Measure success and improve processes

Decide on the key objectives for preparedness and continuity. Based on these, your organisation can set appropriate indicators that best support them. The achievement of the objectives must be monitored and developed regularly.

Ensure that your organisation

• assesses and documents the development of continuity management
• maintains documentation appropriately and
• ensures that the managers receive reports.

You should prepare a report on the indicators, which you, as a manager, can use to identify appropriate development areas and to appropriately allocate the organisation’s resources.

Signs of good risk management include

• the organisation’s perception ability (perception of critical risks related to preparedness)
• setting appropriate controls for the risks identified
• functional risk management methods
• development of risk management methods.

TAISTO is an open and free digital security exercise for practising, testing and developing digital security operating models in organisations. The exercises focus on

• the management
• leadership and
• communication of disruptions.

The exercise is designed for public sector organisations, but other actors can also use it. Read more about the TAISTO exercise on the Digital and Population Data Services Agency’s website (in Finnish)Opens in a new window..

TIETO is a cooperation and information exchange exercise aimed at companies and authorities that are critical for the security of supply. In the exercise, they practise operating during extensive hybrid, cyber and information disruptions. Together with authorities, the companies test their

• continuity management
• preparedness and
• crisis communications.

The exercise is a scenario-based strategic-level exercise. Read more about the TIETO exercise on the Digipooli website of the Technology Industries of Finland (in Finnish)Opens in a new window..

The National Cyber Security Centre has compiled a collection of cybersecurity deviations on the basis of which your organisation can build different exercises.
The deviations test, for example,

• definitions of responsibilities related to subcontracting chains
• contingency arrangements for critical functions
• device management and documentation of the device environment
• managing critical information in outsourced services.

Read more about the scenarios on the National Cyber Security Centre’s website (in Finnish).Opens in a new window.

• Materials for securing critical infrastructure (Traficom)Opens in a new window.

In Finland, the National Cyber Security Centre monitors the operational reliability of communication networks and services related to digital security and monitors the situation picture of cybersecurity.

• The services of National Cyber Security Centre (Traficom)Opens in a new window.