Content library
Julkri: TL IV-I
HAL-12: Ohjeet

How to fill the requirement

Julkri: TL IV-I

HAL-12: Ohjeet

Task name
Priority
Status
Theme
Policy
Other requirements
Staff guidance and training procedure in cyber security
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Cyber security training
requirements

Task is fulfilling also these other security requirements

T11: Turvallisuuskoulutus ja -tietoisuus
Katakri
4 §: Tiedonhallinnan järjestäminen tiedonhallintayksikössä
TiHL
29. Processing under the authority of the controller or processor
GDPR
32. Security of processing
GDPR
7.2.1: Management responsibilities
ISO27 Full
1. Task description

Our organization has defined procedures for maintaining staff's cyber security awareness.These may include e.g. the following things:

  • staff receive instructions describing the general guidelines of digital security related to their job role
  • staff receive training to maintain the appropriate digital and cyber security skills and knowledge required for the job role
  • staff demonstrate through tests that they have the security skills and knowledge required for the job role

Training should focus on the most relevant security aspects for each job role and include often enough the basics, which concern all employees:

  • employee's personal security responsibilities (e.g. for devices and processed data)
  • policies relevant for everyone (e.g. security incident reporting)
  • guidelines relevant for everyone (e.g. clean desk)
  • organization's security roles (who to contact with problems)
Personnel guidelines for avoiding phishing
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Email and phishing
Email and web browser
requirements

Task is fulfilling also these other security requirements

13.2.1: Information transfer policies and procedures
ISO27 Full
13.2.3: Electronic messaging
ISO27 Full
PR.AT-1: Awareness
NIST
HAL-12: Ohjeet
Julkri
5.14: Information transfer
ISO27k1 Full
1. Task description

The organization has developed guidelines for staff that define the acceptable use of various communication services and aim to prevent the disclosure of confidential information to, for example, a phisher or other third parties.

General security guidelines for staff
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Security guidelines
requirements

Task is fulfilling also these other security requirements

T11: Turvallisuuskoulutus ja -tietoisuus
Katakri
4 §: Tiedonhallinnan järjestäminen tiedonhallintayksikössä
TiHL
29. Processing under the authority of the controller or processor
GDPR
9.4.4: Use of privileged utility programs
ISO27 Full
11.2.7: Secure disposal or re-use of equipment
ISO27 Full
1. Task description

Personnel must have security guidelines that deal with e.g. the following topics:

  • Using and updating mobile devices
  • Storing and backing up data
  • Privacy
  • Using email
  • Handling of printouts, papers and files
  • Reporting incidents
  • Scam prevention
Monitoring compliance with security guidelines
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Security guidelines
requirements

Task is fulfilling also these other security requirements

T11: Turvallisuuskoulutus ja -tietoisuus
Katakri
29. Processing under the authority of the controller or processor
GDPR
18.2.2: Compliance with security policies and standards
ISO27 Full
HAL-12: Ohjeet
Julkri
HAL-13: Koulutukset
Julkri
1. Task description

Following security guidelines can be monitored either technically or directly by asking / testing employees.

Continuous development of guidelines
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Security guidelines
requirements

Task is fulfilling also these other security requirements

T11: Turvallisuuskoulutus ja -tietoisuus
Katakri
12.1.1: Documented operating procedures
ISO27 Full
HAL-12: Ohjeet
Julkri
5.37: Documented operating procedures
ISO27k1 Full
6.3: Information security awareness, education and training
ISO27k1 Full
1. Task description

If staff have conflicting goals with the security guidelines, they are unlikely to follow the guidelines.

The organization actively seeks to find poorly functioning guidelines and modify either the guidelines, tools or staff priorities to enable following the guidelines.

No items found.