12 new national NIS2 framework versions published! Read more ->
Cyberday back to normal - related blog
As part of the company's overall risk management, a comprehensive strategy to manage information security and cybersecurity risks shall be developed and updated when changes occur.
Guidance
This strategy should include determining and allocating the required resources to protect the organization’s business-critical assets.
Information security and cybersecurity risks shall be documented, formally approved, and updated when changes occur.
Guidance
Consider using Risk Management tools.
The organization proactively seeks to list and assess the likelihood and severity of various cyber security risks. The documentation shall include the following:
In systematic cyber security work, the impact of significant changes must be assessed in advance and they must be executed in a controlled way. The consequences of unintentional changes must be assessed and efforts made to mitigate possible adverse effects.
Significant changes may include: changes in the organization, operating environment, business processes and data systems. Changes can be identified e.g. through management reviews and other cyber security work.
After risk treatment, the organization assesses the remaining level of residual risk per risk.
Regarding the residual risk, clear decisions are made by the risk owner to either close the risk or return the risk to the processing queue.
The organization has an operating model for continuously improving the functionality and efficiency of the risk management process.
In the improvement, it is possible to use e.g. general standards (e.g. ISO 27005) or feedback from people involved in risk management.
.png)
