Organizations are required to use the national ICT system for reporting incidents and data breaches and for exchanging sensitive information.

The ICT system serves as a central platform for:

• Cooperation
• Generating and sharing recommendations for actions to improve cybersecurity levels
• Reporting and handling incidents
• Estimating risk at the national level
• Warning about cyber threats
• Supervisory activities
• Reporting personal data breaches
• Exchanging information

Organizations must work closely with others in the National Cybersecurity System to improve overall protection against cyber threats.

Each organization must assign at least two people who are responsible for maintaining communication with other cybersecurity-related entities in the national system. These people act as the main contact points for collaboration and information sharing.

The organization must also support its service users by helping them understand cyber threats. This includes making relevant information available—such as tips, warnings, or educational content—especially on the organization’s website. The goal is to help users protect themselves when using the service.

Additionally, the organization must offer users an easy way to report cyber threats, incidents, or security weaknesses related to the service. This shows the organization is taking an active role in improving cybersecurity for everyone involved.

Once officially listed in the National Cybersecurity System, the organization must start using the designated ICT system to communicate and cooperate, within the required timeframe defined by law.

If the organization is a micro or small business, it only needs to assign one person to be responsible for maintaining communication with other key and important entities.

Organisaation olisi laadittava selkeät menettelyt tietojen vaihtamiseksi kansallisten kyberturvallisuusviranomaisten kanssa.

Näihin menettelyihin olisi sisällyttävä:

• nimetään erityinen henkilöstö, joka vastaa tästä viestinnästä.
• Määritellään, miten tietojen toimittamista viranomaisille rajoitetaan.
• Sen varmistaminen, että viranomaisilta saadut tiedot suojataan ja että niitä käytetään tiukasti aiottuun tarkoitukseen, kuten organisaation omien järjestelmien turvaamiseen.