Get an overview of safety and security management

Safety culture is an area of organisational culture that consists of structures, values and practical activities that affect the organisation’s safety.

Safety culture reflects an organisation’s basic values, norms, assumptions and expectations that are included in the operating principles of the company.

− Regional State Administrative Agency

Safety management is comprehensive and systematic operation that promotes safety, and it includes all the procedures and activities that can be used to achieve good overall safety.

− Regional State Administrative Agency

Administrative information security is the management and planning of information security in an organisation.

Administrative information security is the basis for all information security and it determines how the organisation’s information security is managed on the basis of the risk assessment prepared by the organisation.

Administrative information security defines the objectives, principles and policies of different areas of information security, for example. It includes

• information security policies
• risk assessments related to information security
• management commitment
• communicating about information security and
• training on topics related to information security.

Administrative information security supports the activities of the organisation’s senior management, and it must proactively adapt to changes in the operating environment.

Human resources security is part of information security. It includes minimising staff-related reliability risks with the help of

• position descriptions
• definition of access rights
• training
• supervision and
• security clearances.

The national information security auditing criteria for authorities is an information security auditing tool for authorities. It divides safety management into two areas: administrative information security and human resources security.

The assessment criteria for information security in public administration is an information security auditing tool for the development and assessment of information security, intended for public administration. It covers

• administrative security
• physical safety and security
• technical security
• preparedness and continuity management, and
• data protection.

The criteria can be used to assess compliance with the information security requirements laid down in the Act on Information Management in Public Administration, the Government Decree on Security Classification of Documents in Central Government and, in part, the General Data Protection Regulation.

• Turvallisuusjohtaminen (Regional State Administrative Agencies, PDF, in Finnish)Opens in a new window.
• Information security auditing tool for authorities – Katakri 2020 (National Security Authority)Opens in a new window.
• Koulutus: Julkisen hallinnon tietoturvallisuuden arviointikriteeristö (Julkri) (Information Management Board, in Finnish, PDF)Opens in a new window.