National and international classified information must be stored and processed, both within security areas and outside them, in a manner that ensures protection against unauthorized access.

If the organization processes international classified information, it must designate a corresponding registry. The registry must be designated as a security area.

The receipt and dispatch of national information of classification levels II–III and international information of classification level III (Confidential) or higher must be recorded.

The processing of information of classification level III or higher must be logged in an electronic log, information system, case management system, or equivalent.

International information of classification level III (Confidential) or higher must be recorded in the designated registry.

Turvallisuusluokitellun tiedon käsittelyssä tulisi ottaa huomioon:

TL IV:

• Pääsy tietoon suojattu sivullisilta
• Käsittely tapahtuu toimivaltaisen viranomaisen hyväksymällä turva-alueilla
• TL IV tietoja sisältävät tietovarannot ja käsittelyyn käytettävät järjestelmät on sijoitettava viranomaisen hyväksymälle turva-alueelle

Estämisellä tarkoitetaan tiedon suojaamista sekä henkilöiltä, joilla ei ole tiedonsaantitarvetta (need-to-know) kyseiseen keskusteltavaan tietoon että laittomalta tiedustelulta.

Äänieristysvaatimus kohdistuu ainoastaan alueen niihin tiloihin, joissa keskustellaan turvallisuusluokitelluista tiedoista. Äänieristystä voidaan arvioida esimerkiksi kuuntelemalla keskustelua tilan ulkopuolelta ovien, seinien sekä ilmastointiputkien ja muiden läpivientien kohdalta. Tilan äänieristystä voidaan myös tarvittaessa verrata rakenteille annettavaan ilmaääneneristävyysvaatimukseen.

Äänieristysvaatimus voidaan tarvittaessa saavuttaa esimerkiksi tilan uudelleen sijoittelulla, rakenteiden ja läpivientien eristävyyden parantamisella tai arvioitavan tilan ulkopuolisten tilojen taustamelulla.

When storing and processing international classified information in a security area, independent access rights may only be granted to individuals properly authorized by the organization. The authorized individual must hold a valid international personnel security clearance (PSC) and a special permit to access the area based on need-to-know requirements.

The organization stores paper documents and other non-digital information:

• in a suitable office cabinet within a security area or administrative area, or
• temporarily outside security areas if the information handler has committed to following the compensating measures specified in the issued security instructions.

The organization stores digital information:

• in a compliant device or electronic medium within a security area or administrative area, or
• outside security areas, in a compliant terminal device or electronic medium located in a supervised space or in a suitable locked office cabinet, security bag, or in an equivalent manner.

If the area does not have a storage solution assessed as sufficient for information storage, the walls, floor, ceiling, windows, and doors of the area must meet at least the RC3 class of the SFS-EN-1627 standard.

If a locked office cabinet is used as the storage unit for classified information, it must be ensured that any intrusion attempt leaves visible signs of forced entry.

Turvallisuusluokan IV asiakirjoja sisältävät tietovarannot ja näiden asiakirjojen käsittelyyn käytetyt tietojärjestelmät on sijoitettava turvallisuusalueelle (hallinnollinen alue tai turva-alue).

Turvallisuusluokan II tai III asiakirjoja sisältävät tietovarannot ja näiden asiakirjojen käsittelyyn käytetyt tietojärjestelmät on sijoitettava turva-alueelle.

The organization stores paper documents and other non-digital information in an appropriate storage solution within a security area.

The organization stores digital information:

• in a compliant device or electronic medium within a security area, or
• outside security areas, in a compliant terminal device located in a supervised space or in a suitable locked office cabinet, security bag, or in an equivalent manner.

International classified information of classification level III (confidential) may not be stored in an administrative area.

Organization stores paper documents and other non-digital information in a storage solution within a security area that has been assessed as appropriate.

The organization stores digital information in a compliant device or electronic medium within a security area.

Turvallisuusluokan I asiakirjaa saa säilyttää ainoastaan turva-alueella.

The organization must inspect all electronic devices before they are used in areas where classification level II information is processed, if the threat to the information is assessed as high.

The area itself must also be inspected physically or technically at regular intervals, as well as in cases of suspected or confirmed unauthorized entry.

The organisation must define procedures and roles for access rights and key management in the area. Access to the area can be restricted either mechanically, electronically or based on personal identification. A responsible person shall be appointed for the area to manage the access rights and key management procedures. Spare keys for the area shall be stored securely and locked in a sealed storage envelope with a date of closure and receipt or, alternatively, in a key cabinet connected to an access control system. Keys shall be handed over in connection with the job and against receipt. The procedure is described in the security management guidelines. Access to the area is not permitted with a master key suitable for a lower level facility.

A responsible person has been appointed to ensure the following access rights and key management procedures are in place.

