Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Staff guidance and training procedure in cyber security

Critical
High
Normal
Low

Our organization has defined procedures for maintaining staff's cyber security awareness.These may include e.g. the following things:

  • staff receive instructions describing the general guidelines of digital security related to their job role
  • staff receive training to maintain the appropriate digital and cyber security skills and knowledge required for the job role
  • staff demonstrate through tests that they have the security skills and knowledge required for the job role

Training should focus on the most relevant security aspects for each job role and include often enough the basics, which concern all employees:

  • employee's personal security responsibilities (e.g. for devices and processed data)
  • policies relevant for everyone (e.g. security incident reporting)
  • guidelines relevant for everyone (e.g. clean desk)
  • organization's security roles (who to contact with problems)
Connected other frameworks and requirements:
T11: Turvallisuuskoulutus ja -tietoisuus
2 luku, 4 §: Tiedonhallinnan järjestäminen tiedonhallintayksikössä
29. Processing under the authority of the controller or processor
GDPR
32. Security of processing
GDPR
7.2.1: Management responsibilities
ISO 27001

Personnel guidelines for safe processing of personal and confidential data

Critical
High
Normal
Low

The Data Protection Officer (or other responsible person) has drawn up operating instructions for personnel handling personal data. In addition, the Data Protection Officer is ready to advise the controller, personal data processing partners or their own staff on compliance with GDPR or other data protection requirements.

Connected other frameworks and requirements:
29. Processing under the authority of the controller or processor
GDPR
7.2.2: Information security awareness, education and training
ISO 27001
18.1.4: Privacy and protection of personally identifiable information
12.1.1: Documented operating procedures
ISO 27001
11.2.8: Unattended user equipment
ISO 27001

Personnel guidelines for secure remote work

Critical
High
Normal
Low

Remote workers have their own operating guidelines, which are monitored. In addition, regular training is provided to staff to identify threats to information security arising from the use of mobile devices and remote work, and to review the guidelines.

Connected other frameworks and requirements:
6.2.2: Teleworking
ISO 27001
7.2.2: Information security awareness, education and training
ISO 27001
PR.AC-3: Remote access management
NIST CSF
6.7: Remote working
ISO 27001

Personnel guidelines for file usage and local data

Critical
High
Normal
Low

Especially when local or unstructured data needs to be handled a lot due to the nature of the activity, it may be necessary to develop training that describes the risks involved for staff.

Common problems with local and unstructured data include e.g.:

  • no backups
  • no access management
  • hard to locate

For data you do not want to lose, that you want to control, or that is important to find in the future, staff should use data systems designed for it.

Connected other frameworks and requirements:
7.2.2: Information security awareness, education and training
ISO 27001
11.2.9: Clear desk and clear screen policy
ISO 27001
5.10: Acceptable use of information and other associated assets
ISO 27001
8.12: Data leakage prevention
ISO 27001

General security competence and awareness of personnel

Critical
High
Normal
Low

Personnel under the direction of the entire organization must be aware:

  • how they can contribute to the effectiveness of the information security management system and the benefits of improving the level of information security
  • the consequences of non-compliance with the requirements of the information security management systemwhich roles in the personnel have effects to the level of security

In addition, top management has defined ways in which personnel are kept aware of security guidelines related to their own job role.

Connected other frameworks and requirements:
32. Security of processing
GDPR
29. Processing under the authority of the controller or processor
GDPR
7.2.2: Information security awareness, education and training
ISO 27001
7.2.1: Management responsibilities
ISO 27001
PR.AT-1: Awareness
NIST CSF

Unit- or role-specific security guidelines

Critical
High
Normal
Low

The security guidelines are specified in connection with the employee's job role. The organization has identified units and roles that require separate guidance and develops its own detailed security guidelines for these.

Examples of units that may require their own guidelines are e.g. customer service, IT and HR. Examples of work roles that require their own instructions are the system administrators and the remote workers.

Connected other frameworks and requirements:
7.2.2: Information security awareness, education and training
ISO 27001
2 luku, 4 §: Tiedonhallinnan järjestäminen tiedonhallintayksikössä
PR.AT-1: Awareness
NIST CSF
6.3: Information security awareness, education and training
ISO 27001

Management commitment to cyber security management and management system

Critical
High
Normal
Low

The organization's top management must demonstrate a commitment to cyber security work and the management system. Management commits to:

  • defining the frameworks or other requirements that form the basis for work (e.g. customer promises, regulations or certificates)
  • determining the resources needed to manage security
  • communicating the importance of cyber security
  • ensuring that the work achieves the desired results
  • promoting the continuous improvement of cyber security

Top management also decides the scope of the information security management system and records the decision in the description of the system. This means, for example, whether some parts of the organisation's activities or information are excluded from the scope of the management system, or whether it applies to all information / activities of the organization.

