Creating and maintaining a statement of applicability

Organisaation on luotava ja ylläpidettävä tietoturvasuunnitelmaa.

Asiakastietolain 27 §:n mukaisesti palvelunantajan on laadittava tietoturvaan ja tietosuojaan sekä tietojärjestelmien käyttöön liittyvä tietoturvasuunnitelma.

Tämän määräyksen(MÄÄRÄYS 3/2024) mukaista tietoturvasuunnitelmaa ei tule sisällyttää tai yhdistää julkaistaviin tai julkisesti saatavilla oleviin omavalvontasuunnitelmiin. Tietoturvasuunnitelmaa ja siinä viitattuja liitedokumentteja tulee käsitellä ja säilyttää ottaen huomioon tarvittava suojaaminen sivullisilta ja tarvittaessa niihin tulee merkitä salassa pidettävä -tieto

The organization must define the frameworks that are used as the basis of the management system. Requirements frameworks should address:

Internal reporting goals:

• Reports that support decision-making for management
• Reporting accuracy and details not related to financial reports

Requirement fulfillment goals:

• Fulfillment of laws and regulations
• Setting sub-goals so that the security, availability, processing integrity, confidentiality and privacy criteria support adequate reporting, the organization's operation and compliance with the requirements

The organization must operate, maintain, and continuously develop a security management system.

The boundaries and scope, contents, role, cumulative implementation information and other necessary descriptive information related to the management system must be clearly documented.

The organization has established a procedure for conducting internal audits. The procedure shall describe at least:

• how often audits are carried out
• who may carry out the audits (including audit criteria)
• how the actual audit is carried out
• how audit results are documented and to whom the results are reported
• results should be reported to a competent authority if it's law regulated

Compliance with required laws, regulations, standards, and contractual obligations can be as challenging as dealing with an ever-changing threat environment and new forms of cyber-attacks.

The organization shall document the information security requirements and the organisation's operating model for meeting them.

It is important to note that a large part of the requirements (e.g. laws, standards) are evolving entities. It is recommended to define a review interval for the documentation to describe the frequency at which changes in the requirements should at least be checked.

The Statement of Applicability (SoA) is a key document that defines how an organization implements much of its cyber security.

The statement describes which of the controls recommended by ISO 27001 are implemented in the organization, how they are implemented, and the current state of the controls. In addition, possible reasons for not using certain controls are described.

The organization conducts internal audits in accordance with its internal audit procedure. The aim is to check:

• whether the information security management system complies with the organisation's cyber security requirements
• whether the information security management system complies with other operational security requirements or standards complied with
• whether the information security management system is implemented effectively

Documented information on the execution and results of audits must be kept.

Organization's top management sets security objectives. Security objectives meet the following requirements:

• they shall take into account applicable data security and data protection requirements and the results of risk assessment and treatment
• they are clearly communicated to key security and data protection personnel, staff and other relevant stakeholders
• they are updated as necessary (e.g. when the risk landscape changes or periodically when the objectives are met)
• they are documented and (if possible) measurable

In connection with the documentation of security objectives, the necessary top-level improvements and tasks, needed resources, responsible persons, due dates and methods for evaluating the results in order to achieve the objectives are also defined.

The organization has an information security policy developed and approved by top management. The policy shall include at least the following:

• the basis for setting the organization’s security objectives
• commitment to meeting information security requirements
• commitment to continuous improvement of the information security management system

In addition, the task owner shall ensure that:

• the is appropriate for the organization's business idea
• the policy is communicated to the entire organization
• the policy is available to stakeholders as appropriate

The organization must establish and maintain a cyber security program. The program must have the support of the top management.

The program must be established:

• According to the cyber security program strategy
• The support of the top management is active and supports the development and maintenance of the program
  • p> li>
  • The program is responsible for a role that has the authority to fulfill it

The organization must create and maintain a strategy for the cyber security program. The cyber security program defines the goals for the organization's cyber security measures.

The organization must have a strategy for developing and maintaining a cyber security architecture.

The strategy must match the organization's cyber security program and the organization's architecture.

The architecture must include:

• Security measures for computer networks
• Protection of information assets
• Application security
• Implementation of data protection and privacy

The organization must:

• identify the connections between technology and the running of business operations
• Build the necessary infrastructure to maintain the necessary technology so that their availability and operational reliability can be guaranteed

The organization must define what technology is needed in order to achieve the information security objectives? And, what technology must be acquired / developed in order to achieve the information security goals?

