Content library
TiHL: Suositus tietoturvan vähimmäisvaatimuksista
2.1: Tietoturvallisuusvastuiden määrittely

How to fill the requirement

TiHL: Suositus tietoturvan vähimmäisvaatimuksista

2.1: Tietoturvallisuusvastuiden määrittely

Task name
Priority
Status
Theme
Policy
Other requirements
ISMS description and maintenance
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Cyber security management
requirements

Task is fulfilling also these other security requirements

6.3: Planning of changes
ISO27k1 Full
8.1: Operational planning and control
ISO27k1 Full
4.1: Organization and its context
ISO27k1 Full
5.1.1: Policies for information security
ISO27 Full
PR.AT-5: Physical and cybersecurity personnel
NIST
1. Task description

The organization must operate, maintain, and continuously develop a security management system.

The boundaries and scope, contents, role, cumulative implementation information and other necessary descriptive information related to the management system must be clearly documented.

Ajantasaisen ohjeistuksen varmistaminen
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Information management
Organizing information management
requirements

Task is fulfilling also these other security requirements

4 §: Tiedonhallinnan järjestäminen tiedonhallintayksikössä
TiHL
2.1: Tietoturvallisuusvastuiden määrittely
TiHL: Tietoturva
2.6: Ohjeet ja koulutus
TiHL: Tietoturva
1. Task description

Management must ensure that the organization has up-to-date guidance on information management and cyber security topics.

Tiedonhallinnan vastuiden määrittäminen
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Information management
Organizing information management
requirements

Task is fulfilling also these other security requirements

4 §: Tiedonhallinnan järjestäminen tiedonhallintayksikössä
TiHL
1: Tehtävät ja vastuut
Sec overview
2.1: Tietoturvallisuusvastuiden määrittely
TiHL: Tietoturva
1. Task description

Johdon on huolehdittava siitä, että organisaatiossa on määritelty tiedonhallintalaissa (sekä muissa laeissa) säädettyjen tiedonhallinnan toteuttamiseen liittyvien tehtävien vastuut.

Vastuut voidaan määrittää Digiturvamallissa vastuuttamalla eri tiedonhallinnan osa-alueisiin (esim. tietoturvaohjeet, tietojärjestelmät, rekisterinpito, asiahallinta) liittyvät tehtävät sekä dokumentaatiokohteet.

Defining security roles and responsibilities
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Cyber security management
requirements

Task is fulfilling also these other security requirements

T02: Turvallisuustyön tehtävien ja vastuiden määrittäminen
Katakri
24. Responsibility of the controller
GDPR
6.1.1: Information security roles and responsibilities
ISO27 Full
ID.AM-6: Cybersecurity roles and responsibilities
NIST
ID.GV-2: Cybersecurity role coordination
NIST
1. Task description

Top management must ensure clear responsibilities / authority on at least the following themes:

  • who is primarily responsible for ensuring that the information security management system complies with the information security requirements
  • who act as ISMS theme owners responsible for the main themes of the information security management system
  • who has the responsibility and authority to report to top management on the performance of the information security management system
  • who is authorized to carry out internal audits

The ISMS theme owners are presented on the desktop of the management system and in the Information security policy report.

In addition, top management shall ensure that all roles relevant to information security, as well as related responsibilities and authorities, are defined and communicated. It is also important to recognize the roles and responsibilities of external partners and providers.

Continuous development of guidelines
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Security guidelines
requirements

Task is fulfilling also these other security requirements

T11: Turvallisuuskoulutus ja -tietoisuus
Katakri
12.1.1: Documented operating procedures
ISO27 Full
HAL-12: Ohjeet
Julkri
5.37: Documented operating procedures
ISO27k1 Full
6.3: Information security awareness, education and training
ISO27k1 Full
1. Task description

If staff have conflicting goals with the security guidelines, they are unlikely to follow the guidelines.

The organization actively seeks to find poorly functioning guidelines and modify either the guidelines, tools or staff priorities to enable following the guidelines.

No items found.