• Access rights and key management procedures and roles are established, documented and instructed.
• A list of access rights and key holders is maintained.
• Access rights are regularly audited and kept up to date.
• responsibility for additional orders and changes to keys and access codes is assigned.
• key cards, unallocated keys and access codes are stored appropriately.
• the reason for key issuance is documented.
• keys are issued only to the person with independent access rights to the area.
• changes in personnel are communicated to the key management authority as appropriate.

Individuals other than those properly authorized by the organization (visitors) must always be accompanied by an escort. The host of the visitors must have independent access rights to the security area being visited, as well as the authority to host visitors. Visitor procedures must ensure that the confidentiality of the information processed or stored in the area is not compromised.

Maintenance activities in the area may only be performed by, or under the supervision of, personnel with independent access rights. Information processing in the area is prohibited during maintenance, installation, and cleaning activities if there is a risk that the personnel performing these tasks could gain access to the protected information.

Unescorted visitor procedures may be approved for those visitors who meet the requirements for granting access rights.

The organization has approved a procedure for visitors, which may address, for example, the following matters:

• Visitors are identified and provided with a visitor badge.
• Visits are recorded.
• Visitors are never allowed or left in the areas unsupervised, and the host is responsible for external persons throughout the visit.
• Staff are instructed on hosting visitors.
• Ensuring that visitors cannot unlawfully see, hear, or otherwise gain access to protected information.
• Staff are instructed to respond to individuals moving within the area without proper identification.

Hallinnollisella alueella on oltava selkeästi määritelty näkyvä raja, mutta aluetta rajaavalle rakenteelle (seinät, ovet ja ikkunat sekä lattia- ja kattorakenteet) ei aseteta erityisiä vaatimuksia. Alueen rakenne voi olla normaalia toimistorakennetta.

Aluetta rajaavia rakenteita tulee vahventaa, mikäli alueella säilytetään turvallisuusluokiteltua tietoa ja murtoriski arvioidaan todennäköiseksi. Näitä vahvennuksia tulee arvioida suhteessa alueen ympäröivien tilojen antamaan muuhun suojaan sekä vartiointihenkilöstön vasteaikaan.

Only properly authorized individuals may have independent access to an administrative area. Independent access may be granted either by the organization responsible for the information or, under agreed procedures, by the service provider responsible for managing the physical facility, such as a cloud service provider.

The area and its doors may be equipped with an intrusion detection system (burglar alarm system) if classified information is stored in a lockable office cabinet within the area and the risk of forced entry is assessed as likely.

The area or the routes leading to it may also be equipped with an intrusion detection system (burglar alarm system) if classified information is stored in the area and the risk of forced entry is assessed as likely. When assessing the possible use of an intrusion detection system or an alternative arrangement, the response time assessment discussed in connection with structural requirements must be taken into account.

If the area is monitored by an intrusion detection system, it is recommended that the system remain active when the area is unoccupied. The system's control unit should be located within the security area it protects.

A security area must have a clearly defined visible boundary. If the area does not have a storage solution assessed as sufficient for information storage, the walls, floor, ceiling, windows, and doors must provide the level of security required for storing the information.

Openings in the area that are not used for passage must be lockable or closed off with bars or strong steel grilles, in order to reliably control access to the area. Such openings must be monitored by an intrusion detection system if the area is not staffed around the clock or if the premises are not inspected at the end of normal working hours and at random times outside working hours.

The structures of the area must be reinforced if classified information is stored there and the risk of forced entry is assessed as likely. In such cases, the boundary and structures of the area should be made of concrete, steel, brick, or strong wood. Inadequate structures, such as normal office construction, must be reinforced. These reinforcements must be evaluated in relation to the additional protection provided by the surrounding premises and the response time of security personnel.

Emergency exits must not pass through the security area.

Turva-alueen rajalla käytettävän kulunvalvontajärjestelmän etäyhteydet ja lukijalaitteiden asennus tulee toteuttaa riskienarvioinnin perusteella riittävän tietoturvallisesti siten, että järjestelmään pääsy on vain valtuutetuista päätelaitteista ja verkoista ja että tietoliikenneyhteys ja kulunvalvontajärjestelmän rajapinnat on suojattu siten, että ulkopuolisilla ei ole pääsyä välitettyihin tietoihin.

Kulunvalvontajärjestelmän sijoitustilan tulisi sijaita sen suojaamalla turvallisuusalueella.

Independent access rights to a security area may only be granted to an individual properly authorized by the organization, whose reliability has been verified and who holds a special permit to enter the area.

Reliability should primarily be verified through the personnel security clearance procedure.

Access to the area must be based on a need-to-know requirement. In specific cases, a special permit may also be granted on the basis of a work requirement within the area. A responsible person must be designated for the area to oversee the management of access rights, entry identifiers, and keys.

