for the job role
  • staff demonstrate through tests that they have the security skills and knowledge required for the job role

Training should focus on the most relevant security aspects for each job role and include often enough the basics, which concern all employees:

  • employee's personal security responsibilities (e.g. for devices and processed data)
  • policies relevant for everyone (e.g. security incident reporting)
  • guidelines relevant for everyone (e.g. clean desk)
  • organization's security roles (who to contact with problems)
ISMS description and maintenance
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Cyber security management
28
requirements

Task is fulfilling also these other security requirements

6.3: Planning of changes
ISO27k1 Full
8.1: Operational planning and control
ISO27k1 Full
4.1: Organization and its context
ISO27k1 Full
5.1.1: Policies for information security
ISO27 Full
PR.AT-5: Physical and cybersecurity personnel
NIST
1. Task description

The organization must operate, maintain, and continuously develop a security management system.

The boundaries and scope, contents, role, cumulative implementation information and other necessary descriptive information related to the management system must be clearly documented.

Records of processing activities -report publishing and maintenance
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Privacy
Processing principles and accountability
7
requirements

Task is fulfilling also these other security requirements

30. Records of processing activities
GDPR
A.7.2.8: Records related to processing PII
ISO 27701
TSU-01: Käsiteltävien henkilötietojen tunnistaminen
Julkri
TSU-21: Seloste käsittelytoimista
Julkri
61: Seloste käsittelytoiminnasta
Sec overview
1. Task description

Records of processing activities is a written description of the processing of personal data by the organization.

This report is mandatory if any of the following occurs:

  • the organization has more than 250 employees
  • the processing of personal data is not incidental
  • the processing of personal data is likely to pose a risk to the data subject's rights and freedoms
  • the personal data processed contain special categories of data or personal data relating to criminal convictions and offenses

Records must be kept up to date. They also serve as a first-level way of assessing the lawfulness of processing, so it must be provided to the supervisory authority on request.

In Cyberday, records of processing activities is an own report, which is automatically gathered from the data on documentation sections.

Appointment, tasks and position of a Data Protection Officer (DPO)
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Privacy
Security and responsibilities
14
requirements

Task is fulfilling also these other security requirements

38. Position of the data protection officer
GDPR
39. Tasks of the data protection officer
GDPR
37. Designation of the data protection officer
GDPR
18.1.4: Privacy and protection of personally identifiable information
ISO27 Full
6.6: Yleiset
Self-monitoring
1. Task description

Our organization has determined whether a data protection officer should be appointed and, if so, made an appointment.

The Data Protection Officer shall be appointed if:

  • the organization handles sensitive information on a large scale
  • the organization monitors people on an extensive, regular, and systematic basis
  • the organization is a public administration actor

In addition to the appointment, it is essential to regularly assess whether the Data Protection Officer is acting in the role and performing the tasks required by the Data Protection Regulation.

Privacy notices -report publishing and maintenance
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Privacy
Informing and data subject requests
18
requirements

Task is fulfilling also these other security requirements

14. Information to be provided where personal data have not been obtained from the data subject
GDPR
12. Transparent information, communication and modalities for the exercise of the rights of the data subject
GDPR
13. Information to be provided where personal data are collected from the data subject
GDPR
18.1.4: Privacy and protection of personally identifiable information
ISO27 Full
A.12.1: Geographical location of PII
ISO 27018
1. Task description

With regard to the processing of personal data, the data subject must be provided with the information specified in the GDPR in a concise, comprehensible and easily accessible form. This is often done in the form of privacy statements, which are published, for example, on the organisation's website.