Connected other frameworks and requirements:
24. Responsibility of the controller
GDPR
7.2.1: Management responsibilities
ISO 27001
7.2.2: Information security awareness, education and training
ISO 27001
5.1.1: Policies for information security
ISO 27001
ID.GV-1: Cybersecurity policy
NIST CSF

Maintaining a log of cyber security trainings

Critical
High
Normal
Low

A log is kept of the cyber security training events provided by the organization to its staff. The log can be used to show what kind of specific investments the organization has made towards staff's cyber security expertise.

For each training the documentation should include:

  • Time
  • Topics and duration of the training
  • Training method and trainer
  • Staff involved in the training
Connected other frameworks and requirements:
T11: Turvallisuuskoulutus ja -tietoisuus
7.2.2: Information security awareness, education and training
ISO 27001
PR.AT-1: Awareness
NIST CSF
6.3: Information security awareness, education and training
ISO 27001
8.4 (MIL1): Develop Cybersecurity Workforce
C2M2

Instructing and training staff regarding malware

Critical
High
Normal
Low

The organization regularly trains staff on the use of utilized malware protection, reporting malware attacks, and recovering from malware attacks.

Connected other frameworks and requirements:
12.2: Protection from malware
ISO 27001
7.2.2: Information security awareness, education and training
ISO 27001
12.2.1: Controls against malware
ISO 27001
I09: Haittaohjelmasuojaus
8.7: Protection against malware
ISO 27001

Informing staff about new, relevant malware

Critical
High
Normal
Low

Ensuring staff security awareness is an important part of protection against malware. Because of this, staff are regularly informed of new types of malware that may threaten them.

Connected other frameworks and requirements:
12.2: Protection from malware
ISO 27001
7.2.2: Information security awareness, education and training
ISO 27001
12.2.1: Controls against malware
ISO 27001
8.2 (MIL1): Increase Cybersecurity Awareness
C2M2

Training own IT-personnel for security system usage

Critical
High
Normal
Low

The necessary personnel are regularly trained in the use of selected security systems.

Connected other frameworks and requirements:
7.2.2: Information security awareness, education and training
ISO 27001

Evaluating the efficiency of arranged training

Critical
High
Normal
Low

The effectiveness of cyber security training is regularly evaluated. The evaluation may include e.g. the following perspectives:

  • Is the competence of the staff deep enough?
  • Are the training methods and amounts correct?
  • Are different units trained in the right things?
  • Is the staff motivated to learn?
  • Does the staff understand the reasons for the training (e.g. what kind of negative effects can a cyber security breach have?


Connected other frameworks and requirements:
7.2.2: Information security awareness, education and training
ISO 27001
6.3: Information security awareness, education and training
ISO 27001

Regular unit-based cyber security communication

Critical
High
Normal
Low

By informing the units on the most important cyber security issues for them and in the language they understand, great strides can be made at the level of cyber security as staff have a better understanding of why different policies and rules apply. Informing can include distributing cyber guidelines in small chunks, various campaigns (e.g. “Security Day”), leaflets, newsletters, competitions or other similar elements.

Security informing may also be referred to as an "awareness program".

Connected other frameworks and requirements:
7.2.2: Information security awareness, education and training
ISO 27001

Training the use of security systems and reporting of malware attacks

Critical
High
Normal
Low

Our organization has defined procedures and responsibilities for protecting systems from malware and trains staff to use the protections and to report and recover from malware attacks.

Connected other frameworks and requirements:
12.2: Protection from malware
ISO 27001
7.2.2: Information security awareness, education and training
ISO 27001
12.2.1: Controls against malware
ISO 27001
8.7: Protection against malware
ISO 27001

Formal adoption of security policies

Critical
High
Normal
Low

The employees of our organization accept the general information security policy formed by the management with their signatures. The policy may refer to a number of more specific security guidelines.

Connected other frameworks and requirements:
5.1.1: Policies for information security
ISO 27001
7.2.2: Information security awareness, education and training
ISO 27001
5.1: Policies for information security
ISO 27001
No items found.