Monitoring compliance with security guidelines

Personnel must have security guidelines that deal with e.g. the following topics:

• Using and updating mobile devices
• Storing and backing up data
• Privacy
• Using email
• Handling of printouts, papers and files
• Reporting incidents
• Scam prevention

Tietoa käsitteleville henkilöille selvitetään tietojen suojaamista ja asiakirjojen käsittelyä koskevat tietoturvaohjeet ja -periaatteet ennen pääsyä tietoihin tai organisaation tarkasti määrittelemien aikamääreiden sisällä.

Following security guidelines can be monitored either technically or directly by asking / testing employees.

The security guidelines are specified in connection with the employee's job role. The organization has identified units and roles that require separate guidance and develops its own detailed security guidelines for these.

Examples of units that may require their own guidelines are e.g. customer service, IT and HR. Examples of work roles that require their own instructions are the system administrators and the remote workers.

The management of the organization must ensure that the organization has up-to-date instructions on data processing, the use of information systems, data processing rights, the implementation of data management responsibilities, the implementation of access to information rights and information security measures.

In practice, the management defines how the up-to-dateness of the instructions is ensured and to which actors the instructions apply. taking care of up-to-dateness is part of it.

It is recommended to assign the responsibility for keeping the instructions up-to-date to those actors who have overall responsibility for information security, information systems, data reserves, record keeping, decision-making related to document requests, case management and archive work.

The organization should remind the employees that it is their responsibility to keep password and secrets safe. They should never share them with anyone, including colleagues and superiors.

They should also always lock they devices when leaving them.

Personnel must have guidelines that deal with the following topics:

• Approved devices and software the employees need for work
• Devices and software that are not required for work but still permitted
• Devices and software that are unwanted

Guidelines must be communicated to staff when a new guideline is introduced or existing guidelines are modified.

If staff have conflicting goals with the security guidelines, they are unlikely to follow the guidelines.

The organization actively seeks to find poorly functioning guidelines and modify either the guidelines, tools or staff priorities to enable following the guidelines.