Implement observation and handling processes

The ability to observe digital security risks and the handling processes that monitor and support the observations are important for managing information security risks. The handling processes related to observations and information security risks must be approved by the senior management of the organisation, and observation capacity and processes must be actively developed as the operating environment changes. The processes must also be documented and communicated across the organisation.

Supervision of the use of information systems must be carried out in a documented manner. Supervision and communications are used to manage several information security risks and to improve the organisation’s ability to detect information security risks.

The monitoring and reporting of security breaches develop information security risk management:

1. Document any security breaches detected.
2. Identify the risks that led to the breaches.
3. Try to reduce the harm caused by risks.

The identified security breaches must be analysed, classified and documented comprehensively. The analysis of security breaches supports the management of information security risks and the development of a safety culture and information security.

The classification of deviations helps report information security deviations to the management. By reporting the deviations comprehensively, you help the management understand the key development targets of the organisation.

When reporting deviations, follow the guide’s page Monitor, document and report risks.

Your organisation must have a deviation management process. In practice, this means the following:

1. Staff and stakeholders are aware of their duties and role in reaction measures.
2. Communication, coordination and reporting practices have been defined.
3. Digital security disruptions are managed and their impact mitigated.

During the recovery phase, your organisation will recover from the digital security disruption to its normal operating state and continue its operational development. During the recovery phase, your organisation

1. creates and develops a disaster recovery plan for critical systems to be protected based on experience and
2. draws up plans for any reputational damage caused by disruptions.

Read more about the recovery phase in the framework of digital security architecture (in Finnish)Opens in a new window..