Where personal data have not been collected from the data subject himself, the descriptions shall state, in addition to the basic content:

  • where the data were obtained
  • which categories of personal data are covered
Personnel guidelines for secure remote work
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Remote work and mobile devices
Remote work
13
requirements

Task is fulfilling also these other security requirements

7.2.2: Information security awareness, education and training
ISO27 Full
6.2.2: Teleworking
ISO27 Full
6.6.4: Fyysisten tilojen, laitteiden ja tulosteiden turvallisuus
Self-monitoring
PR.AC-3: Remote access management
NIST
FYY-04: Tiedon säilytys
Julkri
1. Task description

Remote workers have their own operating guidelines, which are monitored. In addition, regular training is provided to staff to identify threats to information security arising from the use of mobile devices and remote work, and to review the guidelines.

Information security policy -report publishing, informing and maintenance
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Cyber security management
31
requirements

Task is fulfilling also these other security requirements

T01: Turvallisuusperiaatteet
Katakri
8.1: Operational planning and control
ISO27k1 Full
5.1.2: Review of the policies for information security
ISO27 Full
5: Information security policies
ISO27 Full
5.1: Management direction for information security
ISO27 Full
1. Task description

The organization has an information security policy developed and approved by top management. The policy shall include at least the following:

  • the basis for setting the organization’s security objectives
  • commitment to meeting information security requirements
  • commitment to continuous improvement of the information security management system

In addition, the task owner shall ensure that:

  • the is appropriate for the organization's business idea
  • the policy is communicated to the entire organization
  • the policy is available to stakeholders as appropriate
Maintaining chosen theme-specific policy documents
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Cyber security management
8
requirements

Task is fulfilling also these other security requirements

5.1: Policies for information security
ISO27k1 Full
5.1.1: Policies for information security
ISO27 Full
7.5: Requirements for documented information
ISO27k1 Full
CC5.3: Establishment of policies
SOC 2
6.1: Yleiset tietoturvakäytännöt
Tietoturvasuunnitelma
1. Task description

Theme-specific policy documents can help the communication and viewing of tasks, instructions and other documentation related to different areas, as well as connecting possible upper-level principles to these contents of the management system, which describe a more detailed implementation.

The organization must define which theme-specific policy documents are maintained and, if necessary, reviewed as a whole at desired intervals. Examples of topics for which you may want to maintain your own policy document include:

  • access control
  • physical security
  • management of assets to be protected
  • backup
  • encryption practices
  • data classification
  • technical vulnerability management
  • secure development
Inventory and documentation of data processing agreements
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Privacy
Data transfer and disclosure
16
requirements

Task is fulfilling also these other security requirements

28. Data processor
GDPR
15.1.2: Addressing security within supplier agreements
ISO27 Full
13.2.2: Agreements on information transfer
ISO27 Full
A.8.2.4: Infringing instruction
ISO 27701
5.14: Information transfer
ISO27k1 Full
1. Task description

The processors of personal data (e.g. providers of data systems, other partners using our employee or customer data) and the agreements related to the processing of personal data have been documented. The documentation includes e.g.:

  • Processor name and location
  • Purpose of processing data
  • Status of agreement
Defining security roles and responsibilities
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Cyber security management
31
requirements

Task is fulfilling also these other security requirements

T02: Turvallisuustyön tehtävien ja vastuiden määrittäminen
Katakri
24. Responsibility of the controller
GDPR
6.1.1: Information security roles and responsibilities
ISO27 Full
ID.AM-6: Cybersecurity roles and responsibilities
NIST
ID.GV-2: Cybersecurity role coordination
NIST
1. Task description

Top management must ensure clear responsibilities / authority on at least the following themes:

  • who is primarily responsible for ensuring that the information security management system complies with the information security requirements
  • who act as ISMS theme owners responsible for the main themes of the information security management system
  • who has the responsibility and authority to report to top management on the performance of the information security management system
  • who is authorized to carry out internal audits

The ISMS theme owners are presented on the desktop of the management system and in the Information security policy report.

In addition, top management shall ensure that all roles relevant to information security, as well as related responsibilities and authorities, are defined and communicated. It is also important to recognize the roles and responsibilities of external partners and providers.

No items found.