Treatment process and documentation of occurred security incidents

Critical
High
Normal
Low

All security incidents are addressed in a consistent manner to improve security based on what has happened.

In the incident treatment process:

  • the reported incident is confirmed (or found unnecessary to record)
  • the type and cause of incident is documented
  • the risks associated with the incident are documented
  • the risks are re-evaluated and treated if that is necessary after the incident
  • risk mitigation measures or a decision their acceptance is documented
  • people who need to be informed of the results of the incident treatment are identified (including external ones)
  • possible need for a post-incident analysis is determined
Connected other frameworks and requirements:
T06: Turvallisuuspoikkeamien hallinta
32. Security of processing
GDPR
12. Transparent information, communication and modalities for the exercise of the rights of the data subject
GDPR
16.1.5: Response to information security incidents
ISO 27001
DE.AE-2: Analyze detected events
NIST CSF

Follow-up analysis for security incidents

Critical
High
Normal
Low

If it is difficult to identify the source of a security incident based on the primary treatment, a separate follow-up analysis is performed for the incident, in which the root cause is sought to be identified.

Connected other frameworks and requirements:
16.1.6: Learning from information security incidents
ISO 27001
ID.RA-4: Impacts on business
NIST CSF
DE.DP-5: Detection processes improvment
NIST CSF
RS.AN-2: The impact of the incident
NIST CSF
RS.IM-1: Response plans
NIST CSF

Regular periodic analysis and learning of incidents

Critical
High
Normal
Low

The knowledge gained from analyzing and resolving security incidents should be used to reduce the likelihood of future incidents and their impact.

The organization regularly analyzes incidents as a whole. This process examines the type, amount and cost of incidents with the aim of identifying recurrent and significant incidents that need more action.

If recurrent incidents requiring response are identified, based on them:

  • new management tasks are created or current ones expanded
  • security guidelines in this area are refined or extended
  • a case example of the incident is created that is used to train staff to respond to or avoid similar incidents
Connected other frameworks and requirements:
16.1.6: Learning from information security incidents
ISO 27001
PR.IP-7: Protection processes
NIST CSF
PR.IP-8: Protection effectiveness
NIST CSF
DE.DP-5: Detection processes improvment
NIST CSF
RS.AN-2: The impact of the incident
NIST CSF
No items found.