1.1 (MIL2): Manage IT and OT Asset Inventory
C2M2
1.1 (MIL3): Manage IT and OT Asset Inventory
C2M2
1.1.1: Availability of information security policies
TISAX
1.1.1: Identify the organisation’s strategy and priorities
NSM ICT-SP
1.1.2: Identify the organisation’s structures and processes for security management
NSM ICT-SP
1.1.3: Identify the organisation’s processes for ICT risk management
NSM ICT-SP
1.1.4: Identify the organisation’s tolerances for ICT risk
NSM ICT-SP
1.1.5: Identify the organisation’s deliverables, information systems and supporting ICT functions
NSM ICT-SP
1.1.6: Identify information processing and data flow
NSM ICT-SP
1.2 (MIL2): Manage Information Asset Inventory
C2M2
1.2 (MIL3): Manage Information Asset Inventory
C2M2
1.2.1: Establish a process to identify devices and software in use at the organisation
NSM ICT-SP
1.2.1: Scope of Information Security management
TISAX
1.2.2: Establish organisational guidelines for approved devices and software
NSM ICT-SP
1.2.2: Information Security Responsibilities
TISAX
1.2.3: Identify devices in use at the organisation
NSM ICT-SP
1.2.3: Information Security requirements in projects
TISAX
1.2.4: Definition of responsibilities with service providers
TISAX
1.2.4: Identify the software in use at the organisation
NSM ICT-SP
1.2: Manage Information Asset Inventory
C2M2
1.3 (MIL2): Manage IT and OT Asset Configuration
C2M2
1.3 (MIL3): Manage IT and OT Asset Configuration
C2M2
1.3.1: Identification of information assets
TISAX
1.3.1: Identify the users of the information systems
NSM ICT-SP
1.3.2: Classification of information assets
TISAX
1.3.2: Identify and define the different user categories
NSM ICT-SP
1.3.3: Identify roles and responsibilities linked especially to ICT security
NSM ICT-SP
1.3.3: Use of approved external IT services
TISAX
1.3.4: Use of approved software
TISAX
1.3: Manage IT and OT Asset Configuration
C2M2
1.4 (MIL2): Manage Changes to IT and OT Assets
C2M2
1.4 (MIL3): Manage Changes to IT and OT Assets
C2M2
1.4.1: Management of Information Security Risks
TISAX
1.4: Manage Changes to IT and OT Assets
C2M2
1.5 (MIL1): Management Activities for the ASSET domain
C2M2
1.5 (MIL2): Management Activities for the ASSET domain
C2M2
1.5 (MIL3): Management Activities for the ASSET domain
C2M2
1.5.1: Assessment of policies and requirements
TISAX
1.5.2: External review of ISMS
TISAX
1.5: Management Activities for the ASSET domain
C2M2
1.6.1: Reporting of security events
TISAX
1.6.2: Management of reported events
TISAX
1.6.3: Crisis preparedness
TISAX
10 §: Johdon vastuu
Kyberturvallisuuslaki
10. Processing of personal data relating to criminal convictions and offences
GDPR
10.1 (MIL2): Establish Cybersecurity Program Strategy
C2M2
10.1 (MIL3): Establish Cybersecurity Program Strategy
C2M2
10.1.1: Policy on the use of cryptographic controls
ISO 27001
10.1.2: Key management
ISO 27001
10.1.2: Key management
ISO 27017
10.1: Cryptographic controls
ISO 27001
10.1: Cryptographic controls
ISO 27017
10.1: Establish Cybersecurity Program Strategy
C2M2
10.1: Non-conformity and corrective action
ISO 27001
10.2 (MIL2): Establish and Maintain Cybersecurity Program
C2M2
10.2 (MIL3): Establish and Maintain Cybersecurity Program
C2M2
10.2: Establish and Maintain Cybersecurity Program
C2M2
10.2: Continuous improvement
ISO 27001
10.3 (MIL1): Management Activities for the PROGRAM domain
C2M2
10.3 (MIL2): Management Activities for the PROGRAM domain
C2M2
10.3 (MIL3): Management Activities for the PROGRAM domain
C2M2
10.3: Management Activities for the PROGRAM domain
C2M2
10: Cryptography
ISO 27001
10: Cryptography
ISO 27017
10: Cybersecurity Program Management (PROGRAM)
C2M2
10: Prosessi väärinkäytöksiin reagoimiseksi
Digiturvan kokonaiskuvapalvelu
11 §: Poikkeamailmoitukset viranomaiselle
Kyberturvallisuuslaki
11. Processing which does not require identification
GDPR
11.1.1: Physical security perimeter
ISO 27001
11.1.2: Physical entry controls
ISO 27001
11.1.3: Securing offices, rooms and facilities
ISO 27001
11.1.4: Protecting against external and environmental threats
ISO 27001
11.1.5: Working in secure areas
ISO 27001
11.1.6: Delivery and loading areas
ISO 27001
11.1: Secure areas
ISO 27001
11.2.1: Equipment siting and protection
ISO 27001
11.2.2: Supporting utilities
ISO 27001
11.2.3: Cabling security
ISO 27001
11.2.4: Equipment maintenance
ISO 27001
11.2.5: Removal of assets
ISO 27001
11.2.6: Security of equipment and assets off-premises
ISO 27001
11.2.7: Secure disposal or re-use of equipment
ISO 27001
11.2.7: Secure disposal or re-use of equipment
ISO 27017
11.2.8: Unattended user equipment
ISO 27001
11.2.9: Clear desk and clear screen policy
ISO 27001
11: Digiturvan mittarien määrittäminen
Digiturvan kokonaiskuvapalvelu
11: Physical and environmental security
ISO 27001
11: Physical and environmental security
ISO 27017
12 §: Luotettavuutta edellyttävien tehtävien tunnistaminen ja luotettavuudesta varmistuminen
TiHL
12 §: Poikkeamaa koskeva väliraportti
Kyberturvallisuuslaki
12. Transparent information, communication and modalities for the exercise of the rights of the data subject
GDPR
12.1.1: Documented operating procedures
ISO 27001
12.1.2: Change management
ISO 27001
12.1.3: Capacity management
ISO 27001
12.1.4: Separation of development, testing and operational environments
ISO 27001
12.1: Operational procedures and responsibilities
ISO 27001
12.2.1: Controls against malware
ISO 27001
12.2: Protection from malware
ISO 27001
.png)
