Kyberturvallisuusstandardit NIS2-direktiivin riskienhallintavelvoitteen tukena - Timlin, Päivi (2024)
The European Union's NIS2 directive imposes a cybersecurity risk management obligation on a wide range of organizations of different sizes and operating in different sectors. The NIS2 directive is supposed to be implemented by the national cyber security law, which is under consideration by the parliament when this thesis was written. The thesis explained what is included in the risk management obligations of the NIS2 directive and the draft cybersecurity law. In addition, it was clarified which are the key cybersecurity standards and exact standard points in terms of the obligations of the law, as well as the similarities and differences in the application of the standard in relation to the obligations of the legislation. The master's thesis was carried out as a design science study, the result of which is a construction, i.e. a design product. The construction includes the most general cybersecurity standards and applicable references to the risk management obligation of the cybersecurity law and Traficom's draft recommendations. The theoretical reference framework needed for the construction was formed from the risk management obligation and cyber security standards presented in the law. The construction was based on Traficom's draft recommendations for NIS supervisory authorities on cybersecurity risk management measures. The construction presents the standard references corresponding to the national cybersecurity law from information security management systems to the ISO/IEC 27001:2022 standard and the NIST CSF 2.0 reference framework, to the cybersecurity risk management ISO/IEC 27005:2022, NIST SP 800-30 and NIST SP 800-37 standards, supply chain security to the ISO 28000:2022 and NIST SP 800-161 standards, and to the ISO/IEC 27035-1:2023, ISO/IEC 27035-2:2023 and NIST SP 800-61 standards, which deal with deviation management. The construction is published as part of the standard references contained in Traficom's recommendation and the cross-reference table attached to the recommendation. Cybersecurity standards support the organization in preparing for legal obligations. The requirements of information security management systems are largely the same as in the draft cybersecurity law. They provide a systematic way to perform cybersecurity risk management and help maintain up-to-date documentation. However, the use of the standard does not guarantee that risk management is up-to-date and proportionate.