Cilvēkresursi un apmācība

Our organization has defined procedures for maintaining staff's cyber security awareness.These may include e.g. the following things:

• staff receive instructions describing the general guidelines of digital security related to their job role
• staff receive training to maintain the appropriate digital and cyber security skills and knowledge required for the job role
• staff demonstrate through tests that they have the security skills and knowledge required for the job role

Training should focus on the most relevant security aspects for each job role and include often enough the basics, which concern all employees:

• employee's personal security responsibilities (e.g. for devices and processed data)
• policies relevant for everyone (e.g. security incident reporting)
• guidelines relevant for everyone (e.g. clean desk)
• organization's security roles (who to contact with problems)

All employees handling confidential information should sign a confidentiality or non-disclosure agreement before processing confidential information.

The confidentiality commitment should include, among other things:

• a clear definition of confidential information
• the expected duration of the commitment
• required actions when the commitment is terminated
• the responsibilities and actions of signatories to prevent unauthorized disclosure of information
• ownership of information, trade secrets, and intellectual property and how this relates to the protection of confidential information
• permissible use of confidential information and the signatory's rights to use the information
• the right to audit and monitor activities involving confidential information

The requirements and needs for confidentiality agreements are reviewed and updated at regular intervals.

The employment contracts specify the responsibilities of the employee and the organization for cyber security.

Contracts should include e.g.:

• the employee's legal responsibilities and rights, such as those related to copyright or data protection law
• the employee's responsibility for following the instructions, e.g. related to the use of hardware and data and the classification of information
• the employee's or temporary employee's responsibility for processing information received from other companies or other parties
• measures if the employee or temporary worker violates the safety requirements of the organization
• continuing obligations after termination of employment

Our organization has defined procedures for coordinating, at the time of termination of employment, e.g..:

• Hardware recovery
• Removal of access rights
• Restoration of other information assets

Personnel must have security guidelines that deal with e.g. the following topics:

• Using and updating mobile devices
• Storing and backing up data
• Privacy
• Using email
• Handling of printouts, papers and files
• Reporting incidents
• Scam prevention

Our organization has defined the actions to be taken in the event of a breach of confidentiality. These may include e.g. the following steps:

• investigating what data was breached and how harmful this was
• investigating the intentionality of the act
• investigating what was set as conseguence on the confidentiality agreement
• deciding whether and how to proceed (e.g. legal actions)
• deciding whether outside assistance is needed

Applicants applying for cyber security should have their background checked, taking into account relevant laws and regulations.

The check may include:

• review of recommendations
• verification of CV accuracy
• verification of educational qualifications
• verification of identity from an independent source
• other more detailed checks (e.g. credit information, review of previous claims or criminal record)

The background check may also be extended to, for example, teleworkers, contractors or other third parties. The depth of the background check can be related to the category of the accessed data.

A log is kept of the cyber security training events provided by the organization to its staff. The log can be used to show what kind of specific investments the organization has made towards staff's cyber security expertise.

For each training the documentation should include:

• Time
• Topics and duration of the training
• Training method and trainer
• Staff involved in the training

The security guidelines are specified in connection with the employee's job role. The organization has identified units and roles that require separate guidance and develops its own detailed security guidelines for these.

Examples of units that may require their own guidelines are e.g. customer service, IT and HR. Examples of work roles that require their own instructions are the system administrators and the remote workers.

Before granting access rights to data systems with confidential information employees have:

• received appropriate guidance on their security responsibilities (including reporting responsibilities and responsibility for their own devices)
• received appropriate guidance on their security roles related to their own role (including digital security rules related to their role and information systems and their acceptable use)
• received information from cyber security contacts who can be asked for more information

If staff have conflicting goals with the security guidelines, they are unlikely to follow the guidelines.

The organization actively seeks to find poorly functioning guidelines and modify either the guidelines, tools or staff priorities to enable following the guidelines.

The organization needs to remind employees of their roles and security responsibilities. The reminder reinforces staff security awareness, safe practices and compliance with guidelines and legal requirements related to their job role.