Organizational cybersecurity policy is established and communicated.

Organization's top management sets security objectives. Security objectives meet the following requirements:

• they shall take into account applicable data security and data protection requirements and the results of risk assessment and treatment
• they are clearly communicated to key security and data protection personnel, staff and other relevant stakeholders
• they are updated as necessary (e.g. when the risk landscape changes or periodically when the objectives are met)
• they are documented and (if possible) measurable

In connection with the documentation of security objectives, the necessary top-level improvements and tasks, needed resources, responsible persons, due dates and methods for evaluating the results in order to achieve the objectives are also defined.

The organization has an information security policy developed and approved by top management. The policy shall include at least the following:

• the basis for setting the organization’s security objectives
• commitment to meeting information security requirements
• commitment to continuous improvement of the information security management system

In addition, the task owner shall ensure that:

• the is appropriate for the organization's business idea
• the policy is communicated to the entire organization
• the policy is available to stakeholders as appropriate

The organization shall continuously strive to improve the performance of the information security management system. Ways to improve are being actively sought - not just through audits or clear non-conformities.

Task owner is responsible for documenting the improvements made to the management system and dividing them into tasks to be performed, monitoring task execution and assessing the reached effects.

The organization shall determine which issues related to the information security management system need to be communicated on a regular basis. The plan must include the answers, e.g. to the following points:

• What issues are communicated? These can be e.g. new or changed security objectives
• How and when to communicate?What channels are used and how often?
• To whom is communicated? How often for security executives, how often for the entire organization or partners.
• Who takes part? Who has the right to message and from whom, for example, messages should be approved.

Task owner will take care of the implementation of the plan and regular evaluation of its effectiveness.

The organization's top management must demonstrate a commitment to cyber security work and the management system. Management commits to:

• defining the frameworks or other requirements that form the basis for work (e.g. customer promises, regulations or certificates)
• determining the resources needed to manage security
• communicating the importance of cyber security
• ensuring that the work achieves the desired results
• promoting the continuous improvement of cyber security

Top management also decides the scope of the information security management system and records the decision in the description of the system. This means, for example, whether some parts of the organisation's activities or information are excluded from the scope of the management system, or whether it applies to all information / activities of the organization.

Top management must ensure clear responsibilities / authority on at least the following themes:

• who is primarily responsible for ensuring that the information security management system complies with the information security requirements
• who act as ISMS theme owners responsible for the main themes of the information security management system
• who has the responsibility and authority to report to top management on the performance of the information security management system
• who is authorized to carry out internal audits

The ISMS theme owners are presented on the desktop of the management system and in the Information security policy report.

In addition, top management shall ensure that all roles relevant to information security, as well as related responsibilities and authorities, are defined and communicated. It is also important to recognize the roles and responsibilities of external partners and providers.