1. Goal

Vertia’s information security team ensures the smooth operation and security of Vertia’s information systems.

Information security refers to the secure handling of all data, regardless of its format. Information security involves ensuring the confidentiality, integrity, and availability of data.

Vertia’s business operations require that its information systems function smoothly and securely. To ensure this, information security is actively monitored, and any deviations are addressed promptly in accordance with predefined procedures.

Information security is implemented and developed using solutions that are appropriate in terms of risk and cost-effective. Operations take into account the agreements with employees, customers, and partners, privacy protection, and other legal requirements. Information security measures are used to manage the risks associated with the adoption of new operating methods and technologies.

Customer and other personal data are used only for purposes permitted by contracts and the law, and are accessible only to those who need them for their work.

 

2. Responsibilities and Organization

The business unit is responsible for defining information security requirements for information systems and for ensuring adequate resources for information security. The information security team is responsible for developing business continuity plans for processes critical to the business. These plans are maintained, tested, and practiced regularly to ensure they remain up to date.

The Information Security Team ensures that information security risks are identified and assessed, and that the necessary measures are implemented to keep information security up to date. The information security team is responsible for ensuring that the business complies with requirements based on laws and other external regulations in its operations. The information security team is responsible for providing information security guidance, defining general information security requirements, and overseeing technical information security. Information security solutions are implemented using up-to-date technologies, with particular attention paid to user experience and usability.

It is the responsibility of all members of the information security team to ensure that employees are aware of information security issues so that they can recognize security threats and respond appropriately when they encounter them.

All employees are required to familiarize themselves with and comply with the provided guidelines, as well as to report any information security threats or risks they identify. As part of its normal operations, the information security team is responsible for monitoring employees’ compliance with information security guidelines and, if necessary, addressing any actions that violate information security policies and guidelines.

3. Information Security Policies

Risk Assessment

Information security risks are assessed and analyzed based on their impact on business operations. The assessment must be conducted during the specification phase of new systems and in connection with significant changes that affect the criticality of operations.

Centralized user rights management

The goal is for the administrators of all systems and the information security team to define the principles for granting access rights. Access rights for external users are managed centrally.

Classification and Processing of Data

Vertia uses a data security classification method that defines how data is classified and how data in different categories is handled.

Processing of Personal Data

The processing of personal data via remote connections is prohibited without specific procedures in place. Exceptions must be approved by the information security team and may be implemented in accordance with separately agreed-upon methods.

Cybersecurity Training

Every Vertia employee participates in information security training or reviews the information security guidelines.

Supervision and Monitoring

Improving and maintaining information security requires systematic and continuous monitoring of information systems. Those responsible for monitoring are bound by a duty of confidentiality regarding the information they handle in the course of their work. They are required to sign a confidentiality agreement, whether they are employed by Vertia or a third party.

The information security situation is reported as part of normal internal monitoring. Technical information security is continuously assessed.

Handling of Security Incidents

Vertia has effective procedures and tools in place to detect information security incidents. In addition, it has contingency plans in place and conducts regular drills.

 

4. Monitoring of Service Providers

Suppliers must agree to comply with the data protection requirements set by Vertia, which are outlined in the data protection addendum to the service agreements.

 

5. Data Breaches

Any action that violates the information security policy or guidelines is considered an information security breach. Information security is monitored in accordance with best practices for oversight.

 

6. Communication with staff and partners

Both an internal and a public version of the information security policy will be published. The internal version will be communicated to all staff. The public version will be published in Finnish on Vertia’s website and shared with partners.

 

7. Approval and Adoption of the Information Security Policy

 

This policy takes effect immediately.

 

Helsinki, May 14, 2018