Työskentelyn tietoturvallisuus koko palvelussuhteen ajan

The employment contracts specify the responsibilities of the employee and the organization for cyber security.

Contracts should include e.g.:

• the employee's legal responsibilities and rights, such as those related to copyright or data protection law
• the employee's responsibility for following the instructions, e.g. related to the use of hardware and data and the classification of information
• the employee's or temporary employee's responsibility for processing information received from other companies or other parties
• measures if the employee or temporary worker violates the safety requirements of the organization
• continuing obligations after termination of employment

In all changes on employment relationship, access rights should be reviewed in cooperation with the owners of the protected property and re-granted to the person completely when there is a significant change in the person's employment. A change can be a promotion or a change of role (e.g., moving from one unit to another).

At the very least, job applicants applying for key cyber security roles should be subject to background checks, taking into account relevant laws and regulations.

The check may include:

• review of recommendations
• verification of CV accuracy
• verification of educational qualifications
• verification of identity from an independent source
• other more detailed checks (e.g. credit information, review of previous claims or criminal record)

The background check may also be extended to, for example, teleworkers, contractors or other third parties. The depth of the background check can be related to the category of the accessed data.

Organisaatio on muodostanut ohjeistukset, joilla varmistetaan turvallisuutta eri työsuhteen elinkaaren vaiheissa. Ohjeistuksia koulutetaan ja valvotaan tarvittavien henkilöstöryhmien parissa (esim. esimiehet).

Menettelyohjeet voidaan kohdistaa työsuhteen eri elinkaaren vaiheisiin. Eri ohjeistuksia voivat olla esimerkiksi:

• rekrytointiohjeet
• perehdyttämisohjeet
• työsuhteen aikaisten muutosten ohjeet
• työsuhteen päättymisen ohjeet
• ja ohjeet yksityiskohtaisempiin toimiin kuten esimerkiksi ohjeet käyttö- ja pääsyoikeuksien muutoksiin