Riskienhallinta

Organisation must maintain a listing of used data systems and their owners. Owner is responsible for completing the related documentation and possible other security actions directly related to the data system.

Data system documentation must include at least:

• System purpose and linked responsibilities
• System's data location (covered in a separate task)
• System's maintenance and development responsibilities and linked partners (covered in a separate task)
• When necessary system's access roles and authentication methods (covered in a separate task)
• When necessary systems interfaces to other systems (covered in a separate task)

The organization shall maintain a list of data sets contained in the data stores it manages.

The documentation shall include at least the following information:

• Data systems and other means used to process the data sets
• Key categories of data in the data set (and whether it contains personal data)
• Data retention period (discussed in more detail in a separate task)
• Information on archiving / disposal of data (discussed in more detail in a separate task)

The organization has defined procedures for assessing and treating cyber security risks. The definition includes at least:

• Risk identification methods
• Methods for risk analysis
• Criteria for risk evaluation (impact and likelihood)
• Risk priorisation, treatment options and defining control tasks
• Risk acceptance criteria
• Process implementation cycle, resourcing and responsibilities

The task owner regularly checks that the procedure is clear and produces consistent results.

The organization proactively seeks to list and assess the likelihood and severity of various cyber security risks. The documentation shall include the following:

• Description of the risk
• Evaluated impact and likelihood of the risk
• Tasks for managing the risk or other treatment options
• Acceptability of the risk

Implemented risk management measures and the overall situation of risk management are checked regularly.

The operating model for monitoring the status of risk management is clearly described.

As part of the security risk assessment, the organization shall make assessments of the severity and probability of the risk materializing.

The organization shall have a clearly instructed risk scale that allows each participant in the risk assessment to decide on the appropriate level of severity and probability.

The organisation must enable asset based risk management from the ISMS settings.

Asset-based risk management should be set to cover all needed asset types with high enough criticality. The asset based risk management should be used at least for:

• System providers
• Data systems
• Data stores
• Other stakeholders
• Other assets

After risk treatment, the organization assesses the remaining level of residual risk per risk.

Regarding the residual risk, clear decisions are made by the risk owner to either close the risk or return the risk to the processing queue.