When setting the organization's information security objectives, external objectives must be taken into account. This means, for example:

• Externally set requirement frameworks, such as laws and regulations or requirements set by other external stakeholders
• The reporting takes into account a sufficient amount of detail in the reports to demonstrate the fulfillment of the external requirements

The organization must define its operations and, in particular, the units relevant to the implementation of information security.

The owners defined for the units can be assigned responsibilities for the unit-specific implementation of various tasks.

The organization's information systems collect data from internal and external sources and process essential data into information. Information supports internal control components

Information must be:

• Up-to-date
• Accurate
• Complete
• Secured
• Secured

A board separate from the management supervises the development and implementation of internal information security measures.

The board's duties include in particular:

• Responsibility for the more detailed implementation and monitoring of operations
• Using experts in the field of information security and evaluates the need for additional expertise in the board
• Works independently and is objective in assessments and decision-making
• Adds expertise when necessary, for example with consultants

The organization has formed a plan in case of a smear or influence campaign against it.

The organization has dedicated sufficient resources and expertise to the development of digital security as part of the implementation of the organization's strategy.

In addition, a responsible person has been named for digital security, and this theme receives enough attention in the responsible person's job description and time management.

The organization has an operating model for regular communication to the entire organization about the risk situation in information security and about new significant risks affecting the organization.

Information can be implemented, for example, as a collaboration between the information security core team and communication professionals.

The organization has clearly defined a budget dedicated to the maintenance and development of digital security. The budget is sufficient to achieve the goals set for digital security.

When budgeting for digital security, three key areas must be considered in particular - personnel costs, technology solutions and operational costs.

Theme-specific policy documents can help the communication and viewing of tasks, instructions and other documentation related to different areas, as well as connecting possible upper-level principles to these contents of the management system, which describe a more detailed implementation.

The organization must define which theme-specific policy documents are maintained and, if necessary, reviewed as a whole at desired intervals. Examples of topics for which you may want to maintain your own policy document include:

• access control
• physical security
• management of assets to be protected
• backup
• encryption practices
• data classification
• technical vulnerability management
• secure development

The organization has identified the national and EU legislation governing ICT preparedness related to its operations and services, as well as other norms related to ICT preparedness.

Legislation and norms determine the minimum level for implementing ICT preparedness. In addition to this, the organization must take into account the needs arising from the special features of its own operations. Understanding the internal and external dependencies of operations is a basic requirement for cost-effective management of preparedness.

Valtionhallinnon viranomaisen on pidettävä luetteloa henkilöistä, joilla on oikeus käsitellä turvallisuusluokan I, II tai III asiakirjoja. Luettelossa on mainittava henkilön tehtävä, johon turvallisuusluokitellun tiedon käsittelytarve perustuu.

Tietoturvallisuuteen liittyvä dokumentaatio on ajantasaista.

• Organisaatiolla on prosessi, jonka avulla seurataan dokumentaation kattavuutta ja ajantasaisuutta
• Dokumentaation puutteisiin reagoidaan

Organisaation tietoturvallisuusvaatimukset muodostuvat esimerkiksi lainsäädännössä ja sopimuksissa määritellyistä vähimmäisvaatimuksista sekä muista tunnistetuista tai itse tavoitelluiksi valituista vaatimuksista.

Organisaation on seurattava tietoturvallisuusvaatimusten muutoksia ja tehtävä tarvittavat toimenpiteet niihin reagoimiseksi.

Organisation should identify and document dependencies between its assets.

In Cyberday dependencies between asset elements are created when creating and linking documentation. Procedure can be expanded according to organisation's own needs.

Tietojärjestelmän tai muun useita tietoaineistoja sisältävän kohteen luokitus määräytyy ensi sijassa korkeimman luokituksen aineiston mukaan. Tietojärjestelmien luokitusta arvioitaessa tulee huomioida myös kasautumisvaikutus riskilähtöisesti.

Suuresta määrästä tietyn luottamuksellisuuden tason tietoa koostuvissa tietojärjestelmissä asiakokonaisuus voi nousta luokitukseltaan yksittäistä tietoa korkeammalle tasolle. Määrä ei ole kuitenkaan ainoa tekijä, vaan joskus esimerkiksi kahden eri tietolähteen yhdistäminen voi johtaa tietovarannon luokituksen nousemiseen.

Tyypillisesti kasautumisessa on kysymys IV-luokan tiedosta (esimerkiksi suuri määrä turvallisuusluokan IV tietoa voi muodostaa yhdistettynä turvallisuusluokan III tietovarannon), mutta kasautumisvaikutus tulee huomioida myös turvallisuusluokittelemattoman salassa pidettävän tiedon suojaamisessa.

