No items found.

Documentation of customer groups whose information is processed by the organization

Critical
High
Normal
Low

Organisation must define

  • stakeholders relevant to the information security management system
  • information security requirements set by these stakeholders

Customer groups or individual significant customers that are important to the organization's operations are usually one of the most important stakeholders, also from the point of view of information security. Other stakeholders are treated through other tasks.

Documentation of partner contract status

Critical
High
Normal
Low

A supplier agreement will be drawn up with all partners directly or indirectly involved in the processing of data. The aim is to ensure that there is no misunderstanding between the organization and the supplier of parties' obligations regarding to complying with security requirements.

The organization shall include in the supplier agreement, as appropriate:

  • the data used by the supplier (and possible data classification) and staff receiving access to data
  • rules on the acceptable use of data
  • confidentiality requirements for data processing staff
  • parties responsibilities in meeting regulatory requirements
  • parties' concrete responsibilities in relation to data security (e.g. access control, monitoring)
  • reporting and correcting incidents
  • requirements for the use of subcontractors
  • allowing auditing supplier processes and controls related to the contract (and committing to correcting non-conformities)
  • a commitment to return or destroy data at the end of the contract
  • the supplier's responsibility to comply with organization's security guidelines

Data processing partner listing and owner assignment

Critical
High
Normal
Low

The organization must maintain a list of partners who have access to confidential information. System vendors and processors of personal data are listed separately from other stakeholders because they play an active role in the processing of data.

Service level requirements in contracts related to the data processing environment

Critical
High
Normal
Low

The organization has included the service level requirements necessary for the continuity of operations as part of procurement requirements and contracts.

In particular, it is important to agree on the parts of the data processing environment that are necessary for critical functions (e.g. the information systems and partners that support these functions) in a way that guarantees sufficient availability of services. Contracts can include requirements, e.g. general service level (SLA) and recovery from problem situations (RPO, RTO).

Communicating responsibilities to suppliers

Critical
High
Normal
Low

The organization must communicate to suppliers their roles and responsibilities in supply chain security. It must also be ensured that suppliers understand their security guidelines and any other security responsibilities under the agreements.

Detailed descriptions of required security measures for subcontractors on contracts related to offered cloud services

Critical
High
Normal
Low

When involving subprocessors in processing personal data related to offered cloud services, the organization ensures that contracts clearly specify the minimum technical and organizational security measures required from subprocessors. 

Keeping contact with relevant authorities

Critical
High
Normal
Low

The organization lists the relevant government actors with whom it is important to actively contact and, if necessary, get in touch quickly. These authorities include national law enforcement and supervisory authorities.

A clear contact person should be defined for the relevant authorities to act as a contact point for the organization.

Maintaining contact with cloud-related special interest groups

Critical
High
Normal
Low

The organization should actively maintain contacts with cloud-related stakeholders and other relevant parties related to the organization's operations.

Documentation of other stakeholders

Critical
High
Normal
Low

The organization shall identify

  • the stakeholders relevant to the security management system
  • the security requirements set by these stakeholders

Data system providers and personal data processors are treated through separate tasks.

Definition of supplier-specific responsible persons

Critical
High
Normal
Low

A responsible person has been appointed for the provider companies, who monitors the provider's activities, communications and compliance with the contract.

Responsible person must have sufficient skills to analyze cyber security requirements depending on the criticality of the provider. Responsible person also ensures that the provider appoints an own responsible person to ensure compliance with the contract and facilitate cooperation.

Monitoring suppliers' compliance with security requirements

Critical
High
Normal
Low

A designated responsible person actively monitors the supplier's activities and services to ensure compliance with the security terms of the contracts and the proper management of security incidents.

Monitoring includes the following:

  • monitoring the promised service level
  • reviewing supplier reports and arranging follow-up meetings
  • regular organization of independent audits
  • follow-up of problems identified in audits
  • more detailed investigation of security incidents and review of related documentation
  • review of the supplier's future plans (related to maintaining the service level)

Collection and monitoring of supplier-specific privacy commitments

Critical
High
Normal
Low

The organization must obtain confidentiality commitments:

  • from vendors
  • business partners

Furthermore, privacy commitments must be obtained:

< ul>
  • in addition to obtaining commitments from sellers
  • business partners
  • the organization must assess:

    • compliance with data protection commitments of sellers and business partners
    • compliance with confidentiality obligations of sellers and business partners

    Contact with industry-specific interest groups

    Critical
    High
    Normal
    Low

    The organization shall actively maintain contacts with stakeholders relevant to the organization's operations and other relevant actors related to the organization's operations and security.

    The goal is especially to:

    • increase knowledge of best practices and keep up to date with relevant security information
    • ensure that organisation's understanding of the security environment is up-to-date and complete

    Terms and conditions to limit changes directly affecting customer environments

    Critical
    High
    Normal
    Low

    Supplier and partner agreements should include requirements that directly limit changes affecting customer environments.

    Changes should be explicitly approved and included in the scope of service level agreements.

    Managing changes to supplier services

    Critical
    High
    Normal
    Low

    The responsible person monitors significant changes in the supplier's operations that may affect the supplier relationship and service level, and thus require other measures. The following aspects are taken into account:

    • direct changes to supplier agreements
    • service content improvements, new technologies or the development of new services
    • significant changes in operating methods (either related to cyber security or other activities)
    • changes in the physical location of the data
    • changes in the supply chain / subcontracting process

    Evaluation of data processing agreement for important data processors

    Critical
    High
    Normal
    Low

    Data processing agreements bind the actions of a personal data processing partner.

    It can be important for us to require an important partner to take care of e.g. ensuring the confidentiality requirements for its personnel and restricting the use of other processors of personal data in connection with our data.