Content library
General Data Protection Regulation
24. Responsibility of the controller

Requirement description

How to fill the requirement

General Data Protection Regulation

24. Responsibility of the controller

Task name
Priority
Status
Theme
Policy
Other requirements
Data system listing and owner assignment
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
System management
Data system management
53
requirements

Examples of other requirements this task affects

I06: Pääsyoikeuksien hallinnointi
Katakri
13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
TiHL
24. Responsibility of the controller
GDPR
5. Principles relating to processing of personal data
GDPR
32. Security of processing
GDPR
See all related requirements and other information from tasks own page.
Go to >
Data system listing and owner assignment
1. Task description

Organisation must maintain a listing of used data systems and their owners. Owner is responsible for completing the related documentation and possible other security actions directly related to the data system.

Data system documentation must include at least:

  • System purpose and linked responsibilities
  • System's data location (covered in a separate task)
  • System's maintenance and development responsibilities and linked partners (covered in a separate task)
  • When necessary system's access roles and authentication methods (covered in a separate task)
  • When necessary systems interfaces to other systems (covered in a separate task)
Regular reviewing of data system access rights
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
System management
Access control and authentication
31
requirements

Examples of other requirements this task affects

5. Principles relating to processing of personal data
GDPR
24. Responsibility of the controller
GDPR
32. Security of processing
GDPR
9.2.5: Review of user access rights
ISO 27001
16 §: Tietojärjestelmien käyttöoikeuksien hallinta
TiHL
See all related requirements and other information from tasks own page.
Go to >
Regular reviewing of data system access rights
1. Task description

Data system owner determines the access roles to the system in relation to the tasks of users. The compliance of the actual access rights with the planned ones must be monitored and the rights reassessed at regular intervals.

When reviewing access rights, care must also be taken to minimize admin rights and eliminate unnecessary accounts.

Identification and documentation of cyber security risks
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Risk management
42
requirements

Examples of other requirements this task affects

T04: Turvallisuusriskien hallinta
Katakri
13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
TiHL
24. Responsibility of the controller
GDPR
5. Principles relating to processing of personal data
GDPR
8.3: Information security risk treatment
ISO 27001
See all related requirements and other information from tasks own page.
Go to >
Identification and documentation of cyber security risks
1. Task description

The organization proactively seeks to list and assess the likelihood and severity of various cyber security risks. The documentation shall include the following:

  • Description of the risk
  • Evaluated impact and likelihood of the risk
  • Tasks for managing the risk or other treatment options
  • Acceptability of the risk
Personnel guidelines for reporting security incidents
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Incident management
Incident management and response
40
requirements

Examples of other requirements this task affects

T06: Turvallisuuspoikkeamien hallinta
Katakri
24. Responsibility of the controller
GDPR
16.1.3: Reporting information security weaknesses
ISO 27001
16.1.2: Reporting information security events
ISO 27001
6.4: Menettelytavat virhe- ja ongelmatilanteissa
Omavalvontasuunnitelma
See all related requirements and other information from tasks own page.
Go to >
Personnel guidelines for reporting security incidents
1. Task description

A process for reporting incidents is maintained to help staff report incidents efficiently and consistently.

Things to report as an incident include e.g.:

  • unauthorized access to data / premises
  • action against security guidelines
  • suspected security issue (e.g. phishing, malware infection)
  • data system outage
  • accidental or intentional destruction / alteration of data
  • lost or stolen device
  • compromised password
  • lost physical identifier (e.g. keychain, smart card, smart sticker)
  • suspected security weakness (e.g. on utilized data system or other procedures)

The personnel guidelines emphasize the obligation to report security incidents as soon as possible in accordance with the agreed process. The instructions also describe other operations in the event of an incident (e.g. recording seen error messages and other details).

Defining security roles and responsibilities
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Cyber security management
33
requirements

Examples of other requirements this task affects

24. Responsibility of the controller
GDPR
6.1.1: Information security roles and responsibilities
ISO 27001
T02: Turvallisuustyön tehtävien ja vastuiden määrittäminen
Katakri
ID.AM-6: Cybersecurity roles and responsibilities
NIST
ID.GV-2: Cybersecurity role coordination
NIST
See all related requirements and other information from tasks own page.
Go to >
Defining security roles and responsibilities
1. Task description

Top management must ensure clear responsibilities / authority on at least the following themes:

  • who is primarily responsible for ensuring that the information security management system complies with the information security requirements
  • who act as ISMS theme owners responsible for the main themes of the information security management system
  • who has the responsibility and authority to report to top management on the performance of the information security management system
  • who is authorized to carry out internal audits

The ISMS theme owners are presented on the desktop of the management system and in the Information security policy report.