The organization has set priorities for its operations and goals. Based on these priorities, you need to be able to define security roles, responsibilities, and goals.

Organisation should have processes for ensuring that conflicting responsibilities are segregated to reduce opportunities for misuse of the organization’s assets.

Care should be taken e.g. in relation to a single person being able to process data without detection. Often also separating the initiation of an event from its authorization is a good practice.

When direct segregation of duties is hard to achieve, the following principles can be utilized:

• High-level segregation of information security responsibilities
• Supporting segregation with good monitoring, audit trails and management supervision

Organization has defined what constitutes important security-related documentation and guidelines (e.g. report documents or all task / guideline content), which should be securely archived after they are replaced or become otherwise outdated.

This information should be saved for possible reviews of old policies or guidelines, which may be relevant e.g. in the case of a customer dispute or investigation by data protection authority.

When no specific legal or contractual requirement states the retention period, information should be saved for at least five years.

The organization shall continuously strive to improve the performance of the information security management system. Ways to improve are being actively sought - not just through audits or clear non-conformities.

Task owner is responsible for documenting the improvements made to the management system and dividing them into tasks to be performed, monitoring task execution and assessing the reached effects.

The organization shall determine which issues related to the information security management system need to be communicated on a regular basis. The plan must include the answers, e.g. to the following points:

• What issues are communicated? These can be e.g. new or changed security objectives
• How and when to communicate?What channels are used and how often?
• To whom is communicated? How often for security executives, how often for the entire organization or partners.
• Who takes part? Who has the right to message and from whom, for example, messages should be approved.

Task owner will take care of the implementation of the plan and regular evaluation of its effectiveness.

Top management shall review the organization's information security management system at planned intervals to ensure that it remains appropriate, relevant and effective.

The management review shall address and comment on at least the following:

• Status of improvements (or other actions) initiated as a result of previous management reviews
• Future changes relevant to the security management system
• Performance of the ISMS (problem areas, metering, audit results and fulfillment of management security objectives)
• Stakeholder feedback on data security
• Operation of the risk assessment and treatment process

Documented information on the execution and results of reviews must be maintained.

The organisation regularly evaluates the level of cyber security and the effectiveness of the information security management system.

Organisation has defined:

• monitored metrics to provide comparable results on the development of cyber security level
• persons responsible for the metering
• methods, timetable and responsible persons for metrics reviewing and evaluation
• methods to document metric-related evaluations and results

Effective metrics should be usable for identifying weaknesses, targeting resources better and assessing organisation's success / failure related to cyber security.

Personnel under the direction of the entire organization must be aware:

• how they can contribute to the effectiveness of the information security management system and the benefits of improving the level of information security
• the consequences of non-compliance with the requirements of the information security management systemwhich roles in the personnel have effects to the level of security

In addition, top management has defined ways in which personnel are kept aware of security guidelines related to their own job role.

Management shall define responsibilities and establish procedures to ensure an effective and consistent response to security incidents.

Management must ensure e.g.:

• interference management has clear responsibilities
• there is a documented process for responding, handling and reporting incidents

The process must ensure e.g.:

• staff have a clear contact point / tool and instructions for reporting incidents
• the reported security breaches will be addressed by qualified personnel in a sufficiently comprehensive manner

The organization's top management must demonstrate a commitment to cyber security work and the management system. Management commits to:

• defining the frameworks or other requirements that form the basis for work (e.g. customer promises, regulations or certificates)
• determining the resources needed to manage security
• communicating the importance of cyber security
• ensuring that the work achieves the desired results
• promoting the continuous improvement of cyber security

Top management also decides the scope of the information security management system and records the decision in the description of the system. This means, for example, whether some parts of the organisation's activities or information are excluded from the scope of the management system, or whether it applies to all information / activities of the organization.

The organization shall have a sufficient number of trained, supervised and, where necessary, properly security cleared personnel who play key roles in information security, performing management tasks related to the information security management system.

The organization has defined:

• what qualifications this staff should have
• how qualifications are acquired and ensured (e.g. through appropriate training and training monitoring)
• how qualifications can be demonstrated through documentation

The owner of the task regularly reviews the number and level of competence of the security personnel.

Top management must ensure clear responsibilities / authority on at least the following themes:

• who is primarily responsible for ensuring that the information security management system complies with the information security requirements
• who act as ISMS theme owners responsible for the main themes of the information security management system
• who has the responsibility and authority to report to top management on the performance of the information security management system
• who is authorized to carry out internal audits

The ISMS theme owners are presented on the desktop of the management system and in the Information security policy report.

