Tietoturvallisuuden itsearviointimallin kehittäminen turvallisuuskriittisessä organisaatiossa - Rönkä, Aleksanteri (2023)
Organizations aim to ensure the accessibility, integrity, and reliability of their information assets by implementing security controls within their operational environments. In information systems of safety-critical organizations, sensitive or classified information is frequently processed, requiring compliance with security criteria and formal auditing. Official auditing is always conducted by an external inspection body, but performing an internal self-assessment can prepare the organization, thus conserving resources during the actual audit. The organization's security level can also be improved by self-assessing information systems that are not intended for external audits. Self-assessment should be systematic and continuous, requiring a framework to be in place. The objective of this research was to identify best practices in self-assessment for information security and develop a self-assessment model using design science research methodology for the target organization. The theoretical foundation for the model was established through a literature review, followed by the development of the artifact, the self-assessment model. The best practices of the model were then compared to data obtained from expert interviews to validate the model. The result of the research is a self-assessment model for information system security, providing the self-assessment team in the target organization with theory-based best practices and improvement suggestions for their existing operational model. Additionally, the model is open to further development, which was one of the goals in the development of the artifact.