In addition, top management shall ensure that all roles relevant to information security, as well as related responsibilities and authorities, are defined and communicated. It is also important to recognize the roles and responsibilities of external partners and providers.

Process for initiating data breach treatment
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Incident management
Data breach management
9
requirements

Examples of other requirements this task affects

24. Responsibility of the controller
GDPR
32. Security of processing
GDPR
16.1.5: Response to information security incidents
ISO 27001
16.1.7: Collection of evidence
ISO 27001
5.26: Response to information security incidents
ISO 27001
See all related requirements and other information from tasks own page.
Go to >
Process for initiating data breach treatment
1. Task description

Our organization has pre-defined procedures through which the detected security breach will be addressed. The process may include e.g. the following things:

  • who are part of a team that is ready to respond to breaches
  • how and along what channel the entire team is immediately notified of the breach
  • the team determines the severity (low, medium, high) of the breach based on predefined criteria
  • the breach management is continued with a larger group according to the severity level
Documentation of linked risks for identified security incidents
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Risk management
14
requirements

Examples of other requirements this task affects

T05: Jatkuvuuden hallinta
Katakri
24. Responsibility of the controller
GDPR
5. Principles relating to processing of personal data
GDPR
8.3: Information security risk treatment
ISO 27001
21.2.a: Risk management and information system security
NIS2
See all related requirements and other information from tasks own page.
Go to >
Documentation of linked risks for identified security incidents
1. Task description

Organization assesses cyber security risks by responding to situations where security has been mildly or severely compromised. The documentation shall include at least the following:

  • Description of the incident
  • Risks associated with the incident
  • New tasks introduced as a result of the incident
  • Other measures taken due to the incident
Management commitment to cyber security management and management system
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Cyber security management
28
requirements

Examples of other requirements this task affects

24. Responsibility of the controller
GDPR
5.1.1: Policies for information security
ISO 27001
7.2.1: Management responsibilities
ISO 27001
7.2.2: Information security awareness, education and training
ISO 27001
ID.GV-1: Cybersecurity policy
NIST
See all related requirements and other information from tasks own page.
Go to >
Management commitment to cyber security management and management system
1. Task description

The organization's top management must demonstrate a commitment to cyber security work and the management system. Management commits to:

  • defining the frameworks or other requirements that form the basis for work (e.g. customer promises, regulations or certificates)
  • determining the resources needed to manage security
  • communicating the importance of cyber security
  • ensuring that the work achieves the desired results
  • promoting the continuous improvement of cyber security

Top management also decides the scope of the information security management system and records the decision in the description of the system. This means, for example, whether some parts of the organisation's activities or information are excluded from the scope of the management system, or whether it applies to all information / activities of the organization.

Incident management resourcing and monitoring
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Cyber security management
12
requirements

Examples of other requirements this task affects

24. Responsibility of the controller
GDPR
7.2.1: Management responsibilities
ISO 27001
16.1.1: Responsibilities and procedures
ISO 27001
5.24: Information security incident management planning and preparation
ISO 27001
Article 17: ICT-related incident management process
DORA
See all related requirements and other information from tasks own page.
Go to >
Incident management resourcing and monitoring
1. Task description

Management shall define responsibilities and establish procedures to ensure an effective and consistent response to security incidents.

Management must ensure e.g.:

  • interference management has clear responsibilities
  • there is a documented process for responding, handling and reporting incidents

The process must ensure e.g.:

  • staff have a clear contact point / tool and instructions for reporting incidents
  • the reported security breaches will be addressed by qualified personnel in a sufficiently comprehensive manner

Tasks included in the policy

Task name
Priority
Status
Theme
Policy
Other requirements
No items found.

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way
Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.
Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.
Do it once - we automatically apply it to all current and future frameworks.
Get to know Cyberday
Start your free trial
Cyberday is your all-in-one solution for building a secure and compliant organization. Whether you're setting up a cyber security plan, evaluating policies, implementing tasks, or generating automated reports, Cyberday simplifies the entire process.
With AI-driven insights and a user-friendly interface, it's easier than ever to stay ahead of compliance requirements and focus on continuous improvement.
Clear framework compliance plans
Activate relevant frameworks and turn them into actionable policies tailored to your needs.
Credible reports to proof your compliance
Use guided tasks to ensure secure implementations and create professional reports with just a few clicks.
AI-powered improvement suggestions
Focus on the most impactful improvements in your compliance with help from Cyberday AI.