In addition, top management shall ensure that all roles relevant to information security, as well as related responsibilities and authorities, are defined and communicated. It is also important to recognize the roles and responsibilities of external partners and providers.

Top management of the organization is responsible for:

• the organization having security principles approved by top management, which describe the connection of the organization's information security measures to the organization's operations
• the security principles being comprehensive and appropriate in terms of protecting classified information
• these security principles guiding information security measures
• the organization having organized sufficient monitoring of compliance with obligations and instructions related to information management of security-classified information.

Organisation should have a process to analyse and learn from the operational resilience testing results, from actual cyber security incidents and from experiences of activating continuity plans. Relevant information and experiences should be exchanged with counterparts.

The lessons learned should be incorporated in to the cyber risk management process.

The organisation's top management should have a yearly report about the lessons from senior ICT staff along with recommendations for improvements.

The organisation must monitor the effectiveness of their digital operational resilience strategy. This should include at least:

• Mapping of ICT risk evaluation over time
• Analyse frequency, type, scale and evolution of incidents
• Special focus should be in patterns of cyber attacks

This should increase the awareness of exposure to cyber attack related risk especially with important and critical functions and preparedness against cyber attacks.

Organisation should define and document an information security structure within the organisation. This should include the consideration of other relevant security roles.

The organization must determine what work fields and specific jobs are considered sensitive (e.g. based on data handled and access the employee has).

Sensitive work fields depend on the nature of organizations operations, but can include e.g. information security, IT and system administration, finance, HR, legal, R&D, customer support, analytics, management and many others.

The organization develops and implements a crisis response strategy to protect the organization from the negative consequences and reputational damage of a crisis. This strategy should include predefined actions to manage public view, control the narrative, and mitigate the impact of the crisis on the organization.

Identify and document the organisation's strategy and priorities, which may have an impact on information system security.

It is important to note that this documentation should be reviewed when the organization's strategy and priorities change.

Organization defines the strategic approaches for responding to risks based on the risk types, and the organizational risk tolerance and exposure. These strategies can include for example:

• Define criteria for accepting or avoiding cybersecurity risks for different data classifications
• Determine the need for cybersecurity insurance based on the organizational risk tolerance and exposure
• Document conditions under which shared responsibility models (e.g., outsourcing cybersecurity, third-party transactions, or public cloud services) are acceptable for the organization

Dependencies on external services might affect the organization's risk management and critical capabilities. The organization needs to identify and maintain a list of the organization’s external dependencies, including facilities, cloud providers, and any third-party services.

The documentation should also include:

• The relationships between the dependencies and key organizational assets and business functions
• The dependencies that pose potential failure points for critical services

Ensure that relevant personnel are informed about these dependencies and their associated risks.

Conformity of the organization is ensured by passing a mandatory regular conformity assessment. To carry out this assessment, the organization can choose from three options:

• A CyberFundamentals (CyFun®) certification (level essential) or verification (level important or basic) with the relevant scope of application, granted by a conformity assessment body (CAB) approved by the CCB after accreditation from BELAC
• An ISO/IEC 27001 certification with the relevant scope of application, issued by a CAB accredited by an accreditation body that has signed the mutual recognition agreement (MLA) governing the ISO 27001 standard within the framework of the European co-operation for Accreditation (EA) or the International Accreditation Forum (IAF)
• An inspection by the CCB inspection service (or by a sectoral inspection service).

The conformity assessment statement that the organization receives after the conformity assessment of their chosen framework, allows them to benefit from a presumption of conformity. Until proven otherwise, they are presumed to have respected their obligations.

The entity's cyber security management is ensured and is the responsibility of the entity's manager. The head of each entity determines the responsible person who implements and supervises the implementation of cyber security measures in the relevant entity. The Cabinet of Ministers determines the requirements for the cyber security manager.

The cyber security manager has the following duties:

• Organize security measures for the institution's information and communication technology infrastructure.
• Not less than once a year to conduct a security check of information and communication technologies and, according to its results, to organize the elimination of the detected deficiencies.
• At least once a year attend a cyber security training organized by the cyber incident prevention institution.
• Not less than once a year, to ensure that the employees of the institution are briefed on the subject's current cyber risks and cyber security.

The organization shall notify a competent authority immediately, but no later than within five working days, of the appointment of a cyber security manager. The notice shall state the name, surname, personal identification number, position, e-mail address and telephone number of the cyber security manager. The organization shall report any changes to a competent immediately, but no later than within five working days.