If entering a security area effectively grants immediate access to the classified information stored there:

• the highest security classification of the information normally stored in the area must be clearly indicated, and
• all visitors must have explicit permission to enter the area, must always be accompanied by an escort, and their reliability must be appropriately verified, unless it has been ensured that they will not have access to classified information.

Each security area must have defined security procedures to be followed. These procedures must include instructions on:

• storing and processing information within the area, including the classification levels of information that may be handled or stored there
• applicable monitoring and protective measures
• granting access rights to the area, specifying the individuals who may enter without an escort based on special authorization and verified reliability
• visitor management, including procedures for using escorts or protecting classified information when access is granted to other individuals
• other relevant measures and procedures.

Alue, jolla ei ole henkilöstöä palveluksessa vuorokauden ympäri, on tarvittaessa tarkastettava normaalin työajan päätteeksi ja satunnaisiin aikoihin työajan ulkopuolella, paitsi jos alueelle on asennettu tunkeutumisen ilmaisujärjestelmä (murtohälytysjärjestelmä).

Alueen raja ja rakenteet (seinät, ovet ja ikkunat sekä lattia- ja kattorakenteet) ja/tai alueelle johtavat reitit voidaan varustaa tunkeutumisen ilmaisujärjestelmällä (murtohälytysjärjestelmä), mikäli alueella säilytetään turvallisuusluokiteltua tietoa ja murtoriski arvioidaan todennäköiseksi.

Järjestelmän etäyhteydet ja hallintalaitteiden asennus tulee toteuttaa riskienarvioinnin perusteella riittävän tietoturvallisesti siten, että järjestelmään pääsy on vain valtuutetuista päätelaitteista ja verkoista ja että tietoliikenneyhteys ja tunkeutumisen ilmaisujärjestelmän rajapinnat on suojattu siten, että ulkopuolisilla ei ole pääsyä välitettyihin tietoihin. Tunkeutumisen ilmaisujärjestelmän sijoitustilan tulisi sijaita sen suojaamalla turvallisuusalueella.

Alueen tunkeutumisen ilmaisujärjestelmän hallinta tulee olla organisaation omassa hallinnassa. Hallinta voi olla ulkoistettu riskien arvioinnin ja tehtävien eriyttämisen perusteella.

The keys or access codes for storage units may only be held by individuals who have a need to know the information stored in the unit. These individuals must memorize the number combinations.

The number combinations for storage units containing classified information must be changed:

• when factory codes are replaced upon receipt of a new secure storage unit
• whenever there is a change in personnel who know the combination
• whenever the information has been compromised or is suspected to have been compromised
• whenever one of the locks has been serviced or repaired.

Remote administration of classification level III processing environments must be carried out from within a security area. For classification level III and other critical processing environments, remote administration must be technically bound to approved remote administration equipment (e. g. device authentication).

Kun salassa pidettävää tietoa siirretään viranomaisen sisäisessä verkossa, organisaatio suorittaa riskinarvioinnin. Tulosten perusteella voidaan joko käyttää alemman tason salausta tai salaamatonta tiedonsiirtoa.

Kun turvallisuusluokiteltua tietoa siirretään hyväksyttyjen fyysisesti suojattujen turvallisuusalueiden sisäpuolella, alemman tason salausta tai salaamatonta siirtoa voidaan käyttää riskinhallintaprosessin tulosten perusteella toimivaltaisen viranomaisen erillishyväksyntään perustuen.

Tilanteissa, joissa turvallisuusluokiteltua tietoa siirretään fyysisesti suojattujen turvallisuusalueiden sisäpuolella,

a) ko. turvallisuusluokan liikennekanava on fyysisesti suojattu (esimerkiksi kaapelointi, joka kulkee kokonaisuudessaan suppean, esimerkiksi vain yhden huoneen kattavan ko. turvallisuusluokan tiedon säilytykseen hyväksytyn fyysisesti suojatun turvallisuusalueen sisällä), tai

b) tieto suojataan riittävän turvallisella matalamman tason salauksella (esim. HTTPS ko. turvallisuusluokan verkon sisäisessä liikenteessä).

Remote access to systems is restricted to a security area approved by the competent authority.

Classification level I information may only be stored or otherwise processed within security areas, which also imposes restrictions on the possibilities for remote access.

Alue ja sinne johtavat ovet voidaan varustaa tunkeutumisen ilmaisujärjestelmällä (murtohälytysjärjestelmä), mikäli alueella säilytetään turvallisuusluokiteltua tietoa lukittavassa toimistokalusteessa ja murtoriski arvioidaan todennäköiseksi.

Tunkeutumisen ilmaisujärjestelmää voidaan käyttää täydentävänä monitasoisen suojauksen riskienhallintakeinona tai esimerkiksi tilan tekemiseksi "valvotuksi".