Publications of the Prime Minister’s Office 2024:13
functionality and improving incident resistance, particularly when considering
cybersecurity and various service and supply chain interdependencies. Secure
information systems are a foundation for societal cyber resilience. Attention must
be paid to procuring, developing and maintaining such systems in both the public
and private sectors.
Public services are secure
It is important for public services to be secure in use, and for individuals and
organisations to have confidence in their operational reliability. The cybersecurity of
public services is managed proactively based on knowledge of circumstances and
on threat and risk assessments. Comprehensive and reliable situational awareness
is needed concerning the standards and shortcomings of cybersecurity in public
services in order to manage risks and reinforce cybersecurity. The impact, benefits
and costs of cybersecurity are monitored with focus areas prioritised. Technologies
and service provision must comply with cybersecurity, information security and
data protection requirements throughout their life cycle. The assessment and
approval of compliance in public services and the associated evaluation criteria
must be developed, streamlined, and made mandatory where necessary. It is
also important to develop and require automatic monitoring and supervision
of the technical environment. Prioritisation of service functionality according to
circumstances must be ensured, with preparations made for potential incidents,
and for minimising their impact on the operations of public authorities and society.
Preparedness is a joint endeavour
Cybersecurity preparedness is implemented in close partnership according to
the model of comprehensive security. Identifying cyber threats and preparing for
them must be based on systematic management by information, and on shared
situational awareness derived from anticipation, observation, intelligence collection
and the application of research findings. Intelligence supports preparedness and
anticipation in order to safeguard national security by collecting and sharing
intelligence information on the abilities of hostile cyber operators, and on the goals
and targets of cyberattacks.
Finland also pursues a preparedness operating model that emphasises
collaboration and dialogue within the EU and NATO, promoting application of the
cybersecurity preparedness model and best practice in partner countries. Mutual
trust between various stakeholders in society and trust in public institutions and
28