The national cyber security authorities maintain a Cyber Security Information System for managing data related to cyber security entities, incidents, and risk management measures. The organization based on the requirements specified in the Cyber Security Information System regulations must register to this system and has a right to become a user of the data it provides.

The key requirements include:

• Register as a user of the system and implement mutual information sharing agreements, also maintaining up-to-date information
• Notify the National Cyber Security Center of the mutual agreements or terminations within 20 working days
• Report cyber incidents, near-miss events, and threats to the Cyber Security Information System
• Ensure compliance with national cyber security laws and avoid operational risks

Benefits of the Cyber Security Information system usage for the organization:

• Access and use the Cyber Security Information System data related to the organization’s managed network and systems
• Collaborate with the National Cyber Security Center and institutions during extreme cyber incidents
• Gain real-time insights to improve incident management and preparedness
• Strengthen organizational risk management through tools, services and information the system provides

Governmental and municipal organizations or other institutions handling state information or meeting the criteria must use the Ministry of National Defense overseen Secure State Data Transmission Network for electronic communications and connect to public networks only through it except for government-defined exceptions.

Conditions for the usage of the Secure Network:

• Only organizations included in the government-approved list of users are allowed to use the secure network.
• Institutions must follow government-set plans and timelines for connecting to or disconnecting from the Secure Network
• Includes data transmission, public network access, collective cyber security, and interaction with EU/NATO resources, provided free of charge, funded by the state
• Offered at user-specific levels for a fee covering actual costs, verified annually by auditors

State and municipal organization or other institutions listed in the Secure Network list must store state information resources in state data centers or data centers within Lithuania, EU, EEA, or NATO member states. Storage costs of the state information resources are funded from the institutions' allocated state budget funds.

The National Cyber Security Center installs and manages technical cyber security measures for entities to monitor and address cyber threats and incidents. Important entities can request and essential entities must facilitate the implementation and management of these measures for their systems. The Ministry of National Defense defines the procedures and approves the installation plan, specifying the measures and any data processed. The installation, maintenance, and repair costs of these cyber security measures are covered by The National Cyber Security Center.

The organization performs cyber security audits according to the procedures of the National Cyber ​​Security Center.

• Cyber security audits must be conducted at least once every three years
• Audits must follow the methodology approved by the National Cyber Security Center
• The auditor must be certified, trained and qualified as per National Cyber Security Center procedures
• The auditor must meet the National Cyber Security Center's standards for independence, impartiality, and reputation. Auditors cannot assess networks or systems managed by their employer

The organization appoints a chief information security officer (CISO) that meets the defined requirements and is responsible for the implementation of the organization's risk management measures.

• Ensure the individual is directly accountable to the head of the entity
• Verify the candidate meets qualification standards: impeccable reputation, no recent penalties, and relevant experience or certification
• Define their responsibilities for the cyber security risk management measures and compliance
• Optionally this role can be combined with that of a Cyber Security Officer or outsourced

The organization appoints a Cyber Security Officer who is responsible for the compliance of specific networks and systems.

• Ensure the candidate meets the same qualification standards as the Chief Information Security Officer
• Allow for the Cyber Security Officer to oversee multiple systems if needed
• Optionally outsource this role to a service provider or appoint the CISO to take care of the duties

The organization must consider the possibility of fraud related to information security when assessing risks.

It is at least worth noting:

• Different types of fraud and their possible consequences (incorrect reporting, loss of information assets and corruption)
• Effect of various incentives and pressures to commit fraud
• Evaluation of attitudes and justifications, how a manager or other employee could justify their fraudulent activity
• Evaluation of the possibilities of fraud in the use of information systems

An organization must classify its information assets, such as information systems, data, units, key personnel, and other assets to be protected (e.g., equipment), according to priorities. Prioritization can be done, for example, based on the requirements for confidentiality, integrity, and availability of the information being processed.

Task owner regularly evaluates the implementation of internal audits, especially from the following perspectives:

• whether the auditors have been selected in such a way that the objectivity and impartiality of the audit process are realized
• whether the audits were performed in such a way that the objectivity and impartiality of the audit process were realized

If necessary, task owner makes changes to the internal audit procedure.

The idea behind the certification mechanisms is to demonstrate that data processing follows good data processing practices and good practices in general. Example of a security certificate is for example: ISO27001.

Organisation should have a procedure to classify projects from the point-of-view of required information security level and other information security requirements for the project.

The criteria for the classification of projects should be documented.

Non-compliance with legal, regulatory, or contractual provisions can create risks to the information security of the organization.

To facilitate this, the integrity of records in accordance with the legal, regulatory, or contractual provisions and business requirements is considered.