Definition of supplier-specific responsible persons

Critical
High
Normal
Low

A responsible person has been appointed for the provider companies, who monitors the provider's activities, communications and compliance with the contract.

Responsible person must have sufficient skills to analyze cyber security requirements depending on the criticality of the provider. Responsible person also ensures that the provider appoints an own responsible person to ensure compliance with the contract and facilitate cooperation.

Connected other frameworks and requirements:
8.1.2: Ownership of assets
ISO 27001
15.2.2: Managing changes to supplier services
ISO 27001
ID.SC-4: Audit suppliers and third-party partners
NIST CSF
8.3 (MIL2): Assign Cybersecurity Responsibilities
C2M2

Defining security roles and responsibilities

Critical
High
Normal
Low

Top management must ensure clear responsibilities / authority on at least the following themes:

  • who is primarily responsible for ensuring that the information security management system complies with the information security requirements
  • who act as ISMS theme owners responsible for the main themes of the information security management system
  • who has the responsibility and authority to report to top management on the performance of the information security management system
  • who is authorized to carry out internal audits

The ISMS theme owners are presented on the desktop of the management system and in the Information security policy report.

In addition, top management shall ensure that all roles relevant to information security, as well as related responsibilities and authorities, are defined and communicated.

Connected other frameworks and requirements:
24. Responsibility of the controller
GDPR
6.1.1: Information security roles and responsibilities
ISO 27001
T02: Turvallisuustyön tehtävien ja vastuiden määrittäminen
ID.AM-6: Cybersecurity roles and responsibilities
NIST CSF
ID.GV-2: Cybersecurity role coordination
NIST CSF
No items found.