Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Defining the types of removable media used

Critical
High
Normal
Low

Removable media includes e.g. flash memories, SD memories, removable storage drives, USB sticks and DVDs.

The organization has defined which removable media is allowed to be used.

Connected other frameworks and requirements:
8.3.1: Management of removable media
ISO 27001
8.3.3: Physical media transfer
ISO 27001
A.11.4: Protecting data on storage media leaving the premises
ISO 27018
13.2.1: Information transfer policies and procedures
ISO 27001
13: Communications security
ISO 27018

Protection of data in transit

Critical
High
Normal
Low

The data to be transmitted must be protected using cryptographic methods. The protection of the confidentiality and integrity of the data transmitted applies to the internal and external network and to all systems that can transmit data. These include:

  • Servers
  • Computers
  • Mobile devices
  • Printers

The data to be transferred can be protected by physical or logical means.

  • Physical protection is obtained from a protected distribution system, for example an optical fiber line, which has sufficient protection to prevent, for example, electromagnetic leakage and controls to prevent its unauthorized use.
  • Logical protection is achieved with strong encryption of communications.
Connected other frameworks and requirements:
PR.DS-2: Data-in-transit
NIST CSF

Encryption of public network traffic for application services

Critical
High
Normal
Low

Information included in application services transmitted over public networks must be protected against fraudulent and non-contractual activity and against unauthorized disclosure and alteration.

We use strong encryption and security protocols (eg TLS, IPSEC, SSH) to protect confidential information when it is transmitted over public networks in connection with the IT services we develop.

Connected other frameworks and requirements:
13.2.3: Electronic messaging
ISO 27001
14.1.2: Securing application services on public networks
ISO 27001
14.1.3: Protecting application services transactions
ISO 27001
14.2.5: Secure system engineering principles
ISO 27001
A.11.6: Encryption of PII transmitted over public data-transmission networks
ISO 27018

Electromagnetic data breach management

Critical
High
Normal
Low

Electronic devices such as cables, monitors, copiers, tablets and smartphones leak electromagnetic radiation, from which it is possible to find out the original transmitted data with the right hardware and, for example, steal the entered username and password.

Openings in the premises' structures (windows, doors, air conditioning) are protected to prevent radiation from escaping. In addition, equipment handling confidential data is located so as to minimize the risk of leakage due to electromagnetic leakage.

Connected other frameworks and requirements:
11.1.3: Securing offices, rooms and facilities
ISO 27001
11.2.1: Equipment siting and protection
ISO 27001
I14: Hajasäteily (TEMPEST)
PR.DS-2: Data-in-transit
NIST CSF
7.3: Securing offices, rooms and facilities
ISO 27001
No items found.